// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server
CVE-2026-115845 concerns incomplete validation in the Python sandbox used by AWS MCP Server's run_script tool.
-
Ruby Regexp compilation fixes related to GitLab's CVE's
Ruby released Regexp compilation fixes related to GitLab CVEs.
-
CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server
An open-source Multi Model Server has CVE-2026-115812 and CVE-2026-115813 affecting model archive extraction; the AWS inference tool is end-of-life.
-
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
CVE-2026-87912 and CVE-2026-87913 identify missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server.
-
CVE-2026-87911
A security bulletin describes CVE-2026-87911, an AWS-related vulnerability report.
-
CVE-2026-85788 - Issue with awslabs mysql-mcp-server
A CVE reports an issue in awslabs mysql-mcp-server, a tool for connecting MySQL databases with Model Context Protocol clients.
-
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
A stored cross-site scripting issue in OpenSearch Dashboards involves a bypass of a Vega expression function.
-
CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope
CVE-2026-85787 affects Amazon's PostgreSQL MCP server, allowing disallowed SQL inputs to modify data beyond read-only limits.
-
PHP Informational advisory: Session upload progress (CVE-2026-115560)
PHP published an informational security advisory for CVE-2026-115560, which affects session upload progress functionality.
-
Oracle Security Alert Advisory - CVE-2026-91403
An out-of-cycle security alert from Oracle addresses CVE-2026-91403 with a fix considered too critical to wait for the next patch update.
-
CVE-2026-115748: Apache Vysper: Authorization bypass
A security advisory reports an authorization bypass in Apache Vysper, an XMPP server library, affecting all versions and allowing authenticated users to compromise other accounts.
-
CVE-2026-115721: Apache Vysper: Unbounded allocation
A CVE describes unbounded XML parsing allocation in the retired Apache Vysper XMPP server library, potentially causing out-of-memory conditions.
-
CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input
A medium-severity CVE-2025-60497 describes a NULL pointer dereference in GPAC MP4Box GetESD triggered by crafted MP4 input, causing denial of service.
-
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
A security alert update summarized recent PHP vulnerabilities and returned to normal status.
-
CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input
A CVE describes an invalid memory read in GPAC MP4Box when processing crafted MP4 files, potentially causing denial of service.
-
CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input
A CVE describes uncontrolled recursion in GPAC MP4Box BIFS decoder triggered by crafted MP4 files, causing stack exhaustion.
-
CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input
A heap use-after-free in GPAC MP4Box's dasher_flush_segment function can be triggered by crafted MPEG-2 TS input, assigned CVE-2025-60491.
-
CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input
A heap use-after-free vulnerability in GPAC MP4Box can be triggered by crafted MPEG-2 Transport Stream input and has been assigned CVE-2025-60490.
-
CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input
CVE-2025-60489 is a NULL pointer dereference in GPAC MP4Box triggered by crafted MP4 input, causing a denial of service; a fix is available.
-
CVE-2025-60487: NULL pointer dereference in GPAC/MP4Box gf_isom_get_esd via crafted XML input
A null pointer dereference in GPAC MP4Box may cause a denial of service when processing crafted XML input.
-
CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
Apache Camel CoAP component versions before 4.18.5 and 4.22.2 can expose sensitive information through unmuted consumer exceptions.
-
CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
CVE-2026-95664 affects Apache Camel’s AWS2-S3 producer, which evaluates untrusted S3 object keys from the CamelAwsS3Key header as simple expressions.
-
CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
A vulnerability in Apache Camel’s Keycloak component can accept expired access tokens because cached introspection results are not limited by token expiry.
-
CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
A path traversal vulnerability in Apache Camel Docling can allow remote authenticated users to write conversion output to arbitrary directories.
-
CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
Apache Camel Docling component has a path traversal vulnerability in versions 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2, affecting custom CLI argument validation.
-
CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
CVE-2026-94386 affects Apache Camel OAuth component versions 4.19.0 through 4.22.1, where a token cache may reuse credentials across scopes.
-
CISA Adds One Known Exploited Vulnerability to Catalog
A SQL injection vulnerability in Arista VeloCloud Orchestrator, CVE-2026-114625, was added to the Known Exploited Vulnerabilities catalog after evidence of active exploitation.
-
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
A Palo Alto Networks advisory says PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect some of its products, with severity rated high.
-
DSA-6579-1 roundcube - security update
A security update for Roundcube webmail has been released for Debian systems.
-
DSA-6580-1 erlang - security update
A security update has been released for the Erlang programming language packages on Debian.