Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
An improper authorization check in the similar-questions search let authenticated users view metadata of non-public questions in Apache Answer up to version 2.0.2. The fix is in version 2.0.3. The original advisory rates the severity as moderate.
Cyber ·
A moderate-severity flaw in Apache Answer up to version 2.0.2 let unauthenticated attackers access comments tied to non-public content through public user profiles. The fix is in version 2.0.3.
Cyber ·
A moderate-severity flaw in Apache Answer up to version 2.0.2 let unauthenticated attackers obtain metadata of hidden questions through public answer profiles. The fix is in version 2.0.3, according to the advisory posted to the oss-sec list on 15 October.
Cyber ·
A missing authorization flaw in Apache Answer up to version 2.0.2 lets holders of a global API key read answers to hidden, deleted or pending-review questions through the MCP answer retrieval tool. Moderate severity. Fixed in version 2.0.3.
Cyber ·
Low-severity advisory on missing visibility checks in Apache Answer, which can expose the list of invited users for non-public questions. The fix is in version 2.0.3.
Cyber ·
Moderate-severity advisory: up to version 2.0.2 of Apache Answer, a verification code sent by email could be accepted in another sensitive workflow, enabling account takeover. The fix is in version 2.0.3.
Cyber ·
Low-severity advisory: in Apache Answer up to version 2.0.2, a user with only the question unpin permission can hide or restore questions when custom roles separate these permissions.
Cyber ·
Public advisory rated low severity: the Apache Answer importer up to version 2.0.2 stores question bodies as raw HTML without the usual sanitization, which opens room for stored XSS.
Cyber ·
Sensitive information written to log files in Apache Answer up to version 2.0.2. Full API keys are logged on every authenticated request, and the fix is in version 2.0.3. Severity reported as low.
Cyber ·
Low-severity advisory on Apache Kylin: a project administrator can use a cache API to exhaust resources of calculated columns in versions 4.0.0 through 5.0.4. The fix is in version 5.0.5.
Cyber ·
Low-severity advisory: the default Apache Kylin startup profile through version 5.0.4 lacks security settings. Version 5.0.5 fixes the issue, according to the advisory posted to the oss-sec list.
Cyber ·
Listing for an episode of the SANS Internet Storm Center Stormcast, dated October 16, 2026. The source has no body text, no summary of findings and no further technical details.
Cyber ·
An SANS ISC diary dated October 16, 2026 argues that the cybersecurity sector may be approaching AI security the wrong way. The available text is an opinion, with no methods or test data.
Cyber ·
A message on the oss-sec list, dated 15 October 2026, questions an earlier alert about a recently registered domain, but acknowledges the incident may have occurred. The domain registration was last modified on 10 October 2026.
Cyber ·
An oss-sec mailing list follow-up reports that a fake recruiter campaign, using engineering job emails that led to a bash script, has been taken down. The registrar applied a clientHold to the domain on 10 October 2026.
Cyber ·
According to a machine-translated report from The Record, a cyberattack on a government service provider halted all production of bankruptcy notices at federal courts. The report is dated October 15, 2026.
Cyber ·
Medium-severity security advisory: improper neutralization in Vim's Rust support may allow execution of Ex commands through Cargo Quickfix hooks. A CVE has been requested but not yet assigned.
Cyber ·
A post on the oss-sec list, dated October 15, 2026, describes host memory disclosure and presents the flaw as a guest-to-host escape in KVM. More details are promised later.
Cyber ·
Researchers report zero-click spyware infecting devices worldwide through targeted advertising. The item is a machine translation of a security news feed.
Cyber ·
Cisco Talos analysis (machine-translated) compares CVE and KEV growth, highlights the patch backlog and cites espionage activity attributed to UAT-6275. CVEs rose 105% and KEVs 37% year over year.
Looking for something else?DocumentationContact
