Security for teams connecting data, documents and agents to AI.
Articles 706
Cyber ·
Security advisory dated 7 October 2026: with the LDAP group resolver configured, YuniKorn 1.8.0 through versions before 1.10.0 can crash from an out-of-bounds read. CVSS 4.0 score 2.1, low severity.
Cyber ·
The X.Org project published security fixes for several flaws in the X server and Xwayland, in versions xorg-server-21.1.25 and xwayland-24.1.14, according to an advisory dated 7 October 2026.
Cyber ·
Low-severity advisory: the Apache Impala executor web server does not validate JWT/OAuth token signatures, which can allow access to resources when that mode is enabled. Versions 4.1.0 through 4.5.2 are affected.
Cyber ·
A user with SELECT permission can insert JavaScript into a table alias, which runs in the browser of whoever opens the query plan in the web interface. Affects versions 2.7.0 to 4.5.2; the fix is in 4.5.3.
Cyber ·
Advisory rated important: a crafted relative path can bypass trusted_jar_paths in Impala 4.5.2 and load an attacker-controlled JAR. The fix is in version 4.5.3.
Cyber ·
Moderate-severity advisory for Apache log4net: the RemoteSyslogAppender strips characters outside visible ASCII and space from log records in versions before 3.5.0.
Cyber ·
Moderate advisory for Apache log4net: a NUL character in logged content ends the OutputDebugStringAppender debug output in versions before 3.5.0.
Cyber ·
Apache log4net advisory on EventLogAppender: long messages are truncated to a size above what the Windows Event Log accepts and are then dropped without warning. Moderate severity, CVSS 3.1 score 5.3.
Cyber ·
Moderate-severity vulnerability (CVSS 3.1: 5.3) in Apache log4net: reading request parameters can trigger an ASP.NET validation failure and prevent the event from being logged in the aspnet-request converter. Versions before 3.5.0 are affected.
Cyber ·
Moderate vulnerability in the Apache log4net SmtpPickupDirAppender: content the e-mail file writer cannot encode, such as an unpaired UTF-16 surrogate, can cause the whole batch to be dropped. Versions before 3.5.0 are affected.
Cyber ·
Advisory from the oss-sec feed dated October 6, 2026, on the EventLogAppender in Apache log4net. A NUL character in logged content ends the Windows Event Log record. Moderate severity, CVSS 3.1 score of 5.3.
Cyber ·
Low-severity advisory on Apache Commons BCEL's Class2HTML, which generates pages with unescaped class strings and allows stored XSS in versions before 6.13.0. Published by Gary D. Gregory on October 6, with CVSS 3.1 and 4.0 scores disclosed.
Cyber ·
Security advisory on nested Code and Record attributes that can cause unbounded recursion in the ClassParser of Apache Commons BCEL before 6.13.0. Severity rated important, with CVSS 3.1 at 5.9 and CVSS 4.0 at 8.2.
Cyber ·
The feed announces the publication of the ISC Stormcast episode for Wednesday, October 7, 2026. The item gives the title, date and a link to the episode page, but does not describe the content.
Cyber ·
Let's Encrypt will issue and renew certificates valid for 64 days starting February 10, 2027, and recommends testing automated renewal on its staging environment from October 14, 2026.
Cyber ·
Ubuntu security notice: the Ubuntu Pro for WSL attach token appeared in command line arguments when enabling a subscription, potentially exposing confidential information and access to Ubuntu Pro repositories.
Cyber ·
Ubuntu security notice on librsvg: duplicate XML entity declarations in SVG may lead to denial of service or arbitrary code execution, according to the notice text.
Cyber ·
Ubuntu Security advisory with fixes for libsoup flaws that can cause denial of service, information exposure and bypass of controls, published on October 6, 2026.
Cyber ·
Ubuntu Security advisory on four CVEs in U-Boot, involving ZFS metadata, ext4 filesystems and fragmented IP traffic, with possible impact of arbitrary code execution or denial of service.
Cyber ·
Radar report from The Record feed: an alleged creator of ATM malware appears in a Nebraska court after arrest. The source says he was added in March to the FBI's Ten Most Wanted Fugitives list, becoming the first cybercriminal ever placed on it.
Looking for something else?DocumentationContact
