Vulnerabilities & updates
Page 6
Wed, October 21
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
影響: npm:@apostrophecms/ai-helper >= 1.0.0-beta.10, < 1.0.0-beta.13 → 1.0.0-beta.13 The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL (the default), req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can generate a base64 AI image (which is persisted without a stored url) and then send an unauthorized PATCH accept request with an attacker-chosen Host header. The server then issues an outbound GET to the a…
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
影響: npm:apostrophe < 4.33.0 → 4.33.0 A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space. Details The endpoint is: text POST /api/v1/@apostrophecms/rich-text-widget/generate-csv-table In packages/apostrophe/modules/@apostrophecms/rich-text-widget/lib/apiRoutes.js, Multer first writes t…
ApostropheCMS: Cross-domain session token in URL confers session takeover
影響: npm:apostrophe < 4.33.0 → 4.33.0, npm:@apostrophecms/passport-bridge < 1.6.1 → 1.6.1 Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including passport.user) with no credentials. Details packages/apostrophe/modules/@apostrophecms/i18n/index.js: - Token generation on cross-host/locale flows (L479–487) and passport-bridge cross-locale redirect (passport-bridge/index.js L557–593) places the token in the U…
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5 The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…
ApostropheCMS: CAPTCHA response token not URL-encoded
影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5, npm:@apostrophecms/login-recaptcha < 1.2.1 → 1.2.1, npm:@apostrophecms/login-hcaptcha < 1.3.0 → 1.3.0 Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}' - packages/login-recaptcha/index.js:44 — same pattern for login - packages/login-hcaptcha/index.j…
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
影響: npm:apostrophe < 4.33.0 → 4.33.0 ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole (the core @apostrophecms/archive-page does), so a project can define restricted subtrees that only higher-privileged roles may create or edit within. The move() operation in the @apostrophecms/page module is supposed to enforce that a page may only be moved into a parent the actor has create rights over, the same boundary the page-insert route enforces. The destination-parent authoriza…
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
影響: npm:@apostrophecms/db-connect < 1.1.0 → 1.1.0, npm:apostrophe < 4.33.0 → 4.33.0 @apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project qu…
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
影響: npm:sanitize-html < 2.18.0 → 2.18.0 sanitize-html discards the content of every element in nonTextTags. It delimits that region using htmlparser2's close events, and ignores the isImplied flag htmlparser2 passes it. Closing a still-open ancestor from inside a makes htmlparser2 unwind its stack past the noscript; the synthetic implied close it emits on the way ends the discard region early, and everything after it is treated as ordinary body content. A browser with scripting enabled parses content as raw text, so the same…
follow-redirects array-form headers bypass cross-origin credential stripping
影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1 follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects…
follow-redirects sensitiveHeaders regex escaping can expose credential headers
影響: npm:follow-redirects >= 1.16.0, < 1.16.1 → 1.16.1 follow-redirects 1.16.0 introduced the sensitiveHeaders option (the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653), which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single case-insensitive regular expression built by concatenating the declared header names into an alternation after passing each through escapeRegex. escapeRegex escapes only a partial set of metacharacters and leave…
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
影響: npm:@angular/router >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/router >= 21.2.0, < 21.2.25 → 21.2.25 A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8) and RouterLink directives are rendered with queryParamsHandling: 'merge' or 'preserve', configured either per link or globally via defaultQueryParamsHandling. Starting in v21.2.0 ([angular/angular#66181](https://github.com/angular/angular/pull/66181)), RouterLink internals were refactored to use signals, introducing a computed signal (_urlTree) that cached the re…
Tue, October 20
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
影響: npm:@angular/router >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/router >= 21.0.0, < 21.2.25 → 21.2.25, npm:@angular/router >= 20.0.0, < 20.3.33 → 20.3.33, npm:@angular/router <= 19.2.25 A denial of service (DoS) vulnerability was identified in @angular/router when Server-Side Rendering (SSR) is enabled on Node.js (V8). During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as a:/(), x:/(...), or ///(...)) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrar…
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
影響: npm:hono >= 4.12.4, < 4.13.11 → 4.13.11 serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path once before routing. serveStatic decoded it again before resolving the file. With a malformed percent-encoded sequence, the first decode leaves part of the path encoded, the router matches the encoded for…
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
影響: npm:@angular/platform-server >= 22.0.0, < 22.2.1 → 22.2.1, npm:@angular/platform-server >= 21.0.0, < 21.2.25 → 21.2.25, npm:@angular/platform-server >= 20.0.0, < 20.3.33 → 20.3.33, npm:@angular/platform-server <= 19.2.25 An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering (SSR) is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl (or parseUrl in v20). While resolveUrl rejected protocol-relative URLs whose raw string directly started with //, this check ran prior to WHATWG URL normalization. When a request URL includes a popping dot-segment followed by multiple slash…
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
影響: npm:markdown-it >= 15.0.0, < 15.0.2 → 15.0.2, npm:markdown-it < 14.3.2 → 14.3.2 When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probabilit…
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress
影響: go:github.com/klauspost/compress <= 1.18.6 → 1.18.7 Signed Integer Overflow in s2.NewDict Summary A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. Package - Name: github.com/klauspost/compress/s2 - Ecosystem: Go - Affected ve…
Crass : Large numeric exponents cause CPU and memory denial of service
影響: rubygems:crass < 1.0.7 → 1.0.7 Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash. Patches This is fixed in Crass 1.0.7. Related - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/crass/GHSA-6wmf-3r64-vcwv.yml
Amazic joins MariaDB Foundation as a Silver Sponsor
MariaDB Foundation is pleased to welcome Amazic as a Silver Sponsor, adding a new supporter with strong connections across the software ecosystem. Amazic connects innovative software vendors with partners, developers and organisations looking to adopt modern technologies. Combining software distribution with technical enablement, training, content and community-focused events, Amazic helps bridge the gap between technology […] Amazic joins MariaDB Foundation as a Silver Sponsor appeared first on MariaDB.org
SLES 15.6 repositories are being retired
The SLES 15.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL ZYPP archive .General support for SUSE Linux Enterprise Server (SLES) 15 SP6 (15.6) ended on December 31, 2025 (by upstream). All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. If you are still on SLES 15.6 either update to a newer SP (SP7 at the time of this writing), or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for…
RHEL 10.0 and 9.6 repositories are being retired
The RHEL 10.0 and RHEL 9.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL YUM archive . All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. The rolling EL-10 and EL-9 repository RPMs are not affected. If you are still on RHEL 10.0 or 9.6 (or on Rocky Linux / AlmaLinux 10.0 or 9.6), please either update to a newer minor release, or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for ea…
FOSSASIA PGDay 2027: Bangkok, 9 March – CFP Open
We are happy to announce that FOSSASIA PGDay returns to Thailand on 9 March, 2027 , bringing the PostgreSQL community together at True Digital Park, Bangkok . Visit the PGDay website for more details. About Event FOSSASIA PGDay is an annual gathering for PostgreSQL users, developers, and enthusiasts, bringing together the community from across Asia and beyond. Co-located with the FOSSASIA Summit, the event provides a focused forum for sharing knowledge, practical experiences, and insights into PostgreSQL and its growing ecosystem. Previous editions have taken place in Singapore, Vietnam, Thai…
Announcing rustup 1.29.2
The rustup team is happy to announce the release of rustup version 1.29.2. Rustup is the recommended tool to install Rust , a programming language that empowers everyone to build reliable and efficient software. What's new in rustup 1.29.2 This is a small release which only updates the rustls-webpki and webpki-root-certs dependencies to address the problematic eMudhra intermediate certificates issue described in CVE-2026-111943 . See also RUSTSEC-2026-0382 . Further details are available in the changelog ! How to update If you have a previous version of rustup installed, getting the new one i…
[悪用確認] CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens Software Center Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
[悪用確認] CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
[悪用確認] CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
Quarterly contributor outreach
Hi Django community, thank you all for continuing to contribute to Django. The Steering Council is reaching out to bring people's attention to a few areas. We have major features we'd like to test and review for 6.2 , smaller changes that could use attention and then various New Feature ideas we'd like community input on. Major features These PRs are things we'd like to refine, test and get merged in. We're looking for people to test the features themselves and review the PRs . Please see our guidelines on reviewing PRs . CompositeField (multi-column subqueries) (this only needs testing, not…
aiohttp server lacks an initial request/header timeout
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
AIOHTTP: Secure attribute not enforced for shared cookie
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The Secure attribute was not being enforced for the shared cookie. Impact It may be possible to send a shared cookie marked Secure through an unencrypted request.
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests.
russh: Unbounded memory allocation in agent protocol server via crafted constraint records
影響: rust:russh <= 0.64.0 → 0.64.1 russh_keys::agent::server::add_key (russh/src/keys/agent/server.rs:271-319) spawns a dedicated tokio task for every 5-byte SSH_AGENT_CONSTRAIN_LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks and…
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
影響: rust:russh >= 0.34.0-beta.1, < 0.64.0 → 0.64.0 In russh/src/server/encrypted.rs, server_read_auth_request_pk (0.63.3, around lines 880-990): The requested algorithm name (pubkey_algo) is read and only used to decode the key: PublicKeyOrCertificate::decode(&pubkey_algo, &pubkey_key). The derived hash_alg is then dropped (PublicKeyOrCertificate::PublicKey { ref key, .. }). The signature blob is decoded (Signature::decode) and verified with Verifier::verify(&pubkey, &buf, &sig). ssh-key picks the hash from the signature's own algorithm…
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
影響: pip:mercury >= 3.0.0, < 3.2.11 → 3.2.11 Mercury turns Jupyter notebooks into shared web apps/dashboards. The mr.Markdown widget converts its input to HTML with python-markdown and no sanitization step. MarkdownWidget is an ipywidgets.HTML widget, whose value is written to the page as raw HTML (via innerHTML) with no sanitization, so the result reaches the DOM verbatim. When an app passes untrusted data (database rows, user submissions, uploaded file contents, or an external/LLM API response) to mr.Markdown, HTML/JS in that da…
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4 A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
影響: go:github.com/envoyproxy/ai-gateway >= 0.4.0-rc1, < 1.2.0-rc1 → 1.2.0-rc1 The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT sub claim) specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification's documented session-hijacking guidance (https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#session-hijacking). However, the session-resume path never checks that discriminator against the current caller's identity, so any client that obtains a session ID…
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
影響: pip:graphifyy >= 0.7.2, < 0.9.70 → 0.9.70 The Fortran extractor's C-preprocessor step (graphify/extractors/fortran.py, _cpp_preprocess) applies an incomplete #include hardening. The -nostdinc -I /dev/null flags it relies on (comment "Security (F-007)") do not stop a capital-F Fortran source file from including absolute paths (#include "/etc/passwd") or from path-traversing out of the corpus (#include "../../../../home/victim/.ssh/id_rsa"). cpp always searches the directory of the file being preprocessed for quoted includes and…
Mercury: Unauthenticated Remote Code Execution via /api/kernels
影響: pip:mercury <= 3.2.5 → 3.2.6 Mercury runs a JupyterLab server with anonymous access by default (mercury_app/__main__.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints. The vulnerability /api/kernels is NOT in the blocklist (and cannot be — Mercury needs kernels…
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5 loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…
Get Your .NET MAUI App Ready for Xcode 27
Use an agent skill to prepare your existing .NET MAUI app for Xcode 27, with the scene lifecycle changes and manual migration steps explained. The post Get Your .NET MAUI App Ready for Xcode 27 appeared first on .NET Blog .
Bring Your Own Model to the GitHub Copilot SDK with C#
The GitHub Copilot SDK gives your application an agent runtime. BYOK lets you keep that runtime while sending model requests to your own Microsoft Foundry or Azure OpenAI deployment. Here is the complete C# setup. The post Bring Your Own Model to the GitHub Copilot SDK with C# appeared first on .NET Blog .
Sun, October 18
crecheck v6.0 has been released
Antananrivo, Madagascar - October 14, 2026 PostgreSQL credcheck extension The credcheck PostgreSQL extension provides few general credential checks, which will be evaluated during the user creation, during the password change and user renaming. By using this extension, we can define a set of rules: allow a specific set of credentials reject a certain type of credentials deny password that can be easily cracked enforce use of an expiration date with a minimum of day for a password define a password reuse policy define the number of authentication failure allowed before a user is banned define…
pgBackRest 2.60.0 Released
October 18, 2026 : The pgBackRest community is pleased to announce the release of pgBackRest 2.60.0, the latest version of the reliable, easy-to-use backup and restore solution that can seamlessly scale up to the largest databases and workloads. pgBackRest supports a robust set of features for managing your backup and recovery infrastructure, including: parallel backup/restore, full/differential/incremental backups, block incremental backup, multiple repositories, delta restore, parallel asynchronous archiving, malware/ransomware protection, per-file checksums, page checksums (when enabled) v…
FOSDEM PGDay 2027: two days of PostgreSQL, with calls for papers and sponsors now open!
Join us for FOSDEM PGDay 2027 on January 28 and 29 at the Brussels Marriott Hotel Grand Place . This year, we're expanding to two days, bringing you more PostgreSQL talks and more time to connect with fellow enthusiasts from around the world. Start your FOSDEM trip with dedicated PostgreSQL content, then enjoy the main FOSDEM event over the weekend! - New for 2027: sponsor the event - For the first time, we're offering sponsorship opportunities for FOSDEM PGDay! Our Platinum , Gold and Silver packages offer different ways to get involved. Platinum and Gold packages include an exhibition desk…
pg_utl_smtp v2.0 released
Antananarivo, Madagascar - October 06, 2026 PostgreSQL UTL_SMTP compatibility extension pg_utl_smtp is a PostgreSQL extension to create, manage and use Oracle-style UTL_SMTP package. The use and behavior is just like with the UTL_SMTP Oracle package. This work is released from the HexaRocket project. This extension allows email notifications to be sent from triggers or stored procedures. By integrating the extension directly into the database, you can trigger data-driven actions without waiting for application intervention. Examples include security alerts or notifications when certain minimu…
pg_hint_plan v1.9.0 Released
The pg_hint_plan development team is pleased to announce pg_hint_plan 1.9.0. This release of pg_hint_plan adds compatibility with PostgreSQL 19, and includes various improvements and bug fixes. For more details, see the release notes . This new major version includes support for path generation strategies (PGS). pg_hint_plan is a PostgreSQL extension that offers the possibility to tweak PostgreSQL execution plans using so-called "hints" in SQL comments. For more information, see the project page . The documentation of the project is published at this page , and is synced up automatically from…
Sat, October 17
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.6.0 → 2.6.0 A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation. Root Cause UpdateUser (handler backen…