Vulnerabilities & updates
Page 9
Fri, October 16
Backstage: Improper access control in backend action invocation
影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8 An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
影響: go:github.com/getkin/kin-openapi >= 0.136.0, < 0.149.0 → 0.149.0 The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone parseArray function, the top-level array check in UrlencodedBodyDecoder, and MultipartBodyDecoder. Three additional crash paths were missed. All of them reach the unguarded urlValuesDecoder.parseArray method (openapi3filter/req_resp_decoder.go:576) or the u…
Introducing dotnetup: A toolchain manager for .NET
Learn how the new dotnetup tool helps macOS and Linux developers install, manage, and update user-local .NET SDKs and runtimes. The post Introducing dotnetup: A toolchain manager for .NET appeared first on .NET Blog .
MariaDB Foundation Newsletter – 15 October 2026
The first half of October belonged to the ecosystem. The MariaDB Ecosystem Hub passed 200 entries six months after launch, Laravel 13 gained native MariaDB Vector support through community contributors, and Frappe and Solanica joined the Foundation as Silver Sponsors. The Foundation’s testing framework learned PostgreSQL, reproduced a regression reported by Mark Callaghan and confirmed […] MariaDB Foundation Newsletter – 15 October 2026 appeared first on MariaDB.org
Google Summer of Code 2026 With the Kotlin Foundation: Recap
Google Summer of Code 2026 has wrapped up! This was the Kotlin Foundation’s fourth year participating in GSoC, bringing new contributors into the Kotlin open-source ecosystem through hands-on projects and mentorship. This year, two projects successfully reached completion, tackling two areas of the ecosystem: improving recursion support in the Kotlin/Wasm backend and building a global […]
Thu, October 15
What Makes a Great KotlinConf Proposal?
The KotlinConf 2027 Call for Papers is now open! We invite developers from across the Kotlin community to bring their ideas, experiences, and expertise to the stage in Kraków. Do you have a Kotlin lesson or discovery that could help other developers? Perhaps you solved a difficult technical problem, introduced Kotlin into an existing codebase, […]
Solanica joins MariaDB Foundation as a Silver Sponsor
We are pleased to welcome Solanica, the company driving the development of OpenEverest, as a MariaDB Foundation Silver Sponsor. OpenEverest is an open-source platform for deploying and managing databases on Kubernetes. Its recently added MariaDB support gives developers and platform teams another way to bring MariaDB into their infrastructure, with deployment, high availability, backups and […] Solanica joins MariaDB Foundation as a Silver Sponsor appeared first on MariaDB.org
PostgreSQL 19 RC 1 Released!
The PostgreSQL Global Development Group announces that the first release candidate of PostgreSQL 19 is now available for download. As a release candidate, PostgreSQL 19 RC 1 will be mostly identical to the initial release of PostgreSQL 19, though some more fixes may be applied prior to the general availability of PostgreSQL 19. The next scheduled update release for supported versions of PostgreSQL, on November 12, 2026, will include a large number of fixes. Because of this, the release team decided to include these fixes in PostgreSQL 19 before its general availability. This means a second re…
Announcing Rust 1.99.1
The Rust team has published a new point release of Rust, 1.99.1. Rust is a programming language that is empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup, getting Rust 1.99.1 is as easy as: rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website. What's in 1.99.1 Rust 1.99.1 fixes the following regressions from prior releases: Missing symbol wcslen : Some Rust targets were getting link errors for missing wcslen , and that function is now present in Rust's compiler-bui…
[悪用確認] CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian Multiple Products Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-18)
Add email to any Laravel Cloud environment with the Resend
Resend is now a first-party Laravel Cloud integration. Connect once, verify a domain, and attach email to an environment like any other resource.
MariaDB Foundation: Reproducing and Validating MDEV‑37992 with TAF
Thanks to Mark Callaghan for filing MDEV‑37992. This regression only appears under specific LRU and buffer‑pool conditions, and requires a memory‑resident workload to expose. Using TAF, I reproduced the issue across 11.8, 12.3, and 13.1 using both parent commits and patched commits from MDEV‑33966. The fix restores expected throughput in all branches. The workload used […] MariaDB Foundation: Reproducing and Validating MDEV‑37992 with TAF appeared first on MariaDB.org
Why Is My Kubernetes Job Still Pending? Tracing Kueue Admission with Headlamp
You submit a Kubernetes Job and wait for its Pods to appear. A minute passes. Then another. The Job is still suspended, there are no application logs, and there may not even be a Pod to inspect. In a cluster managed by Kueue , this can be completely normal. Kueue may still be deciding whether the Job can use the requested resources. The useful question is not only “Why is the Pod pending?” It is first “Has Kueue admitted the Workload?” The Kueue plugin for Headlamp brings that investigation into the Headlamp UI. Instead of reconstructing the admission path from several commands and large YAML…
r9.0.4
r9.0.4
Next.js Security Update for Upstream Vulnerabilities
The October 14, 2026 out-of-band security update for Next.js is now available
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description: The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to e…
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting (XSS) vulnerabilities…
r9.0.2
r9.0.2
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit p…
Wed, October 14
KotlinConf Recap: Lessons from Verifone’s Architect on Kotlin in Mission-Critical Payments
This article was written by an external contributor. Yuri Geronimus’s four-year-old son once asked him what his job was. Yuri told him he writes books: books that describe what he wants to change in the physical world. His son didn’t fully get it. Neither would most engineers: if you understand the words in your application […]
Perseid 0.1.0 is now available
I am very pleased to announce that, after a long hiatus, Perseid 0.1.0, a set of utilities for versioning PostgreSQL database schemas, has been released. Perseid 0.1.0 is available from: Codeberg Git repository: https://codeberg.org/perseas/perseid Documentation is available at: https://perseas.codeberg.page/perseid/ Perseid is the successor to Pyrseas . It provides dbtoyaml and yamltodb to extract a PostgreSQL database schema as YAML and to generate or apply SQL to bring a target database into agreement with a YAML specification. This initial release supports SQL SCHEMAs, TABLEs, COLUMNs and…
Better HTTP/1 connection reuse
Go 1.27 includes a change to the HTTP client that can make programs sending many sequential HTTP/1 requests significantly faster.
[悪用確認] CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-76519: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
[悪用確認] CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-17)
containerd 2.3.7
Welcome to the v2.3.7 release of containerd! The seventh patch release for containerd 2.3 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14301 ) Image Distribution Apply hardening to reject image references with ".." path components ( #14281 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14248 ) Snapshotters Apply hardening to…
containerd 2.2.10
Welcome to the v2.2.10 release of containerd! The tenth patch release for containerd 2.2 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14300 ) Image Distribution Avoid hang and data corruption during multipart image fetch ( #14316 ) Apply hardening to reject image references with ".." path components ( #14280 ) Runtime Apply hardening to allowlist socket domains in…
containerd 2.4.2
Welcome to the v2.4.2 release of containerd! The second patch release for containerd 2.4 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14302 ) Image Distribution Fix excessive memory usage during image pulls when registry downloads outpace content writes ( #14342 ) Apply hardening to reject image references with ".." path components ( #14282 ) Runtime Apply hardening to allowlist socke…
containerd 2.0.14
Welcome to the v2.0.14 release of containerd! The fourteenth patch release for containerd 2.0 contains various fixes and updates including a security patch. Security Updates containerd GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14299 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14251 ) Snapshotters Apply hardening to filter ID-mapping labels from image annotations during unpack ( #14270 ) Please try out the release binaries and report any issues at https://github.…
nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).
Bagisto MariaDB Vector Semantic Search
I’m always interested to see how MariaDB Vector is being used in real applications, beyond the usual demos and simple similarity-search examples. In this guest post, the team behind Bagisto takes a very practical look at semantic search for e-commerce using MariaDB Vector. What I particularly like is that they don’t stop at showing it […] Bagisto MariaDB Vector Semantic Search appeared first on MariaDB.org
Announcing .NET 11 Release Candidate 2
.NET 11 Release Candidate 2 is available with improvements across libraries, runtime, SDK, MSBuild, NuGet, F#, ASP.NET Core, .NET MAUI, and Windows Forms. The post Announcing .NET 11 Release Candidate 2 appeared first on .NET Blog .
r8.3.13
r8.3.13
r8.0.34
r8.0.34
r7.0.45
r7.0.45
Tue, October 13
Agents on Rails: Stage 3. Can a model build on its own work?
Now that we understand better how agents deal with contained tasks and contained codebases, it’s time to push them a little harder. Stage 3 adds a set of large multi-step tasks that test how well a model can build on its own work over multiple sessions without turning it into a hot mess. We’ve also greatly expanded the variety of apps we test the models on.
Python 3.16.0 alpha 1 is now available
The first developer preview of Python 3.16 is ready for testing.
[悪用確認] CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
Microsoft Windows Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-16)
[悪用確認] CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-16)
.NET and .NET Framework October 2026 servicing releases updates
A recap of the latest servicing updates for .NET and .NET Framework for October 2026. The post .NET and .NET Framework October 2026 servicing releases updates appeared first on .NET Blog .
Community Spotlight: Slava Rozhnev and SQLtest.online
Open source runs on people. Not only the engineers who commit code, but everyone who builds tools, answers questions, writes tutorials and shows up when help is needed. Slava Rozhnev, creator of SQLtest.online, is one of those people for MariaDB. He has been creating SQL quizzes with the MariaDB Foundation for a while now, and […] Community Spotlight: Slava Rozhnev and SQLtest.online appeared first on MariaDB.org
Durable Task in the Real World: What Problems Does It Actually Solve?
Five practical examples of when durable execution makes sense, when it does not, and what it means for AI agents. The post Durable Task in the Real World: What Problems Does It Actually Solve? appeared first on .NET Blog .