NewsThe Register — Security
Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'
Teaser from the source
From October 26, only high and critical cases stay private as project seeks help sharing the workload
This is the RSS-feed teaser. Read the full article at the original source.
Read at The Register — SecurityMore on maintainers
Other advisories
- HighCVE-2026-26231Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea
- HighCVE-2026-26231Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
- Not ratedosv:ECHO-1445-d49a-1c4bThere is no fix for the cve, and the maintainers kind of ignore it as a minor issue. It is somewhat disputed, but ideally we would fix it. https://security-tracker.debian.org/tracker/CVE-2024-56433 https://github.com/shadow-maint/shadow/issues/1157
- Not ratedosv:ECHO-d89c-9245-720bThis vulnerability is considered negligible, and upstream maintainers stated a fix is impossible without breaking existing workflows. https://security-tracker.debian.org/tracker/CVE-2020-15778 https://github.com/cpandya2909/CVE-2020-15778
- Not ratedosv:ECHO-06e5-62cc-395fThis issue has been fixed to the best ability of the maintainers by adjusting host key ordering to always use the default if the client has learned a hostkey matching the best-preference algorithm. Fixes beyond this are considered to reduce overall security by the maintainers. https://security-tracker.debian.org/tracker/CVE-2020-14145 https://docs.ssh-mitm.at/vulnerabilities/CVE-2020-14145.html
- Not ratedosv:ECHO-701c-0998-5cefThis vulnerability is disputed by the openssh maintainers, and is considered expected behavior. As long as scp is used within trusted servers, this vulnerability should not affect the image. https://security-tracker.debian.org/tracker/CVE-2019-6110 https://lists.mindrot.org/pipermail/openssh-unix-dev/2019-January/037475.html
- Not ratedosv:ECHO-765e-25a4-4a31This vulnerability is disputed by the openssh maintainers. https://security-tracker.debian.org/tracker/CVE-2018-15919 https://www.openwall.com/lists/oss-security/2018/08/24/1 https://www.openwall.com/lists/oss-security/2018/08/27/2
- Not ratedosv:ECHO-195a-a2de-ff9aThis vulnerability is disputed by the opensh maintainers and is considered expected behavior. https://security-tracker.debian.org/tracker/CVE-2016-20012 https://github.com/openssh/openssh-portable/pull/270 https://www.openwall.com/lists/oss-security/2018/08/24/1
Other news entries
- Microsoft releases emergency .NET security fixes for Google Brotli bugNewsThe Register — Security
- Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape SandboxesNewsThe Hacker News
- Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patchesNewsThe Register — Security
- Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT SecurityNewsSecurityWeek
- Debian's latest kernel security update has 1,313 reasons to patchNewsThe Register — Security
- Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth CredentialsNewsThe Hacker News
- Public Exploits Released for Four Linux Kernel Flaws That Enable Local RootNewsThe Hacker News
- OpenAI Investigates Report Linking AI Agents to RubyGems AttackNewsSecurityWeek
ID