proj: X.Org X server and Xwayland
subj: [vs-plain] Preview of X.Org Security Advisory (xserver) for 2026-07-08
trep: Wed Jul 01 00:22:27 2026
cves: CVE-2026-55999, CVE-2026-56000, ZDI-CAN-30498, ZDI-CAN-30561
tcrd: July 08, 2026 at 01:00 UTC
toss: Wed Jul 08 01:55:08 2026
soss: [oss-security] FW: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland
loss: https://www.openwall.com/lists/oss-security/2026/07/08/2

proj: libXfont2
subj: [vs-plain] Preview of X.Org Security Advisory (libXfont2) for 2026-07-08
trep: Wed Jul 01 00:28:10 2026
cves: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003, ZDI-CAN-30558, ZDI-CAN-30559, ZDI-CAN-30560
tcrd: July 08, 2026 at 01:00 UTC
toss: Wed Jul 08 01:35:41 2026
soss: [oss-security] FW: X.Org Security Advisory: multiple security issues in libXfont2
loss: https://www.openwall.com/lists/oss-security/2026/07/08/1

proj: Linux
subj: [vs-plain] Januscape: Guest-to-Host Escape in KVM/x86
trep: Wed Jul 01 15:02:52 2026
cves: CVE-2026-53359
tcrd: 5 day embargo \\ 2026-07-06 16:00 UTC
lpub: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb
toss: Mon Jul 06 16:26:14 2026
soss: [oss-security] Januscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-53359)
loss: https://www.openwall.com/lists/oss-security/2026/07/06/7

proj: ntfs-3g
subj: [vs] ...
trep: Wed Jul 08 20:22:55 2026
cves: CVE-2026-42616, CVE-2026-42617, CVE-2026-42618, CVE-2026-46569, CVE-2026-46570, CVE-2026-46571, CVE-2026-46572, CVE-2026-56135, CVE-2026-56136
tcrd: 2026-07-15 12:00 UTC
toss: Wed Jul 15 19:00:04 2026
soss: [oss-security] Multiple vulnerabilities in ntfs-3g
loss: https://www.openwall.com/lists/oss-security/2026/07/15/6

proj: Kata Containers
subj: [vs-plain] Subject: [pre-KCSA] Vulnerability in Kata Containers runtimes (both rust and go) (CVE-2026-50540)
trep: Sat Jul 11 09:18:33 2026
cves: CVE-2026-50540
tcrd: 2026-07-20, 1200UTC
toss: Sun Aug 23 18:51:59 2026
soss: [oss-security] Vulnerability in Kata Containers runtimes (both rust and go) (CVE-2026-50540)
loss: https://www.openwall.com/lists/oss-security/2026/08/23/3

proj: BusyBox dpkg applet
subj: [vs] BusyBox dpkg applet: OS command injection -> root RCE (CWE-78)
trep: Mon Jul 13 03:14:45 2026
tcrd: 2026-07-27 \\ I'm withdrawing this
toss: Mon Aug 24 05:01:24 2026
soss: [oss-security] BusyBox dpkg applet: OS command injection
loss: https://www.openwall.com/lists/oss-security/2026/08/24/2

proj: snapd
subj: [vs] LPE in snapd and other vulnerabilities
trep: Mon Jul 13 13:23:42 2026
cves: CVE-2026-8933, CVE-2024-5300, CVE-2026-15226
tcrd: 2026-07-21 14:00:00 UTC
toss: Tue Jul 21 14:58:39 2026
soss: [oss-security] LPE in snapd and other vulnerabilities
loss: https://www.openwall.com/lists/oss-security/2026/07/21/1

proj: Linux
subj: [vs-plain] Advance notice of CVE-2026-53362 exploit publication
trep: Mon Jul 13 15:33:16 2026
cves: CVE-2026-53362, CVE-2026-53366
tcrd: 2026-07-17 15:00 UTC
toss: Mon Jul 20 16:45:01 2026
soss: [oss-security] CVE-2026-53362, CVE-2026-53366: OOB write in UDP MSG_SPLICE_PAGES fragment-boundary handling in Linux kernel
loss: https://www.openwall.com/lists/oss-security/2026/07/20/2

proj: Exim
subj: [vs-plain] Exim GCVE-25-2026-07-45-1, GCVE-25-2026-07-45-3: security update 4.99.4 -> 4.99.5
trep: Mon Jul 13 19:25:42 2026
cves: GCVE-25-2026-07-45-1, GCVE-25-2026-07-45-3, EXIM-Security-2026-06-22.1, EXIM-Security-2026-06-22.3
tcrd: Wednesday, Jul 20th, 2026, at 14:00 UTC
toss: Wed Jul 22 15:57:06 2026
soss: [oss-security] security release for Exim
loss: https://www.openwall.com/lists/oss-security/2026/07/22/9

proj: OpenStack Swift
subj: [vs] ...
trep: Tue Jul 14 19:36:43 2026
cves: CVE-2026-71191, CVE-2026-71192, OSSA-2026-030
tcrd: 2026-07-28 15:00 UTC
toss: Tue Jul 28 15:49:36 2026
soss: [oss-security] [OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-pending)
loss: https://www.openwall.com/lists/oss-security/2026/07/28/26

proj: OpenStack Swift
subj: [vs] ...
trep: Tue Jul 14 19:41:38 2026
cves: CVE-2026-71190, OSSA-2026-031
tcrd: 2026-07-28 15:00 UTC
toss: Tue Jul 28 15:49:39 2026
soss: [oss-security] [OSSA-2026-031] OpenStack Swift: Proxy denial of service via Accept header (CVE-2026-pending)
loss: https://www.openwall.com/lists/oss-security/2026/07/28/27

proj: OpenStack ironic-python-agent
subj: [vs] ...
trep: Wed Jul 15 20:46:39 2026
cves: CVE-2026-54422, OSSA-2026-028
tcrd: 2026-07-23 15:00 UTC
toss: Thu Jul 23 19:21:09 2026
soss: [oss-security] [OSSA-2026-028] OpenStack Ironic Python Agent: Credential extraction via malicious container (CVE-2026-54422)
loss: https://www.openwall.com/lists/oss-security/2026/07/23/4

proj: OpenStack ironic-python-agent
subj: [vs] ...
trep: Wed Jul 15 20:51:01 2026
cves: CVE-2026-66138, OSSA-2026-027
tcrd: 2026-07-23 15:00 UTC
toss: Thu Jul 23 19:21:36 2026
soss: [oss-security] [OSSA-2026-027] OpenStack Ironic Python Agent: Command execution via unsanitized config (CVE-2026-pending)
loss: https://www.openwall.com/lists/oss-security/2026/07/23/5

proj: Linux
subj: [vs] Qualys Security Advisory (2026-07-15)
trep: Wed Jul 15 21:55:23 2026
cves: RefluXFS, CVE-2026-64600
tcrd: aware of the 14-day embargo limit \\ no later than July 30th \\ Wednesday, July 22, 16:00 UTC
toss: Wed Jul 22 16:47:30 2026
soss: [oss-security] RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600)
loss: https://www.openwall.com/lists/oss-security/2026/07/22/14

proj: GNU inetutils talkd
subj: [vs-plain] GNU inetutils talkd buffer overflow with long DNS names.
trep: Fri Jul 17 05:44:17 2026
tcrd: 2026-07-24
toss: Sat Jul 25 16:59:19 2026
soss: [oss-security] GNU Inetutils talkd buffer overflow with long DNS names.
loss: https://www.openwall.com/lists/oss-security/2026/07/25/3

proj: Unbound
subj: [vs] ...
trep: Mon Jul 20 13:54:16 2026
cves: CVE-2026-32665, CVE-2026-40691, CVE-2026-44690, CVE-2026-55973, CVE-2026-14586, CVE-2026-44621, CVE-2026-50045, CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251, CVE-2026-50252, CVE-2026-52863, CVE-2026-55717, CVE-2026-55990, CVE-2026-55991, CVE-2026-56416, CVE-2026-56444, CVE-2026-41637, CVE-2026-42955, CVE-2026-44687, CVE-2026-46582, CVE-2026-54478, CVE-2026-55708
tcrd: 22 July 2026
toss: Wed Jul 22 15:56:26 2026
soss: [oss-security] Unbound: 1.25.2 addresses multiple CVE items
loss: https://www.openwall.com/lists/oss-security/2026/07/22/7

proj: rsyslog
subj: [vs-plain] EMBARGOED: rsyslog imptcp regex-framing remote denial of service
trep: Mon Jul 20 15:41:50 2026
tcrd: 2027-07-22 12:00 CEST (10:00 UTC) \\ 2026-07-22 12:00 CEST (10:00 UTC)
toss: Wed Jul 22 15:56:09 2026
soss: [oss-security] rsyslog v8.36.0 through v8.2606.0: imptcp regex-framing remote denial of service
loss: https://www.openwall.com/lists/oss-security/2026/07/22/5

proj: BIND 9
subj: [vs] ...
trep: Tue Jul 21 11:59:43 2026
cves: CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321
tcrd: 22 July 2026
toss: Wed Jul 22 15:56:35 2026
soss: [oss-security] ISC has disclosed nine vulnerabilities in BIND 9 (CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321)
loss: https://www.openwall.com/lists/oss-security/2026/07/22/8

proj: OpenStack Neutron
subj: [vs] ...
trep: Tue Jul 21 18:10:22 2026
cves: CVE-2026-55707
tcrd: 2026-07-29 15:00 UTC
toss: Wed Jul 29 15:09:19 2026
soss: [oss-security] [OSSA-2026-032] OpenStack Neutron: Subnetpool onboarding cross-project subnet mutation (CVE-2026-55707)
loss: https://www.openwall.com/lists/oss-security/2026/07/29/5

proj: Linux
subj: [vs-plain] Linux kernel LPE affecting a number of distros
trep: Thu Jul 23 09:24:18 2026
cves: OVSwrap, CVE-2026-64531
tcrd: Monday, July 27, 6am UTC \\ Tuesday 6am UTC \\ may slip a couple of hours on the 6am UTC timeline
toss: Tue Jul 28 10:06:15 2026
soss: [oss-security] OVSwrap (CVE-2026-64531): Linux kernel/OVS local root vulnerability
loss: https://www.openwall.com/lists/oss-security/2026/07/28/8

proj: gzip
subj: [vs] ...
trep: Sat Jul 25 19:04:48 2026
cves: CVE-2026-41992
tcrd: August 1
toss: Sun Aug 23 16:37:12 2026
soss: [oss-security] CVE-2026-41992 gzip 1.14 out-of-bounds memory buffer access
loss: https://www.openwall.com/lists/oss-security/2026/08/23/1

proj: libXfont2
subj: [vs-plain] Preview of X.Org Security Advisory (libXfont2) for 2026-08-05
trep: Thu Jul 30 06:07:01 2026
cves: CVE-2026-59679, CVE-2026-44950
tcrd: Aug 05, 2026 at 01:00 UTC
toss: Wed Aug 05 02:15:57 2026
soss: [oss-security] FW: X.Org Security Advisory: multiple security issues in libXfont2
loss: https://www.openwall.com/lists/oss-security/2026/08/05/1