proj: Linux
subj: [vs-plain] Zapscape: Guest-to-Host Escape in KVM/x86
trep: Sat Aug 01 18:01:59 2026
cves: Zapscape, CVE-2026-64561
tcrd: 2026-08-06 16:00 UTC
lpub: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2abd5287f083
toss: Thu Aug 06 16:06:44 2026
soss: [oss-security] Zapscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-64561)
loss: https://www.openwall.com/lists/oss-security/2026/08/06/6

proj: OpenStack designate
subj: [vs] ...
trep: Mon Aug 03 22:58:25 2026
cves: CVE-2026-71193, CVE-2026-71194, OSSA-2026-034
tcrd: 2026-08-11, 1500UTC
toss: Tue Aug 11 16:08:33 2026
soss: [oss-security] [OSSA-2026-034] OpenStack Designate: Cross-tenant DNS zone overlap and mDNS DoS via pool scheduling (CVE-2026-71193, CVE-2026-71194)
loss: https://www.openwall.com/lists/oss-security/2026/08/11/6

proj: rsync
subj: [vs-plain] rsync 3.5.0 - 33 CVEs - embargo until 2026-08-13 00:00 UTC
trep: Fri Aug 07 05:57:59 2026
tcrd: 13th August 2026 at 00:00 UTC (10am Canberra, Australia time on the 13th)
toss: Thu Aug 13 01:07:25 2026
soss: [oss-security] rsync 3.5.0 released with fixes for 33 CVEs
loss: https://www.openwall.com/lists/oss-security/2026/08/13/1

proj: Linux
subj: [vs-plain] Report Guest-to-Host DoS Vulnerability via TAP
trep: Fri Aug 07 16:31:48 2026
tcrd: Wednesday, August 12, at 16:00 UTC
toss: Wed Aug 12 17:04:20 2026
soss: [oss-security] Linux kernel: Guest-to-Host DoS via TAP
loss: https://www.openwall.com/lists/oss-security/2026/08/12/20

proj: OpenStack Keystone
subj: [vs] ...
trep: Tue Aug 11 04:12:07 2026
cves: CVE-2026-80182, CVE-2026-80184, OSSA-2026-037
tcrd: 2026-08-18 15:00 UTC \\ 2026-08-25, 1500 UTC
toss: Tue Aug 25 23:11:08 2026
soss: [oss-security] [OSSA-2026-037] OpenStack Keystone: Inconsistent scope enforcement for delegated tokens (CVE-2026-pending)
loss: https://www.openwall.com/lists/oss-security/2026/08/25/9

proj: OpenRGB
subj: [vs] encrypted subject
trep: Tue Aug 11 13:49:52 2026
cves: CVE-2026-59682, CVE-2026-59683, CVE-2026-18794
tcrd: about 2 weeks until Mid-August \\ Aug 25 \\ 2026-08-25 at 4:00 PM CEST \\ Monday August 24 4PM CEST
lpub: https://codeberg.org/OpenRGB/OpenRGB/commit/d2dd9dcc7369e78f47d01ace19af3750cd89ae66
toss: Tue Aug 25 16:19:22 2026
soss: [oss-security] OpenRGB: Remote System Compromise via Custom Network Protocol (CVE-2026-59682, CVE-2026-59683, CVE-2026-18794)
loss: https://www.openwall.com/lists/oss-security/2026/08/25/4

proj: OpenSSL
subj: [vs-plain] Embargoed OpenSSL security issues
trep: Tue Aug 11 16:02:48 2026
cves: CVE-2026-18798, CVE-2026-63072, CVE-2026-63076, CVE-2026-14457, CVE-2026-54874, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-75803
tcrd: 25th August 2026
toss: Tue Aug 25 16:17:53 2026
soss: [oss-security] OpenSSL Security Advisory [25th August 2026]
loss: https://www.openwall.com/lists/oss-security/2026/08/25/3

proj: OpenStack Aodh and Watcher
subj: [vs-plain] Vulnerabilities in OpenStack Aodh and Watcher (CVE-2026-pending)
trep: Tue Aug 11 20:59:47 2026
cves: CVE-2026-76878, OSSA-2026-036
tcrd: 2026-08-19 15:00 UTC
toss: Wed Aug 19 19:08:45 2026
soss: [oss-security] [OSSA-2026-036] OpenStack Aodh and Watcher: Aodh cross-project alarm enumeration and Watcher webhook authorization bypass (CVE-2026-pending)
loss: https://www.openwall.com/lists/oss-security/2026/08/19/5

proj: LyX
subj: [vs-plain] LyX security advisory (coordinated release 2026-08-17, 10am ET)
trep: Thu Aug 13 11:52:28 2026
tcrd: Aug 17 2026, 10am ET/ 4pm CET
toss: Mon Aug 17 15:16:03 2026
soss: [oss-security] LyX security advisory
loss: https://www.openwall.com/lists/oss-security/2026/08/17/1

proj: Kata Containers
subj: [vs-plain] Vulnerability in Kata Containers (CVE requested)
trep: Fri Aug 14 21:51:44 2026
cves: CVE-2026-77176, GHSA-fmg6-v47x-52wr
tcrd: 2026-08-20, 1200 UTC
toss: Thu Aug 20 21:33:16 2026
soss: [oss-security] CVE-2026-77176: Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy
loss: https://www.openwall.com/lists/oss-security/2026/08/20/19

proj: Emacs
subj: [vs-plain] Emacs zero-click local command execution via TRAMP
trep: Tue Aug 18 09:04:06 2026
cves: CVE-2026-79992
tcrd: on **Friday** \\ Friday 10am, GMT \\ Friday 21 August 2026, 10am GMT
toss: Fri Aug 21 17:51:06 2026
soss: [oss-security] Emacs zero-click local command execution via TRAMP
loss: https://www.openwall.com/lists/oss-security/2026/08/21/1

proj: uutils coreutils
subj: [vs-plain] uutils coreutils 'stdbuf' uses LD_PRELOAD on a world-writable temporary file
trep: Wed Aug 19 02:28:53 2026
tcrd: in a week, on 08-26-2026 \\ the issue is already disclosed publicly
lpub: https://github.com/uutils/coreutils/issues/13939#issuecomment-5303138075
toss: Thu Aug 20 03:06:08 2026
soss: [oss-security] uutils coreutils 'stdbuf' uses LD_PRELOAD on a world-writable temporary file
loss: https://www.openwall.com/lists/oss-security/2026/08/20/2

proj: NSD
subj: [vs] ...
trep: Wed Aug 19 12:49:25 2026
cves: CVE-2026-18664, CVE-2026-18916, CVE-2026-19401, CVE-2026-19538
tcrd: Wednesday 26 August 2026
toss: Fri Aug 28 20:57:46 2026
soss: [oss-security] NSD 4.15.1 security release
loss: https://www.openwall.com/lists/oss-security/2026/08/28/2

proj: rsyslog
subj: [vs-plain] EMBARGOED: rsyslog RainerScript replace() heap buffer overflow
trep: Thu Aug 20 15:25:39 2026
tcrd: 2026-08-24 12:00 CEST (10:00 UTC)
toss: Sat Aug 29 20:11:34 2026
soss: [oss-security] CVE-2026-78002: rsyslog RainerScript replace() heap buffer overflow
loss: https://www.openwall.com/lists/oss-security/2026/08/29/1

proj: Dovecot
subj: [vs] Dovecot Advisory 2026/3
trep: Wed Aug 26 06:02:54 2026
cves: CVE: CVE-2026-33263, CVE: CVE-2026-33607, CVE: CVE-2026-27852, CVE: CVE-2026-33606, CVE: CVE-2026-33604, CVE: CVE-2026-40014, CVE: CVE-2026-40013, CVE: CVE-2026-33605, CVE: CVE-2026-40018, CVE: CVE-2026-40019, CVE: CVE-2026-40015, CVE: CVE-2026-40017, CVE: CVE-2026-40203, CVE: CVE-2026-42007, CVE: CVE-2026-40204, CVE: CVE-2026-40205, CVE: CVE-2026-42008, CVE: CVE-2026-42395, CVE: CVE-2026-42393, CVE: CVE-2026-52681, CVE: CVE-2026-42392, CVE: CVE-2026-73208, CVE: CVE-2026-73209, CVE: CVE-2026-42391, CVE: CVE-2026-52687, DOV-8476, DOV-8874, DOV-8884, DOV-8941, DOV-8947, DOV-8949, DOV-8991, DOV-8994, DOV-9039, DOV-9041, DOV-9046, DOV-9047, DOV-9066, DOV-9070, DOV-9099, DOV-9106, DOV-9109, DOV-9142, DOV-9148, DOV-9223, DOV-9230, DOV-9309, DOV-9401, DOV-9529, DOV-9530
tcrd: Friday (or latest Monday) 28th of August \\ 12:00 EEST on Friday 28th
toss: Fri Aug 28 20:55:51 2026
soss: [oss-security] Dovecot Security Advisory 3/2026
loss: https://www.openwall.com/lists/oss-security/2026/08/28/1

proj: OpenStack Glance
subj: [vs] ...
trep: Thu Aug 27 04:20:06 2026
cves: CVE-2026-71196, CVE-2026-71197, CVE-2026-71198, LP#2160020
tcrd: 2026-09-03 15:00 UTC
toss: Thu Sep 03 16:11:49 2026
soss: [oss-security] [OSSA-2026-038] OpenStack Glance: Multiple SSRF vulnerabilities in web-download and HTTP image APIs (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198)
loss: https://www.openwall.com/lists/oss-security/2026/09/03/2

proj: curl
subj: [vs-plain] : curl pre-notification of 8 security advisories
trep: Fri Aug 28 14:29:47 2026
cves: CVE-2026-13608, CVE-2026-18924, CVE-2026-19931, CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-82208
tcrd: Wednesday September 2
toss: Wed Sep 02 10:55:07 2026
soss: [oss-security] [SECURITY ADVISORIES] curl 8.22.0
loss: https://www.openwall.com/lists/oss-security/2026/09/02/2