proj: Linux
subj: [vs-plain] Guest-to-Host Escape in KVM/arm64
trep: Fri Sep 11 15:46:07 2026
cves: CVE-2026-89775
tcrd: 2026-09-16 16:00 UTC
toss: Wed Sep 16 16:02:51 2026
soss: [oss-security] CVE-2026-89775: Guest-to-Host Escape in KVM/arm64
loss: https://www.openwall.com/lists/oss-security/2026/09/16/14

proj: Unbound
subj: [vs] ...
trep: Mon Sep 14 13:04:53 2026
cves: CVE-2026-81642, CVE-2026-81634, CVE-2026-82717, CVE-2026-77955, CVE-2026-78227, CVE-2026-80225, CVE-2026-82720, CVE-2026-85501, CVE-2026-77860
tcrd: 16 September 2026 \\ September 16 when the the accompanying email to oss-security@ arrives
toss: Wed Sep 16 15:03:02 2026
soss: [oss-security] Unbound: 1.26.1 addresses multiple CVE items
loss: https://www.openwall.com/lists/oss-security/2026/09/16/3

proj: BIND 9
subj: [vs] ...
trep: Tue Sep 15 07:36:10 2026
cves: CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736
tcrd: 16 September 2026 \\ 16th September 12:00 UTC
toss: Wed Sep 16 15:03:21 2026
soss: [oss-security] ISC has disclosed fourteen vulnerabilities in BIND 9 (CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736)
loss: https://www.openwall.com/lists/oss-security/2026/09/16/4

proj: OpenSSL
subj: [vs-plain] Embargoed OpenSSL security issue
trep: Tue Sep 15 10:51:52 2026
cves: CVE-2026-84782, CVE-2026-84783, CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84784
tcrd: 29th September 2026
toss: Tue Sep 29 16:10:09 2026
soss: [oss-security] OpenSSL Security Advisory [29th September 2026] 
loss: https://www.openwall.com/lists/oss-security/2026/09/29/28

proj: Exim
subj: [vs] Advance notice of Exim Security Release 4.100.1
trep: Tue Sep 15 15:31:11 2026
cves: GCVE-25-2026-09-50-1, GCVE-25-2026-09-51-1, GCVE-25-2026-09-55-1, GCVE-25-2026-09-56-1
tcrd: 2026-09-18T12:00:00+0000
toss: Sat Sep 19 03:51:39 2026
soss: [oss-security] Exim Security Release 4.100.1
loss: https://www.openwall.com/lists/oss-security/2026/09/19/2

proj: Linux
subj: [vs-plain] A quartet of Linux kernel LPE affecting a number of distros
trep: Wed Sep 16 04:28:37 2026
cves: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469)
tcrd: Friday, September 18, 6am UTC (Thursday, September 17, 2026, 11pm PT)
toss: Fri Sep 18 06:15:23 2026
soss: [oss-security] A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
loss: https://www.openwall.com/lists/oss-security/2026/09/18/3

proj: GNU Inetutils
subj: [vs-plain] GNU Inetutils uninitialized struct sigaction usage
trep: Sat Sep 19 03:14:18 2026
cves: CVE-2026-95510
tcrd: 2026-09-25
toss: Sat Sep 26 06:15:52 2026
soss: [oss-security] CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction
loss: https://www.openwall.com/lists/oss-security/2026/09/26/1

proj: rsyslog
subj: [vs-plain] [vs] rsyslog imdtls permitted-peer authorization bypass — embargoed until 2026-09-22 16:00 UTC
trep: Sun Sep 20 14:49:35 2026
tcrd: 2026-09-22 16:00 UTC
toss: Tue Sep 22 16:27:58 2026
soss: [oss-security] rsyslog imdtls permitted-peer authorization bypass
loss: https://www.openwall.com/lists/oss-security/2026/09/22/19

proj: ntfs-3g
subj: [vs] ...
trep: Mon Sep 21 11:41:42 2026
cves: NTFS-3G-SA_2026-06-1_20, NTFS-3G-SA_2026-06-1_19, NTFS-3G-SA_2026-06-1_12, NTFS-3G-SA_2026-06-1_11, NTFS-3G-SA_2026-06-1_10, NTFS-3G-SA_2026-06-1_08, NTFS-3G-SA_2026-06-1_07, NTFS-3G-SA_2026-06-1_05
tcrd: 2026-09-23 11:00 UTC
toss: Wed Sep 23 15:05:10 2026
soss: [oss-security] Vulnerabilities in ntfs-3g
loss: https://www.openwall.com/lists/oss-security/2026/09/23/4