proj: OpenStack Mistral
subj: [vs] Four authorization and privilege vulnerabilities in OpenStack Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147)
trep: Thu Oct 01 16:49:28 2026
cves: CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147
tcrd: Thursday, October 8 (2026-10-08), 1500UTC
toss: Fri Oct 09 06:02:53 2026
soss: [oss-security] [OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
loss: https://www.openwall.com/lists/oss-security/2026/10/09/1

proj: X.Org X Server
subj: [vs-plain] Preview of X.Org Security Advisory (xserver) for 2026-10-07
trep: Fri Oct 02 03:57:21 2026
cves: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536
tcrd: Wed Oct 07, 2026 at 01:00 UTC
toss: Wed Oct 07 04:36:04 2026
soss: [oss-security] FW: X.Org Security Advisory: multiple security issues in X.Org X server
loss: https://www.openwall.com/lists/oss-security/2026/10/07/23

proj: Emacs
subj: [vs-plain] Incomplete fix for Emacs CVE-2026-79992
trep: Mon Oct 05 11:29:47 2026
tcrd: on or after 10am UTC on Sunday \\ Sunday 11 October 2026, 10:00 UTC
toss: Sun Oct 11 15:13:25 2026
soss: [oss-security] Incomplete fix for Emacs CVE-2026-79992
loss: https://www.openwall.com/lists/oss-security/2026/10/11/1

proj: OpenStack Cinder
subj: [vs] Vulnerability in OpenStack Cinder (CVE-2026-93856)
trep: Wed Oct 07 20:09:59 2026
cves: CVE-2026-93856, OSSA-2026-045
tcrd: 2026-10-20, 1400UTC
toss: Tue Oct 20 16:29:01 2026
soss: [oss-security] [OSSA-2026-045] Cinder: Cross-project information disclosure in Cinder Messages API (CVE-2026-93856)
loss: https://www.openwall.com/lists/oss-security/2026/10/20/17

proj: OpenStack Manila
subj: [vs] ...
trep: Wed Oct 07 22:48:22 2026
cves: CVE-2026-71195, OSSA-2026-046
tcrd: 2026-10-20, 1500UTC
toss: Tue Oct 20 16:32:55 2026
soss: [oss-security] [OSSA-2026-046] OpenStack Manila: Manila allows cross-project public-share and export-metadata changes (CVE-2026-71195)
loss: https://www.openwall.com/lists/oss-security/2026/10/20/18

proj: NSD
subj: [vs] ...
trep: Thu Oct 08 10:37:50 2026
cves: CVE-2026-101337, CVE-2026-101338, CVE-2026-101339, CVE-2026-101341
tcrd: Wednesday 14 October 2026
toss: Wed Oct 14 19:21:57 2026
soss: [oss-security] NSD 4.15.3 security release
loss: https://www.openwall.com/lists/oss-security/2026/10/14/12

proj: cifs-utils
subj: [vs-plain] CVE-2026-104715: Embargoed cifs-utils vulnerability
trep: Thu Oct 08 19:29:28 2026
cves: CVE-2026-104715
tcrd: October 15, 2026
toss: Fri Oct 16 15:44:46 2026
soss: [oss-security] CVE-2026-104715: cifs-utils 4.2-7.8 mount-option injection in mount.cifs
loss: https://www.openwall.com/lists/oss-security/2026/10/16/35

proj: OpenStack Ironic
subj: [vs] ...
trep: Thu Oct 08 19:39:59 2026
cves: CVE-2026-90458, OSSA-2026-047
tcrd: 2026-10-22, 1500UTC
toss: Thu Oct 22 18:46:58 2026
soss: [oss-security] [OSSA-2026-047] Ironic: Redfish vendor_passthru method allows path injection via ID (CVE-2026-90458)
loss: https://www.openwall.com/lists/oss-security/2026/10/22/6

proj: curl
subj: [vs-plain] : pre-notification of 24 pending curl CVEs
trep: Fri Oct 09 13:39:13 2026
cves: CVE-2026-107929, CVE-2026-107928, CVE-2026-94266, CVE-2026-94265, CVE-2026-92392, CVE-2026-92391, CVE-2026-92390, CVE-2026-92389, CVE-2026-92388, CVE-2026-92387, CVE-2026-92386, CVE-2026-87866, CVE-2026-87865, CVE-2026-87864, CVE-2026-87863, CVE-2026-87862, CVE-2026-87861, CVE-2026-86415, CVE-2026-86414, CVE-2026-86413, CVE-2026-86412, CVE-2026-86411, CVE-2026-86410, CVE-2026-86409
tcrd: October 14 around 06:00 UTC
toss: Wed Oct 14 14:39:44 2026
soss: [oss-security] [SECURITY ADVISORIES] curl 8.23.0
loss: https://www.openwall.com/lists/oss-security/2026/10/14/3

proj: OpenStack Ironic
subj: [vs] ...
trep: Fri Oct 09 18:57:52 2026
cves: CVE-2026-89419, OSSA-2026-048
tcrd: 2026-10-22, 1500UTC
toss: Thu Oct 22 18:47:03 2026
soss: [oss-security] [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419)
loss: https://www.openwall.com/lists/oss-security/2026/10/22/7

proj: rsyslog
subj: [vs-plain] EMBARGOED: rsyslog RainerScript replace() length wrap
trep: Sat Oct 10 10:40:35 2026
cves: GHSA-48f2-29wv-5jgc
tcrd: Monday, 2026-10-12 16:00 UTC (18:00 CEST, Europe/Berlin)
toss: Tue Oct 13 17:26:00 2026
soss: [oss-security] rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc)
loss: https://www.openwall.com/lists/oss-security/2026/10/13/12

proj: Linux
subj: [vs-plain] Infinity Core: Linux Kernel Core LPEs
trep: Mon Oct 12 16:25:48 2026
cves: CVE-2026-98260, CVE-2026-98256, CVE-2026-97941, CVE-2026-80775, CVE-2026-98385, CVE-2026-89754
tcrd: 2026-10-16 at 16:00 UTC
toss: Fri Oct 16 16:04:07 2026
soss: [oss-security] Infinity Core: Linux Kernel Core LPEs
loss: https://www.openwall.com/lists/oss-security/2026/10/16/36

proj: libpcap
subj: [vs] one more reason to update libpcap
trep: Sun Oct 18 18:10:17 2026
cves: CVE-2026-6554
tcrd: 18:00 UTC on Thursday 22 October
toss: Thu Oct 22 18:41:31 2026
soss: [oss-security] one more reason to update libpcap to at least 1.10.7
loss: https://www.openwall.com/lists/oss-security/2026/10/22/3

proj: Unbound
subj: [vs] ...
trep: Mon Oct 19 09:45:25 2026
cves: CVE-2026-97206, CVE-2026-50106, CVE-2026-96405, CVE-2026-109125, CVE-2026-35501
tcrd: October 21 2026
toss: Wed Oct 21 15:22:36 2026
soss: [oss-security] Unbound: 1.26.2 addresses multiple CVE items
loss: https://www.openwall.com/lists/oss-security/2026/10/21/11

proj: AIDE
subj: [vs] aide (GHSA-6wc9-4w69-5jc5, CVE pending)
trep: Mon Oct 19 12:08:41 2026
cves: GHSA-6wc9-4w69-5jc5
tcrd: Thu 22 Oct 2026 14:00:00 UTC
toss: Thu Oct 22 18:46:48 2026
soss: [oss-security] aide (<= 0.19.4) improper comparison of hash values containing a null byte (AIDE detection bypass) [GHSA-6wc9-4w69-5jc5, CVE pending]
loss: https://www.openwall.com/lists/oss-security/2026/10/22/5

proj: AIDE
subj: [vs] aide (GHSA-wq25-fm54-5q3q, CVE pending)
trep: Mon Oct 19 12:09:35 2026
cves: GHSA-wq25-fm54-5q3q
tcrd: Thu 22 Oct 2026 14:00:00 UTC
toss: Thu Oct 22 18:46:48 2026
soss: [oss-security] aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass) [GHSA-wq25-fm54-5q3q, CVE pending]
loss: https://www.openwall.com/lists/oss-security/2026/10/22/4

proj: PHP
subj: [vs-plain] PHP security coordination coverage check
trep: Mon Oct 19 16:02:20 2026
cves: CVE-2026-109618, CVE-2026-109619
tcrd: 2026-10-22 14:00 UTC \\ 2026-10-21 at 14:00 UTC (tomorrow, one day earlier than planned)
lpub: https://www.openwall.com/lists/oss-security/2026/10/20/34
toss: Wed Oct 21 15:07:19 2026
soss: [oss-security] CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption
loss: https://www.openwall.com/lists/oss-security/2026/10/21/6

proj: git-annex
subj: [vs] git-annex cross-repository data exfiltration
trep: Mon Oct 19 17:22:09 2026
cves: CVE-2026-112818
tcrd: October 26th at 18:00 GMT
toss: Mon Oct 26 18:45:09 2026
soss: [oss-security] CVE-2026-112818: git-annex cross-repository data exfiltration
loss: https://www.openwall.com/lists/oss-security/2026/10/26/17

proj: TLS certificate stores
subj: [vs-plain] eMudhra Intermediates Compromise - Action Required
trep: Mon Oct 19 19:47:16 2026
tcrd: 14 days \\ Nov 2 \\ treat the embargo period as over
toss: Tue Oct 20 16:04:42 2026
soss: [oss-security] eMudhra Intermediates Compromise
loss: https://www.openwall.com/lists/oss-security/2026/10/20/1

proj: BIND 9
subj: [vs] ...
trep: Tue Oct 20 12:13:34 2026
cves: CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313
tcrd: 21 October 2026
toss: Wed Oct 21 15:22:35 2026
soss: [oss-security] ISC has disclosed four vulnerabilities in BIND 9 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313)
loss: https://www.openwall.com/lists/oss-security/2026/10/21/8

proj: OpenStack keystonemiddleware
subj: [vs] Vulnerability in OpenStack keystonemiddleware (CVE pending)
trep: Thu Oct 22 18:53:36 2026
cves: CAN-2026-2040504, CVE-2026-115642, OSSA-2026-050
tcrd: Thursday, October 29, 1500UTC
toss: Thu Oct 29 14:54:45 2026
soss: [oss-security] [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)
loss: https://www.openwall.com/lists/oss-security/2026/10/29/2

proj: OpenVox and Puppet
subj: [vs] OpenVox security update
trep: Thu Oct 29 20:47:32 2026
cves: GHSA-ffr6-rwpm-p5wq, GHSA-q4hm-33rc-572g
tcrd: Next Tuesday, November 3rd at 1700 UTC
toss: Tue Nov 03 20:13:40 2026
soss: [oss-security] OpenVox Server RCE and client impersonation vulnerabilities
loss: https://www.openwall.com/lists/oss-security/2026/11/03/14