Development & Open Source
Software development and open source follows supply chain, dependencies, tooling, repositories and code security. The cluster highlights vulnerabilities, updates and useful practices for developers and maintainers.
GNOME 50.5 Patches CVEs and Critical Bugs: The Risk of the Missing Severity Score
GNOME 50.5 arrives with 22 updated modules and a fix for CVE-2026-88924, yet the GNOME Security Team assigns no severity score. For ad…
Public Exploit for CVE-2026-80521 Puts Ubuntu Containers at Root Risk
An exploit released on September 22, 2026 leverages CVE-2026-80521 for container escape on Ubuntu LTS. The upstream fix landed on Augu…
CVE-2026-43502: RDS Zero-Copy Bug Enables Root Escalation on Linux Since 2018
ZcopyReaper has affected the Linux kernel since 2018 with a CVSS 7.8 score. The fix landed in May 2026, but the September 21 disclosur…
Bifrost AI Gateway RCE Risk: Authentication Disabled by Default
CVE-2026-90898 in the Bifrost AI gateway enables unauthenticated remote command execution. The flaw is amplified by a design choice th…
CVE-2026-89775: ARM64 Guest Gains Host Memory Access via KVM TLB Bug
A flaw in TLB invalidation size calculation lets a KVM guest read and write host physical memory without a VM exit. On RHEL-like distr…
CISA Adds Three Linux Kernel CVEs to KEV With Three-Day Deadline for US Agencies
CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on September 18, 2026, giving federal civ…
Four Linux Exploits Published: Local Root via Bugs 10–21 Years Old
Security researcher Asim Manizada released working proof-of-concept exploits for four Linux kernel vulnerabilities on September 18, 20…
Xreader PDF RCE: Unguarded C Union Exposes Linux Mint to Remote Attack
ZDI-26-715 reveals a type confusion in Xreader's PDF parser that enables arbitrary code execution simply by opening a malicious PDF. T…
Airbyte OneDrive Zero-Day: CVE-2026-92204 Remains Unpatched After 10 Months
Trend Zero Day Initiative disclosed CVE-2026-92204, an SSRF vulnerability in Airbyte's OneDrive connector with a CVSS 7.7 score that e…
CVE-2026-91826: RCE in Samsung rlottie Library Creates Supply-Chain Risk
A stack-based buffer overflow in Samsung's open-source rlottie library allows remote code execution via crafted vector animations. The…
ZDI Discloses Zero-Day in BusyBox: Symlink Directory Traversal Enables Arbitrary File Creation
Trend Micro's Zero Day Initiative published advisory ZDI-26-705 on September 17, 2026, detailing a zero-day vulnerability in the BusyB…
GIMP Under Attack: APNG Buffer Overflow Enables Remote Code Execution
The ZDI-26-713 vulnerability in GIMP allows RCE via malicious APNG files. CVSS 7.8, patch available after 140 days of coordinated disc…