critical

CVE

CVE-2026-110003, CVE-2026-90908, CVE-2026-100307, CVE-2026-125926, CVE-2026-67449, CVE-2026-65840, CVE-2026-65967, CVE-2026-127016, CVE-2026-126991, CVE-2026-126777, CVE-2026-126774, CVE-2026-126779, CVE-2026-65843, CVE-2026-67543, CVE-2026-67544, CVE-2026-67546, CVE-2026-67541, CVE-2026-67545, CVE-2026-67547, CVE-2026-67548, CVE-2026-65957, CVE-2026-126673, CVE-2026-93404, CVE-2026-108472, CVE-2026-126813, CVE-2026-114605, CVE-2026-124023, CVE-2026-126641, CVE-2026-126642

CWE

CWE-287, CWE-862, CWE-22, CWE-94, CWE-78, CWE-89, CWE-918, CWE-200, CWE-400

Affected Surface

  • Azul Payara Community `< 7.2026.11` and Payara Enterprise `< 7.6.0`, `< 6.44.0`, `< 5.93.0`, and `< 4.1.2.191.61` (`CVE-2026-110003` / `FISH-14855` CVSS 9.3 Critical REST `X-GlassFish-authToken` remote-admin bypass and `CVE-2026-90908` / `FISH-14190` CVSS 9.3 Critical JMX `GenericAdminAuthenticator` host-spoofing RCE)
  • Amazon `mcp-gateway-registry` (`agentic-community/mcp-gateway-registry`) versions `1.0.9` through `1.24.7` (`CVE-2026-100307` / `AWS-2026-179`, CVSS 8.7 High missing authorization on `/api/servers/groups/import`) and versions `1.0.3` through `1.34.0` (`CVE-2026-125926` / `AWS-2026-180`, SSRF on server registration/update)
  • Self-hosted AI agent and MCP platforms: Heym (`heymrun/heym`) `< 0.0.75` (`CVE-2026-67543`, `CVE-2026-67544`, `CVE-2026-67546` all CVSS 8.8 High RCE, plus `CVE-2026-67541` and `67545`), taOS (`jaylfc/taOS`) `< 1.0.0-beta.25` (`CVE-2026-67547` CVSS 8.8 High `code_exec` RCE and `CVE-2026-67548` CVSS 8.3 High), and Helio MCP proxy (`gethelio/helio`) `< 0.8.0` (`CVE-2026-65957`)
  • Portabase `< 1.21.2` (`CVE-2026-67449` / `GHSA-7697-vf3j-253j`, CVSS 9.8 Critical), Fider `< 0.36.0` in `HOST_MODE=multi` (`CVE-2026-65840` / `GHSA-vxjw-gv4f-vq58`, CVSS 9.6 Critical, plus `CVE-2026-65967` OAuth SSRF), MISP `misp-modules` website (`CVE-2026-127016` CVSS 9.2 Critical and `CVE-2026-126991`), Traccar `3.15` through `6.16.0` (`CVE-2026-126777` CVSS 9.1 Critical, fixed in `6.17.0`), and Roundcube Webmail `< 1.6.21` and `1.7.x < 1.7.6` (`CVE-2026-126813` CVSS 7.4 High)
  • npm `@tinacms/mdx` `< 2.4.2` (`CVE-2026-126774` / `GHSA-6vw5-w22x-ghxv` CVSS 8.8 High) and `sync-rpc` `< 1.3.7` (`CVE-2026-65843` / `GHSA-2x86-cf3f-86gw` CVSS 8.7 High), Packagist `spatie/browsershot` `>= 2.2.0, < 5.5.0` (`CVE-2026-126779` CVSS 8.7 High), CPAN `Data::Dump::Streamer` `< 3.00` (`CVE-2026-126673`), PyPI `dnspython` `< 2.9.0` (`CVE-2026-114605` / `GHSA-45c3-73f7-pv4m` High), `rsyslog` `8.1901.0` through pre-`2026-11-11` (`CVE-2026-93404` High `omclickhouse` SQLi), and `xfsprogs` `xfs_admin` (`CVE-2026-108472` CVSS 7.8 High)

TL;DR

Between 19:00 UTC on 11 November and 12:00 UTC on 12 November 2026, NVD, AWS, Azul, the CPAN Security Group, Red Hat, and oss-security published a wave of critical and high-severity application security advisories:

  1. Azul Payara Server & Payara Micro 7.2026.11 / 6.44.0 (CVE-2026-110003 and CVE-2026-90908, both CVSS 9.3 Critical):
    • REST X-GlassFish-authToken remote-admin bypass (CVE-2026-110003 / FISH-14855, PR #8537): In GenericAdminAuthenticator.rejectRemoteAdminIfDisabled(), Payara checked if (cbh.tkn() != null) return; before verifying whether the token string in X-GlassFish-authToken actually existed in authTokenManager. Sending any arbitrary value in X-GlassFish-authToken bypassed the secure-admin remote-access rejection and fell through to password authentication, which succeeds with no password on default domains (admin with an empty password), granting full remote administrative command execution on port 4848.
    • JMX/RMI credentials[2] host-spoofing RCE (CVE-2026-90908 / FISH-14190, PR #8495 and #8525): In GenericAdminAuthenticator.authenticate(Object credentials), if a remote JMX client supplied a 3-element String[] (up.length > 2), Payara took host = up[2] directly from the client-controlled array instead of calling RemoteServer.getClientHost(). Passing new String[]{"admin", "", "localhost"} over RMI tricked NetUtils.isThisHostLocal(host) into treating the remote connection as local and granting MBean server access.
  2. Amazon mcp-gateway-registry (CVE-2026-100307 / AWS-2026-179, CVSS 8.7 High; CVE-2026-125926 / AWS-2026-180, Medium) and self-hosted AI agent platforms Heym < 0.0.75 (CVE-2026-67543, 67544, 67546, CVSS 8.8 High), taOS < 1.0.0-beta.25 (CVE-2026-67547, CVSS 8.8 High), and Helio < 0.8.0 (CVE-2026-65957):
    • In Amazon’s open-source mcp-gateway-registry (1.0.9 through 1.24.7), /api/servers/* routes verified authentication via nginx_proxied_auth but omitted role checks (commit 676d69285b). Any authenticated user could POST /api/servers/groups/import to map their own IdP group to "all" UI permissions (registry administrator) or point /api/federation/* at a rogue peer registry. Version 1.35.0 additionally patches CVE-2026-125926 (SSRF via upstream server URLs). Crucially, AWS notes that upgrading to 1.25.0+ does not remove rogue group mappings persisted before the upgrade.
    • In Heym (< 0.0.75), Agent Python skills (CVE-2026-67543), the Playwright node’s playwrightCode field (CVE-2026-67544), and POST /api/mcp/fetch-tools with stdio transport (CVE-2026-67546) executed caller-supplied commands directly inside the backend container (which mounts /var/run/docker.sock as root by default). In taOS (< 1.0.0-beta.23, CVE-2026-67547), POST /api/skill-exec/code_exec/call allowed any non-admin session to run subprocess.run(["python3", "-c", code]).
  3. Portabase 1.21.2 (CVE-2026-67449, CVSS 9.8 Critical), Fider 0.36.0 (CVE-2026-65840, CVSS 9.6 Critical), MISP misp-modules (CVE-2026-127016, CVSS 9.2 Critical), Traccar 6.17.0 (CVE-2026-126777, CVSS 9.1 Critical), and Roundcube 1.7.6 / 1.6.21 (CVE-2026-126813, CVSS 7.4 High): Portabase’s unauthenticated /api/tus/hooks endpoint trusted the X-File-Path header to move uploaded files anywhere on disk, letting an attacker overwrite /data/private/keys/master_key.bin (the AES-256-GCM backup encryption key); Fider’s getVerificationByKey() queried email_verifications without AND tenant_id = $3, letting a user redeem a Tenant A verification link on Tenant B; misp-modules exposed /external_tools add/delete/config endpoints without checking current_user.is_authenticated when ADMIN_PASSWORD was set; Traccar’s LdapProvider.login() passed empty passwords to InitialDirContext, which LDAP treats as an anonymous Simple Bind that succeeds without verifying credentials; and Roundcube’s /^[0-9:.]+$/ check on _uid allowed trailing \r\n IMAP command injection when messages_cache was enabled.
  4. Developer libraries and Linux utilities (@tinacms/mdx 2.4.2 CVE-2026-126774, Spatie Browsershot 5.5.0 CVE-2026-126779, sync-rpc 1.3.7 CVE-2026-65843, Perl Data::Dump::Streamer 3.00 CVE-2026-126673, dnspython 2.9.0 CVE-2026-114605, rsyslog omclickhouse CVE-2026-93404, and xfsprogs xfs_admin CVE-2026-108472).

What to do now: Upgrade Azul Payara to 7.2026.11 (7.6.0 / 6.44.0 / 5.93.0), mcp-gateway-registry to >= 1.35.0 (and audit group_mappings and registered server URLs in MongoDB/DocumentDB), Portabase to >= 1.21.2, Fider to >= 0.36.0, Traccar to >= 6.17.0, Heym to >= 0.0.75, taOS to >= 1.0.0-beta.25, @tinacms/mdx to >= 2.4.2, spatie/browsershot to >= 5.5.0, sync-rpc to >= 1.3.7, Data::Dump::Streamer to >= 3.00, dnspython to >= 2.9.0, and Roundcube to >= 1.7.6 or >= 1.6.21.

Affected packages and components

EcosystemPackage / ProjectCVE / Advisory IDsSeverityAffected versionsFixed version
Java / ServerAzul Payara Community & Enterprise (fish.payara)CVE-2026-110003 (FISH-14855), CVE-2026-90908 (FISH-14190)CVSS 9.3 CriticalCommunity < 7.2026.11; Enterprise < 7.6.0, < 6.44.0, < 5.93.0, < 4.1.2.191.617.2026.11, 7.6.0, 6.44.0, 5.93.0, 4.1.2.191.61
Python / MCPAmazon mcp-gateway-registry (agentic-community/mcp-gateway-registry)CVE-2026-100307 (GHSA-rxf3-qgpv-wxvr, AWS-2026-179), CVE-2026-125926 (AWS-2026-180)CVSS 8.7 High / 6.3 Medium1.0.9..1.24.7 (100307); 1.0.3..1.34.0 (125926)1.25.0 (100307), 1.35.0 (125926)
Python / AI AgentsHeym (heymrun/heym), taOS (jaylfc/taOS), Helio (gethelio/helio)Heym: CVE-2026-67543, 67544, 67546, 67541, 67545; taOS: CVE-2026-67547, 67548; Helio: CVE-2026-65957CVSS 8.8 High to 6.9 MediumHeym < 0.0.75; taOS < 1.0.0-beta.25; Helio < 0.8.0Heym 0.0.75; taOS 1.0.0-beta.25; Helio 0.8.0
TypeScript / Go / JavaPortabase (Portabase/portabase), Fider (getfider/fider), Traccar (traccar/traccar), MISP misp-modulesCVE-2026-67449 (GHSA-7697-vf3j-253j); CVE-2026-65840 (GHSA-vxjw-gv4f-vq58), CVE-2026-65967; CVE-2026-126777; CVE-2026-127016, 126991CVSS 9.8 / 9.6 / 9.2 / 9.1 CriticalPortabase < 1.21.2; Fider < 0.36.0; Traccar 3.15..6.16.0; misp-modules < 28c27e30f6d3Portabase 1.21.2; Fider 0.36.0; Traccar 6.17.0; misp-modules 28c27e30f6d3
npm@tinacms/mdx (tinacms/tinacms), sync-rpc (ForbesLindesay/sync-rpc)CVE-2026-126774 (GHSA-6vw5-w22x-ghxv); CVE-2026-65843 (GHSA-2x86-cf3f-86gw)CVSS 8.8 / 8.7 High@tinacms/mdx < 2.4.2; sync-rpc < 1.3.7@tinacms/mdx 2.4.2; sync-rpc 1.3.7
Packagist / PHPspatie/browsershot, Roundcube Webmail (roundcube/roundcubemail)CVE-2026-126779; CVE-2026-126813CVSS 8.7 / 7.4 Highspatie/browsershot >= 2.2.0, < 5.5.0; Roundcube < 1.6.21, 1.7.x < 1.7.6spatie/browsershot 5.5.0; Roundcube 1.6.21, 1.7.6
CPAN / PyPI / LinuxPerl Data::Dump::Streamer, PyPI dnspython, rsyslog (omclickhouse), xfsprogs (xfs_admin)CVE-2026-126673; CVE-2026-114605 (GHSA-45c3-73f7-pv4m); CVE-2026-93404 (GHSA-8rx7-ww92-p4vr); CVE-2026-108472High (7.8 to 8.8)Data-Dump-Streamer < 3.00; dnspython < 2.9.0; rsyslog >= 8.1901.0; xfsprogs prior to Nov 11 patchData-Dump-Streamer 3.00 (3.002); dnspython 2.9.0; rsyslog 2026-11-11 patch

Technical analysis

1. Azul Payara CVE-2026-110003 and CVE-2026-90908: how X-GlassFish-authToken and credentials[2] bypassed GenericAdminAuthenticator

Out of the box, GlassFish and Payara domains configure the admin user with an empty password and disable secure-admin, relying on GenericAdminAuthenticator (nucleus/admin/util/src/main/java/com/sun/enterprise/admin/util/GenericAdminAuthenticator.java) to reject any administrative request that does not originate from localhost. Two bugs in that class let a remote unauthenticated attacker bypass the local-only check and run administrative commands (such as deploy) with blank credentials:

  1. Unvalidated X-GlassFish-authToken header (CVE-2026-110003 / FISH-14855, PR #8537): When an HTTP request to port 4848 (/__asadmin/*) included an X-GlassFish-authToken header, AdminCallbackHandler.tkn() returned the header string. Before calling rejectRemoteAdminIfDisabled(cbh.getRemoteHost()), rejectRemoteAdminIfDisabled(AdminCallbackHandler) checked only if (cbh.tkn() != null) return;: 
    --- a/nucleus/admin/util/src/main/java/com/sun/enterprise/admin/util/GenericAdminAuthenticator.java
+++ b/nucleus/admin/util/src/main/java/com/sun/enterprise/admin/util/GenericAdminAuthenticator.java
@@ -424,10 +424,10 @@ private void rejectRemoteAdminIfDisabled(final AdminCallbackHandler cbh) throws
-        if (cbh.tkn() != null) {
+        if (cbh.tkn() instanceof String token && authTokenManager.findToken(token) != null) {
             return;
         }
         rejectRemoteAdminIfDisabled(cbh.getRemoteHost());
    Because cbh.tkn() != null returned early before the token was checked against authTokenManager, a remote attacker who sent X-GlassFish-authToken: anything skipped rejectRemoteAdminIfDisabled(remoteHost). Later in authenticate(), the invalid token failed token lookup and fell through to password authentication, which succeeded with the default empty admin password.
  2. Client-supplied host = up[2] in JMX authentication (CVE-2026-90908 / FISH-14190, PR #8495 and #8525): In authenticate(Object credentials) (used for JMX over RMI on port 8686), Payara accepted a String[] credentials array and checked if (up.length > 2) { host = up[2]; } else { host = RemoteServer.getClientHost(); }: 
    -            if (up.length > 2) {
-                host = up[2];
-            } else {
-                try {
-                    host = RemoteServer.getClientHost();
+        String host;
+        try {
+            host = RemoteServer.getClientHost();
+        } catch (ServerNotActiveException ex) {
+            throw new SecurityException("Unable to determine JMX client host");
+        }
    A remote RMI client that passed a 3-element String[]{"admin", "", "127.0.0.1"} set host = "127.0.0.1", bypassing RemoteServer.getClientHost() and authenticating as admin against the MBean server (where MLet or diagnostic MBeans give immediate remote code execution).

2. Amazon mcp-gateway-registry (CVE-2026-100307, CVE-2026-125926), Heym (CVE-2026-67543, 67544, 67546), and taOS (CVE-2026-67547)

  • Amazon mcp-gateway-registry (CVE-2026-100307 / AWS-2026-179 and CVE-2026-125926 / AWS-2026-180): In registry/api/server_routes.py and registry/api/federation_routes.py prior to 1.25.0 (commit 676d69285b), external management endpoints used Depends(nginx_proxied_auth) without _require_admin. Any authenticated user could send POST /api/servers/groups/import with ui_permissions: {"modify_service": ["all"]} for their own IdP group; because _user_is_admin evaluates "all" permissions on each request, the caller became a full registry administrator on their very next request. Commit 676d69285b adds _require_admin to all five /api/servers/groups/* endpoints, adds _check_federation_management_scope to all 10 mutating /api/federation/* routes, and blocks scope_repository.import_group() from writing "all" permissions unless allow_privileged=True.
  • Heym 0.0.70 to 0.0.75 (CVE-2026-67543, CVE-2026-67544, CVE-2026-67546) and taOS 1.0.0-beta.23 (CVE-2026-67547): While Heym ran user-defined Python tools inside a Docker sandbox, Agent Python skills (commit 2155057f4153), custom playwrightCode in the Playwright workflow node (commit d2fd46c07754), and MCP stdio transport commands in POST /api/mcp/fetch-tools (commit 22b8ee60eb92) all spawned subprocesses directly inside the privileged backend container with {**os.environ, **user_env} and access to /var/run/docker.sock. Similarly, in taOS < 1.0.0-beta.23 (commit 8998d8519042), POST /api/skill-exec/{skill_id}/call lacked an admin/local-token check (_is_admin_or_local_token), letting any non-admin session invoke the built-in code_exec skill (subprocess.run(["python3", "-c", code])).

3. Portabase 1.21.2 (CVE-2026-67449), Fider 0.36.0 (CVE-2026-65840), @tinacms/mdx 2.4.2 (CVE-2026-126774), sync-rpc 1.3.7 (CVE-2026-65843), Perl Data::Dump::Streamer 3.00 (CVE-2026-126673), rsyslog (CVE-2026-93404), and xfs_admin (CVE-2026-108472)

  • Portabase < 1.21.2 (CVE-2026-67449, CVSS 9.8 Critical, commit 8dcb40679072): In app/api/tus/hooks/route.ts, /api/tus/hooks was reachable without authentication through Nginx and moved completed TUS uploads to headers["X-File-Path"]?.[0] without path validation. Passing X-File-Path: ../private/keys/master_key.bin overwrote Portabase’s AES-256-GCM master key with an attacker-known key. Version 1.21.2 blocks /api/tus/hooks in docker/nginx/nginx.conf, enforces FILE_PATH_RE = /^backups\/\d{4}-\d{2}-\d{2}\/[A-Za-z0-9._-]+$/, and requires a registered uploadSession matching X-Upload-Secret.
  • Fider < 0.36.0 (CVE-2026-65840, CVSS 9.6 Critical, commit ce4f44bb1055): In app/services/sqlstore/postgres/tenant.go, getVerificationByKey() ran SELECT ... FROM email_verifications WHERE key = $1 AND kind = $2 LIMIT 1 without AND tenant_id = $3. On multi-tenant (HOST_MODE=multi) deployments, an attacker could trigger a sign-in or invite email for a victim’s address on a tenant they controlled, or take an invite key from Tenant A, and redeem that key on Tenant B.
  • @tinacms/mdx < 2.4.2 (CVE-2026-126774, CVSS 8.8 High, commit 19285c6deeee), sync-rpc < 1.3.7 (CVE-2026-65843, CVSS 8.7 High, commit ffccfe5bc39a), and Spatie Browsershot < 5.5.0 (CVE-2026-126779, CVSS 8.7 High, commit eba71ab7f4ab): In @tinacms/mdx, stringifyProps() and markAttributes() interpolated rich-text string arrays and highlightColor values directly into MDX JSX attribute expressions (value: \[${value.map((item) => `”${item}”`).join(’, ’)}]`) without escaping quotes or newlines, letting an author break out of the string literal and inject arbitrary JavaScript expressions into compiled MDX. In sync-rpc, lib/worker.jsopened an unauthenticated TCP server that executedrequire(req.f)(req.a)for any process that connected to its port;1.3.7generates a 32-byte randomcrypto.randomBytes(32)key per worker and verifies it withcrypto.timingSafeEqual. In spatie/browsershot, Browsershot::html($html)blocked literalfile:// strings in PHP but did not intercept browser requests in Puppeteer (bin/browser.cjs), allowing file:///etc/passwd to render server files into the output PDF (5.5.0enablesblockLocalFileAccess` request interception by default).
  • Perl Data::Dump::Streamer < 3.00 (CVE-2026-126673, oss-security 2026/11/12/2): In lib/Data/Dump/Streamer.pm, _dump_qr() serialized compiled Perl Regexp (qr//) objects by choosing a delimiter and running: 
    # Data::Dump::Streamer <= 2.42 lib/Data/Dump/Streamer.pm (lines 197-208)
$pat =~ s/(?!\\)([$quotes])/\\$1/g
    if $best;
{
    use utf8;
    $pat =~ s/([^\040-\176])/sprintf "\\x{%x}", ord($1)/ge;
}
$self->{fh}
    ->print('qr', substr($quotes, 0, 1), $pat, substr($quotes, -1), $mod);
    Because _dump_qr() never escaped $ or @ and its negative lookahead (?!\\) was placed at the delimiter rather than as a lookbehind (?<!\\), a pattern containing @{[ system(...) ]} or ${\ system(...) } executed arbitrary Perl code when eval restored the dump, or an already-escaped delimiter \/ became \\/ and closed the qr/.../ literal early. Fixed in Data::Dump::Streamer 3.00 (3.002 current on MetaCPAN).
  • rsyslog omclickhouse SQL injection (CVE-2026-93404, oss-security 2026/11/11/26), xfsprogs xfs_admin OS command injection (CVE-2026-108472, oss-security 2026/11/11/27), and dnspython 2.9.0 (CVE-2026-114605): In rsyslog’s plugins/omclickhouse/omclickhouse.c, the default StdClickHouseFmt template requested OMSR_RQD_TPL_OPT_SQL (stdSQL, which doubles single quotes '' per ANSI SQL) instead of OMSR_RQD_TPL_OPT_SQL_BACKSLASH (option.sql="on"). Because ClickHouse interprets backslash escapes inside string literals, a log message ending with \' escaped the doubled quote and injected arbitrary ClickHouse SQL expressions. In xfsprogs, db/xfs_admin.sh concatenated -L <label>, -U <uuid>, -C <cfgfile>, -O <feature>, and -r <rtdev> into DB_OPTS / IO_OPTS / REPAIR_OPTS and ran eval xfs_db ... $DB_OPTS "$1", allowing command injection when invoked by privileged storage daemons such as udisks. And in dnspython < 2.9.0, dns.name.from_wire_parser() followed backward DNS compression pointers without a hop cap (2.9.0 adds MAX_COMPRESSION_POINTER_CHAIN = 16).

Detection and remediation

# 1. Check Java, Python, Node.js, PHP, and Perl manifests for affected versions
rg -n 'payara|mcp-gateway-registry|@tinacms/mdx|sync-rpc|spatie/browsershot|dnspython|Data::Dump::Streamer|Data-Dump-Streamer' \
  pom.xml build.gradle* requirements*.txt pyproject.toml uv.lock package.json composer.json composer.lock cpanfile* 2>/dev/null

# 2. Check rsyslog configurations for omclickhouse and audit Payara / mcp-gateway-registry logs
rg -n 'omclickhouse' /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null || true
  1. Upgrade Azul Payara to 7.2026.11 (or Enterprise 7.6.0 / 6.44.0 / 5.93.0), set a strong admin password, and enable secure-admin.
  2. Upgrade Amazon mcp-gateway-registry to >= 1.35.0 and audit persisted database state: After upgrading past 1.25.0 (CVE-2026-100307) and 1.35.0 (CVE-2026-125926), inspect the group_mappings collection in MongoDB/DocumentDB for unexpected groups granted "all" UI permissions and inspect registered server definitions for internal/link-local upstream URLs.
  3. Upgrade Portabase to >= 1.21.2 (and verify /data/private/keys/master_key.bin was not modified), Fider to >= 0.36.0, Traccar to >= 6.17.0, MISP misp-modules past 28c27e30f6d3, Heym to >= 0.0.75, taOS to >= 1.0.0-beta.25, Helio to >= 0.8.0, @tinacms/mdx to >= 2.4.2, spatie/browsershot to >= 5.5.0, sync-rpc to >= 1.3.7, Perl Data::Dump::Streamer to >= 3.00, dnspython to >= 2.9.0, and Roundcube to >= 1.7.6 / >= 1.6.21.

Timeline

  • 2026-06-26 to 2026-10-29: Amazon mcp-gateway-registry merges PR #1333 (676d69285b, released in 1.25.0) and releases 1.35.0.
  • 2026-10-23 to 2026-11-02: Azul Payara merges PRs #8495 / #8525 (FISH-14190) and #8537 (FISH-14855).
  • 2026-11-10 to 2026-11-11: CPAN releases Data::Dump::Streamer 3.00 / 3.002; Andrey Albershteyn posts the xfs_admin eval-removal patch on linux-xfs; Rainer Gerhards publishes the rsyslog omclickhouse SQL injection advisory (CVE-2026-93404); and AWS publishes Security Bulletins 2026-179-AWS (CVE-2026-100307) and 2026-180-AWS (CVE-2026-125926).
  • 2026-11-11 (19:17 UTC) to 2026-11-12 (11:17 UTC): NVD, oss-security, and the GitHub Advisory Database publish CVE-2026-110003 and CVE-2026-90908 (Payara), CVE-2026-67449 (Portabase), CVE-2026-65840 (Fider), CVE-2026-127016 (misp-modules), CVE-2026-126777 (Traccar), CVE-2026-67543..67548 (Heym & taOS), CVE-2026-126774 (@tinacms/mdx), CVE-2026-126779 (Browsershot), CVE-2026-65843 (sync-rpc), CVE-2026-126673 (Data::Dump::Streamer), CVE-2026-108472 (xfs_admin), CVE-2026-126813 (Roundcube), and GHSA-45c3-73f7-pv4m (dnspython).

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Explore secrets scanning Get Demo

References