Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service high
vulnerability · GHSA-v53p-9fqp-m79j · osv.dev · Sep 29
Daily issue
Wednesday, September 30, 2026
71 items · compiled overnight
Security
7
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab high
vulnerability · GHSA-hq2x-r82h-9wj4 · osv.dev · Sep 29
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions high
vulnerability · GHSA-gr2m-v5gq-v685 · osv.dev · Sep 29
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled high
vulnerability · GHSA-j84w-jfhq-vhvj · osv.dev · Sep 29
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions high
vulnerability · GHSA-9qh4-3jw8-366w · osv.dev · Sep 29
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS moderate
vulnerability · GHSA-8vvx-rff5-p5rq · osv.dev · Sep 29
Electron: Local race condition in Squirrel.Mac update installation on macOS moderate
vulnerability · GHSA-vv43-5jgx-7qv8 · osv.dev · Sep 29
Claude
1
Elevated errors on claude.ai, Claude Code, Claude Cowork and the Claude API
incident · status.claude.com · Sep 29
AI
7
Quoting Anthropic Frontier Red Team
blog · simonwillison.net · Sep 29
GPT 6.1 Sol: Near-Astra intelligence for a fifth of the price
blog · simonwillison.net · Sep 29
OpenAI DevDay 2026 live blog
blog · simonwillison.net · Sep 29
DevDay 2026 Recap
model · openai.com · Sep 29
Introducing GPT-6.1 Sol
model · openai.com · Sep 29
Introducing dots
model · openai.com · Sep 29
Towards safety cases for frontier AI training
model · openai.com · Sep 28
Tech
49
America.gov gets really weird when you ask it about Minecraft, but it’s not a glitch
blog · techcrunch.com · Sep 29
Livenerf: Has Opus 5.5 been nerfed yet?
blog · github.com · Sep 29 · 344 pts
Most powerful obesity drug yet: People lost up to 25% of weight in trial
blog · arstechnica.com · Sep 29
The internet is convinced Elon Musk’s xAI trolled OpenAI’s ‘Dots’ launch
blog · techcrunch.com · Sep 29
Your car and its mobile app are probably handing over all kinds of data to tech companies
blog · techcrunch.com · Sep 29
Protests against OpenAI get increasingly creative
blog · arstechnica.com · Sep 29
a16z-backed EliseAI raises $350M, doubles valuation to $4B
blog · techcrunch.com · Sep 29
Tesla secures $30B in new credit lines as it looks to scale Cybercab, Optimus
blog · techcrunch.com · Sep 29
AMD acquires World Labs AI startup, upping the ante against Nvidia
blog · arstechnica.com · Sep 29
Trump ads paid for by US government allegedly violate anti-propaganda laws
blog · arstechnica.com · Sep 29
OpenAI’s latest features take direct aim at the app store model
blog · techcrunch.com · Sep 29
OpenAI reportedly in talks to raise $30B round at $1.4T valuation
blog · techcrunch.com · Sep 29
+37 more in this section
Web
2
Search trace spans from the Vercel CLI
blog · vercel.com · Sep 29
GPT-6.1 Sol now available on AI Gateway
blog · vercel.com · Sep 29
Mobile & Stores
1
chore: Migrate "unpublished" changelog entries to changesets (#50762)
release · github.com · Sep 29
Quick Hits
4
- pnpm 12.8.2pnpm-releases
- vscode-typescript/v1.0.1typescript-releases
- v2.1.285claude-code
- v16.3.7nextjs-releases