-
Eclipse Che’s unauthenticated 9.8 was fixed with 321 added lines and zero deletions, and the auth default is still false on main
The patch adds 321 lines and deletes none: the shell construction that caused the injection is untouched, a 21-character blocklist now sits in front of it, and the…
-
Asterisk fixed twenty flaws in June and the CVE records landed this week, including one caused by a 2022 fix never carried forward
The fixes shipped on June 25; the CVE IDs that would have put them in front of a scanner arrived this week, and one of the twenty exists…
-
Dell’s 35 new Data Domain CVEs name four unauthenticated 9.8s, and all 136 of their version ranges are unparseable
Thirty-five CVE records for Dell’s backup appliance landed this morning, four of them unauthenticated 9.8s, and all 136 of their machine-readable version ranges are written in a way…
-
jackson-databind’s June deserialization fix is incomplete, and the three builds it named as fixed still accept the attack
The June fix for a jackson-databind allow-list bypass left the same door open, and the bypass of that fix scores higher than the bug it was meant to…
-
Two CVEs got a deadline today, and 219 others arrived with no score at all
Both KEV additions are due Tuesday, November 10, 2026, and the vendor paperwork on each one argues with the catalog that now lists it.
-
Thunderbird 159 fixes seven email-client flaws, and two of them leak Windows credentials from merely displaying a message
Six of the seven are the same bug worn seven ways: Thunderbird fetching a location that a sender, an RSS feed, a calendar server, a news link, or…
-
Adobe still reports no known exploits for the Magento upload flaw CISA added to KEV, and its bulletin scores it 9.6 where its own CVE record says 9.3
CVE-2026-48356 was published on July 14 and reached the federal catalog on October 27 with a November 10 deadline; the only public exploitation evidence is one vendor’s research,…
-
Brotli’s decoder flaw is on KEV with a November 10 deadline, and the build headed for Debian stable is still unpatched
CISA’s catalog names the entry after the unchecked return value rather than the out-of-bounds write that Google’s own release note leads with, and Debian’s tracker still marks the…
-
Chrome’s 52-fix update credits one reporter on all four criticals and 16 of 33 external bugs
Twelve of the 33 external credit lines name an AI lab’s security program, one of them printing the reporter’s own attribution instruction verbatim, and not one of the…
-
Veeam’s fix build for the 9.0 cross-tenant SQL injection is listed as affected by two other CVEs in the same article
Veeam disclosed nine vulnerabilities across three products on Tuesday, October 27, 2026. In Backup for Microsoft 365, the build named as the fix for a 9.0 cross-tenant SQL…
-
Tanium’s two 8.8s let a user with read-only Tanium permissions run code on endpoints, and the CVE records say none of it
Tanium published 31 CVEs in an eight-minute window on Tuesday afternoon. Every record describes its flaw in one sentence that names no attack path. The advisory pages behind…
-
Adobe’s Campaign Classic bulletin prints 9.8 beside a vector that scores 10.0, and Adobe’s own CVE record says 10.0
Adobe published eight critical vulnerabilities in Adobe Campaign Classic on Tuesday, October 27, 2026. Its bulletin scores the worst of them 9.8. Its own CVE record for the…
-
Nine MCP servers take command-injection CVEs in one batch, and every one is scored as a local attack
VulnCheck published nine command-injection CVEs against nine unrelated MCP servers inside two minutes on Tuesday morning, eight of them with no fix, and every one scored as a…
-
Mozilla shipped 167 Firefox CVEs in one release, none of them scored, and NVD deferred them within the hour
Firefox 159 shipped Tuesday with 167 CVEs — 42 percent of every CVE ID published worldwide that day — and not one of them carries a CVSS score,…
-
WatchGuard’s 18 new Fireware CVEs name three fixed releases that its own release notes do not list
Eighteen Fireware OS advisories went up at 10:52 a.m. Central on Tuesday, seven of them critical and six reachable before authentication, and the three releases every one of…