-
DeepSeek Harness gets a 10.0 from CISA’s ADP on a record whose vendor, product and version are all “n/a”
CVE-2026-95182 carries the highest score CVSS 3.1 can produce, and the record carrying it names no vendor, no product, no version, no fix and no vendor advisory.
-
MariaDB’s three 9.9 criticals were patched in August under release announcements that named no security content
Three of the seven MariaDB records published Friday afternoon are rated 9.9 critical — and every fix has been shipping since August, under release announcements that named no…
-
SGLang’s debug filter still reaches eval() on main, and the only fix pull request was closed unmerged
A CVSS 9.2 code-injection record for SGLang published October 16, 2026 names no fixed version, the newest PyPI release shipped hours earlier and is listed as affected, and…
-
Nutanix’s stopgap for its pre-auth Prism bypass is to strip a header it will not name
Nutanix published CVE-2026-84731 on Wednesday with two mitigations for a pre-authentication cluster takeover, and the one most readers could actually deploy today depends on a header string the…
-
A federal clock lands Sunday, and in five of today’s ten stories the control was switched on and reported success
Five of today’s ten stories describe a security control that was switched on, ran, and reported success while the request went through. The item to deal with first…
-
Nine CVEs land against EnergizeLab’s Eilik robots, and the researcher says a third party had webshells on the server first
Nine CVE records for EnergizeLab’s Eilik and EilikO companion robots were published on October 15, 2026, assigned by a researcher-run CNA after four months in which the vendor…
-
BeyondTrust confirms a Remote Support zero-day exploited in August, and says a triage tool closed its own alerts as false positives
BeyondTrust says its sensors fired while an intruder escalated privileges on a Remote Support appliance on August 29, and that the automated triage layer in front of them…
-
CISA put Atlassian’s unauthenticated file read on a three-day clock, ten days after Atlassian said exploitation requires prior knowledge of the exact file path
CISA added the eight-product Atlassian file read to its catalog this afternoon with a federal deadline of Sunday, October 18, 2026, and a forensic-triage obligation attached. Atlassian says…
-
OPNsense’s own release notes attach the 9.9’s CVE ID to a different fix, and one of today’s ten records names a version that does not contain the fix
Ten OPNsense CVE records landed this afternoon for flaws fixed in July. The vendor’s own release notes attach the batch’s critical identifier to a different fix, and one…
-
AWS’s Neptune bulletin says “unintended activity within the query engine environment,” and AWS’s own CVE record says code execution and internal service credentials
AWS’s bulletin carries no severity score and one clause about impact; the CVE record AWS filed hours later carries two critical scores and a much larger claim, and…
-
kin-openapi authenticated one operation while gorilla/mux dispatched another, and the shipped fix guards only the encoded slash
Update, October 15, 2026. Two further kin-openapi records landed at NVD at 5:17 p.m. UTC today, after this story published, and they move the version this page recommends.…