-
nginx left the automatic session ticket key uninitialized, and F5 says a forged session can bypass client certificate verification
nginx’s one-line changelog entry reads like an opt-in feature. nginx’s own documentation says automatic session ticket key rotation is what you get when you configure a shared session…
-
10Web Booster writes its REST nonce to a world-readable file, which turns a 9.8 file upload into an unauthenticated one
A critical arbitrary-upload flaw in a WordPress speed plugin with more than 60,000 active installations is reachable without logging in, because the plugin saves the REST nonce that…
-
Five of today’s nine stories name a fix that does not exist, does not install, or does not fix
Three of today’s nine stories concern vulnerabilities already being exploited, and the one to deal with first is attached to the smallest vendor: Ahsay says the version NVD…
-
Ahsay says the version NVD still lists as the fix did not fully address either CVE, and both went on KEV with a Saturday deadline
Both AhsayCBS records went into the KEV catalog on October 14 with a federal deadline of Saturday, October 17. NVD lists 10.3.4 as unaffected on both; Ahsay says…
-
CISA put the exploited PAN-OS root code injection on a three-day clock, and Palo Alto says no workarounds exist
CVE-2026-0322 went into the KEV catalog on October 14 with a federal deadline of Saturday, October 17 and a forensic-triage obligation attached.
-
Better Auth kept OAuth state and magic-link tokens in one namespace, so a state value redeems as a login token
The fix shipped September 30 in version 1.7.7. CVE-2026-110862 arrived two weeks later, and the project’s own advisory page still reads “No known CVE.”
-
Juniper’s October batch is 153 records with three unauthenticated routes to root through J-Web, and one Junos Evolved train with no fixed version
Eleven of the 153 CVE records Juniper SIRT published on October 14 are rated 9.8, three of them give an unauthenticated attacker root through J-Web, and two of…
-
Cisco’s exploited email gateway flaw is fixed by a content update with no restart, and upgrading a compromised appliance destroys the evidence
Cisco PSIRT says CVE-2026-76519 is under active exploitation, and the fix needs no software upgrade and no reboot — but applying it to a compromised appliance erases the…
-
Seven of twelve packages in VulnCheck’s shell-injection batch have no fixed release, and one fix is behind npm’s next tag
We checked all twelve against the registries they ship from: four have a fix at the default install tag, seven have no fix at any version, and one…
-
Komodo’s Periphery agent accepts any key when its key list is empty, and the setup docs never name the list
A function named is_valid returns true for any key an attacker presents, because the list it checks against is empty on every default install — and the vendor’s…
-
NVIDIA’s AIStore bulletin says install 5.0; the release notes say 5.0 will not start on a 4.x network configuration
The bulletin’s remediation is one sentence; the release notes for the version it names describe a mandatory major upgrade that refuses to start on a 4.x network configuration.…
-
Park Dental Partners confirms patient data was taken 46 days after finding the intrusion, and 40 days after the first class action was filed over it
The dental group’s October 13 filing is the first time it has said data was taken, and by the time it said so, four putative class actions were…