-
GitLab’s CVSS 10.0 CI/CD regex overflow has no NVD record four days after the October 8 patch, and neither do the other 23
Update, October 13, 2026. The open question this story ended on has been answered, and two of its numbers have moved. All 24 records were published at the…
-
Bricksforge CVE-2026-85097 is exploited from 63 addresses, and the 3.1.8.10 fix every advisory names has no changelog entry
Attackers started hitting the Bricksforge upload flaw the evening before its CVE record appeared, and the fixed version every advisory names has no dated entry on the vendor’s…
-
Not one of today’s nine stories has a fix to install, so the ranking is what you can close without one
Nine stories, no installable fix among them — so the order is what you can close tonight without a release, and the top of that list is a…
-
GNU Emacs gets a second TRAMP command-injection CVE for an incomplete fix, and the 31.2 the record names has not been released
The new record scopes the flaw to Emacs before 31.2 and TRAMP through 2.8.2, and GNU’s own release directories contain no 31.2 and nothing newer than 2.8.2. What…
-
Plano resolves $OPENAI_API_KEY into the Envoy config before load, and the admin port that returns it binds to 0.0.0.0 with no authentication
Writing $OPENAI_API_KEY into Plano’s config keeps the secret out of your repository and puts it in the file Envoy hands to anyone who asks port 9901 for it.…
-
BotSharp ships one JWT signing key in its starter config, and the 9.1 record built on it claims administrator impersonation the researcher’s writeup declines to assert
BotSharp’s starter host ships one JWT signing key for every deployment, and the 9.1 record built on it asserts an impact the researcher’s own writeup declines to claim.…
-
hyper-mcp verifies a plugin signature against a tag it resolves twice, and skips the check entirely when the plugin is cached
Two CVEs published Sunday morning describe a plugin loader that pulls one manifest, asks Cosign about a name that may resolve to another, and never compares the two…
-
ImageMagick’s Windows Ghostscript fallback runs gswin64c.exe by bare name; the fix is an environment variable the same function checks first
CVE-2026-108693 covers a fallback branch in ImageMagick’s Windows Ghostscript lookup that launches gswin64c.exe with no path at all; the same function checks an environment variable before it ever…
-
Eight CVEs for one flaw: click5’s four CRM add-ons all take an unauthenticated options write, and click5 fixed that same bug in 2022
WPScan published eight CVE records on October 11, 2026, covering one missing-authorization bug and one stored XSS bug repeated across four separately listed click5 plugins; none has a…
-
Spug’s CVE caps the affected range at 4.0.1; v4.1.0 interpolates the same path into a shell=True rsync command
CVE-2026-108540 scores Spug’s File Transfer flaw 9.9 under CVSS 3.1 and 8.6 under CVSS 4.0, names no fix, and caps the affected range one release below the version…
-
Eight of today’s ten stories turn on a record that does not match what it describes, and the other two on a documented defense that was never shipped
The thing to deal with first is the smallest-sounding item on today’s wire. Advanced IP Blocker, a WordPress security plugin sold as an all-in-one hardening suite, shipped a…
-
Advanced IP Blocker’s own 2FA accepted a TOTP code without the password step, and nothing counted the failed guesses
Advanced IP Blocker is a WordPress security plugin with a firewall, rate limiting, and brute-force protection. Its own two-factor login flow accepted a TOTP code without checking that…
-
iFlytek’s astron-agent code node advertised RestrictedPython in its own docstrings, and RestrictedPython was never a dependency
The code node in iFlytek’s astron-agent shipped with docstrings describing a RestrictedPython sandbox. RestrictedPython was never in the project’s dependencies, and the executor those docstrings sat on ran…