-
Mooncake fixed a 9.8 unauthenticated memory read-write in a performance commit, and the 9.4 beside it is unfixed in the newest release
Two critical CVE records landed against Mooncake overnight: the 9.8 was already closed in August by a commit about connection-lane scheduling that never mentions security, and the 9.4…
-
AI coding agents published 13,000 internal screenshots to public GitHub repos, and the tool behind a third of them warns against exactly that
Glow Labs says AI coding agents routed screenshots through public GitHub repositories to get around a missing upload API — and the tool a third of the affected…
-
FortiMail’s exploited 9.8 landed on KEV with a Sunday deadline, and Fortinet’s advisory calls every fix “upcoming”
CISA gave federal agencies until Sunday, October 4, 2026 to remediate a 9.8 unauthenticated file write that Fortinet says is being exploited — and the advisory’s own Solution…
-
Red Hat Satellite’s provisioning endpoint checks that a token exists in the database, not that the requester sent one
Red Hat shipped 31 CVE fixes for Satellite 6.19 on October 1, 2026, and three of them lead to the same place: the root passwords Satellite holds for…
-
Fortra prints 6.5 on a BoKS advisory whose own vector computes 7.9, and labels it High
Seven of the eight BoKS advisories Fortra published October 1 score exactly as their vectors compute; the eighth is off by 1.4 points, across a band boundary.
-
Fortra’s BoKS upgrade does not secure the Active Directory passwords its own flaw generated
The warning, and the fixed version, appear only in the CVE record; Fortra’s advisory page for the 9.9 carries neither.
-
Fleet’s device API accepted hostnames and hardware serials as authentication tokens, and the fix shipped sixteen days before the CVE existed
Fleet patched a critical authentication bypass in its iOS device API on September 15, 2026 and published an advisory that said “No known CVE”; the identifier arrived on…
-
WAGO’s new CODESYS advisory reproduces two scores that CERT@VDE’s own CVE records contradict, one too high and one too low
WAGO’s advisory published Thursday morning prints 8.3 for one CODESYS flaw and 5.5 for another; the CVE records for those same flaws, assigned by the same organization that…
-
WAGO’s 9.8 BACnet advisory names 4.8.9 as the fix, while its companion advisory the same morning requires 4.10.0
An unauthenticated attacker can read or overwrite any file on eleven WAGO controller families by naming it in a BACnet object, and the two advisories WAGO released on…
-
In seven of today’s nine stories, the version data is wrong, missing, or names the wrong package
The thing to deal with first is not the biggest number on today’s page. Cisco’s authentication bypass in Catalyst SD-WAN Manager scored 9.8, and two records filed this…
-
OrdaSoft’s Joomla CCK shipped its upload allow-list commented out, and the 10.0 record for it links no advisory
The CVE record Joomla filed this afternoon for a 10.0 unauthenticated remote code execution in OrdaSoft’s Joomla CCK extension says the control that would have stopped it was…
-
Joomla fixed 16 core flaws including an MFA bypass on September 25, and the CVE records did not appear until September 29
Joomla shipped 5.4.9 and 6.1.4 on Friday, September 25, 2026, closing 16 flaws in the CMS core including an MFA bypass — and the CVE records for all…
-
Cisco Catalyst SD-WAN Manager draws an October 3 federal deadline, and NVD overrode Cisco’s own affected-version list
CISA added Cisco’s actively exploited Catalyst SD-WAN Manager bypass to the Known Exploited Vulnerabilities catalog on Wednesday, September 30, 2026, and set the federal deadline at Saturday, October…