-
VulnCheck has now filed ten CVEs against LightLLM, nine in seventeen days, and the project has answered none of them
VulnCheck filed three more LightLLM records this afternoon, bringing the catalog to ten CVEs against one inference server — nine of them in seventeen days, six scored 9.8,…
-
Joomla scores a JCTables SQL injection 10.0, flags it Attacked, and names the fixed version as the affected one
The CVE record Joomla filed for a 10.0 SQL injection in the JCTables extension carries an exploit-maturity flag reading “Attacked,” a CISA SSVC block reading “none,” and a…
-
Apache patched an unauthenticated SOAP authentication bypass in WSS4J and scored none of its four CVEs
Four WSS4J CVEs landed inside four minutes, including one that lets an unauthenticated attacker forge a signed SOAP message. Apache filed all four with textual severity and no…
-
Cisco says SD-WAN Manager is exploited and every system is affected — its CVE record names only 17.x and 18.x
Cisco confirmed active exploitation of a 9.8 authentication bypass in Catalyst SD-WAN Manager, then filed a CVE record listing 23 affected versions, none of them in the six…
-
A malicious model’s config.json can run Python in Unsloth, and the fixed version number belongs to unsloth-zoo, not unsloth
VulnCheck’s CVE-2026-93348 turns a JSON metadata field into an exec() payload with no pickle and no trust_remote_code, and the two packages share version strings two weeks apart. VulnCheck…
-
Two new LightLLM CVEs put unauthenticated pickle deserialization on the network, and the project’s last such report is still open
VulnCheck published CVE-2026-103040 and CVE-2026-103041 on Tuesday night, both scored 9.8, both reaching code execution through RPyC services that accept pickled objects from any host, and neither names…
-
The record caught up on one of today’s six stories, and it is still behind on the other five
The thing to deal with first is not the biggest number on today’s page. Apple’s CoreGraphics out-of-bounds write went onto CISA’s catalog on Tuesday with a cisaActionDue of…
-
PyJWT shipped the fix on September 11 and got its thirteen CVE IDs on September 28, all in the same second
The critical one, CVE-2026-102268 at 9.1, lets anyone holding the public verification key forge HMAC tokens — and it has been fixed on PyPI for seventeen days. PyJWT…
-
Apple’s CoreGraphics zero-day is in KEV with an October 2 deadline, and CISA’s own Exploitation field flipped from none to active
Update, October 11, 2026. The federal deadline stated in this story’s headline and body — Friday, October 2, 2026 — is not the deadline the record carries today.…
-
lib0’s memory-disclosure advisory names 1.0.0-rc.33 as patched, and rc.33 is missing the second bounds check
Two out-of-bounds reads in the binary decoder underneath Yjs got CVE IDs on Tuesday, September 29, 2026 — and the release the first advisory names as patched carries…
-
OpenDMARC took ten CVEs in two days, and its newest release is still 1.4.2 from December 2021
Ten CVEs landed on OpenDMARC on September 28 and 29, 2026, all of them against “up to 1.4.2” — which is every version the project has ever released,…
-
Upbound disclosed its July intrusion to investors in nine days and to customers in 72
The 8-K filed nine days after discovery called the accessed customer information “non-sensitive” and booked roughly $13 million in fraud losses as not material; the notification letters dated…
-
Kiteworks shut down its customers’ servers, fixed a critical flaw, and published no CVE
Kiteworks told its entire customer base to take production systems offline on September 25, 2026, found a previously unknown critical flaw during the window, deployed a fix, and…
-
Apple’s exploited CoreGraphics zero-day carries a CISA enrichment that reads Exploitation: none
Apple published CVE-2026-86950 on September 28, 2026 with its own report of a targeted attack in the description. Twenty-nine minutes later, CISA’s automated enrichment attached an SSVC assessment…
-
In four of today’s six stories the severity score points at the wrong flaw, on the day CISA stopped sorting by it
Two exploited NetScaler flaws carry a Wednesday federal deadline with a forensic triage obligation, and one of them stopped being critical today.