-
Seven mall4j CVEs landed in one minute with a runnable exploit each, and the one that walks a shopper into the admin API is a 5.4
VulnCheck published all seven records inside one minute tonight, every one against “mall4j through 4.0,” and the project has no release above 4.0, no advisory of its own,…
-
NVD deferred a 10.0 with a public exploit 59 minutes after publication, using a status NIST defined by CVE age
NVD’s own rationale for the “Deferred” label is a CVE’s age. On Monday it applied that label to 43 records that had been published the same day, one…
-
NVD’s own scores drop exploited NetScaler CVE-2026-88772 to High, and hand the bulletin’s only 10.0 to a flaw with no federal deadline
NVD finished analyzing five of the eight Citrix NetScaler records today and attached its own CVSS v3.1 scores, and on four of the five they do not match…
-
CISA retires its weekly vulnerability bulletin today, and none of the three resources it names in place of it publishes a weekly list
The weekly Vulnerability Summary stops today, and the three resources CISA names in its place — the KEV catalog, its advisories, and CVE.org — all answer a narrower…
-
Two exploited NetScaler zero-days draw a Wednesday federal deadline with forensic triage, and Citrix’s own IOC tool warns it may miss compromises
Both flaws were exploited before disclosure and both carry a Wednesday federal deadline that also requires a forensic triage — and the NetScaler tool built for that triage…
-
Forty-nine CVE IDs, one CNA, and five projects that score their own flaws differently
The call today is vm2, and it is not the biggest number on the page. Three CVE records published overnight say vm2 3.12.1 carries three sandbox escapes, two…
-
Nezha rates its OAuth2 regression Low. Tonight’s CVE says 9.8, and the same function’s first CVE said 6.8
The original host header injection was patched in 2.2.0 and came back in 2.2.3. The two CVE records for it differ on exactly three CVSS metrics, and the…
-
Obot’s own Docker quickstart is a 9.8 CVE, and the only fix is a README edit
VulnCheck published five Obot CVE IDs on Sunday for advisories the project wrote in May and June. The critical one describes the vendor’s own getting-started command, and its…
-
A bad rebase deleted image-digest verification from Contrast’s generated policies for ten releases. The project calls it Critical; today’s CVE says High
Eleven CVE records for the confidential-containers runtime landed at once this morning; the one worth reading says a merge accident, not a design flaw, removed the check that…
-
Three MONAI advisories say no patched version exists. Two of the three are fixed in a release candidate from September 18
Eight CVE records for the medical-imaging AI toolkit landed overnight, three of them citing project advisories whose “Patched versions” field reads “None.” Two of those three are already…
-
Netty QUIC clients skipped hostname verification since 4.2.11. The release that fixes it names every CVE as CVE-2026-XXXXX
Twelve Netty CVE records arrived on Saturday. The release that fixes them, published more than two weeks earlier, identifies every one of its security fixes as CVE-2026-XXXXX. What…
-
Froxlor fixed four root-cron flaws in 2.3.11. Every advisory and CVE names 2.3.12 as the patched version
Four VulnCheck CVE records landed for the hosting panel on Saturday. All four say the fix is 2.3.12; the release notes that describe the fixes belong to 2.3.11,…
-
npm audit calls vm2 3.12.1 clean. Three CVE records published overnight say it has two 10.0 sandbox escapes
The advisory database npm audit reads has not received a vm2 advisory since August 14. The project has closed at least 33 since then. What happened At 2:17…
-
Three Monday deadlines, and four stories where “fixed” names nothing you can install
Three of today’s eleven stories are the same event: a CISA catalog addition made on Friday, September 25, carrying a federal remediation deadline of Monday, September 28. That…