-
miniOrange’s SAML plugin ships six editions on one slug, and the 8.1 login-bypass record’s version range fits only the free one
CVE-2026-82842 says “before 6.0.0.” That numbering belongs to the free edition; the paid editions share the slug and their own version lines, and one was on 17.
-
Forminator’s 8.5 remote code execution reached 600,000 WordPress sites as one changelog line: “Security improvements”
Two CVE records published this morning name an 8.5 code-execution flaw and a role-granting form import in Forminator; the vendor’s account of both is five words.
-
getID3’s advisory says 1.9.26 fixes the XXE. The file in the 1.9.26 tag doesn’t, and WordPress ships a byte-identical copy
CVE-2026-94108, published September 20, says getID3 is affected through 1.9.26 with no fixed version named — which contradicts the project’s own advisory from ten days earlier, and matches…
-
REDCap’s unauthenticated 9.8 needs one thing the software exists to hand out: a public survey link
CVE-2026-90817 landed on September 20 with a 9.8, a fix in three releases, one reference that links back to the CVE record, and a structured affected-version field that…
-
Suricata’s biggest security release marks every CVE “Pending,” and the two that arrived cite tickets its own table doesn’t list
Version 8.0.7 shipped on September 15 with dozens of numbered security tickets and not one CVE ID; five days later MITRE published two of them at 9.4, and…
-
Eleven stories, and none of the three highest-scored flaws has a version to upgrade to
The first thing to deal with on Saturday’s page is not the biggest number on it. IBM Sterling File Gateway hands a remote attacker a fully authenticated session…
-
Mistral Vibe created the worktree before its trust check, so a cloned repo’s git hook ran first
The trust gate worked. It just ran after the worktree that git had already executed the repository’s hook to create — and the release that fixed it says…
-
Expat’s second surrogate bug in six weeks is fixed on master, in no release, and absent from the changelog
A CVE published last night rates Expat’s UTF-16 surrogate handling 8.7 and names no patched version, because there isn’t one: the fix is on master, master is still…
-
Exim fixed a 12-year-old Proxy-Protocol heap write in 4.100.1, and the CVE IDs landed five days after the tarball
Exim shipped 4.100.1 on September 18, 2026, numbering the four flaws itself under GCVE. MITRE published the matching CVE IDs the following night, and the fixed downloads had…
-
CISA’s own vulnrichment calls an arbitrary file upload total impact and a fully authenticated session partial, fifteen minutes apart
Fifteen minutes apart on Saturday afternoon, CISA’s vulnrichment program called a WordPress file upload “total” technical impact and an authentication bypass that hands over a working session “partial”…
-
Mint bounded the HTTP chunk-extension line two weeks ago without checking what was in it, and today’s CVE is the third in the same few bytes
Two Mint CVEs on September 4 bounded how many bytes an HTTP server could put on the chunk-size line; today’s CVE is about the fact that nobody was…
-
Perl’s DBI loads whatever module a DSN names, and the CVE record that landed today carries no score
DBI 1.653 shipped on September 9 with two security fixes. One got its CVE record this morning with no score at all, and the other’s record still names…
-
OpenPanel’s 9.9 webhook RCE names a commit hash instead of a version, and its patched-version field says “None”
VulnCheck assigned four CVE IDs to OpenPanel this morning. The critical one has been public since September 4 with no fix, no release, and a git commit hash…
-
IBM Sterling File Gateway grants a full session to an unvalidated SSO header, and the bulletin lists no workaround
IBM’s bulletin for CVE-2026-75878 went up on September 15, 2026. The CVE record that puts it in front of a scanner arrived three days later, at 7:22 p.m.…