-
LightLLM’s PD master routes user prompts to any node that asks, on the same endpoint that took an unauthenticated RCE in February
A researcher reported on Wednesday that LightLLM’s PD master accepts worker-node registrations from any client that opens a WebSocket, with no authentication and no check that the address…
-
Gravity Forms’ 9.8 file upload cites a version number the vendor’s changelog has never listed
Correction, September 19, 2026: this story originally gave the weekday for September 19, 2026 as Friday in two places. September 19, 2026 is a Saturday. The dates themselves…
-
Ten stories, and the only three with a federal clock are the lowest-scored items on the page
Three Linux kernel flaws took a Monday federal deadline on Friday, September 18, 2026, and they carry the lowest severity numbers of the day. The 10.0s carry no…
-
Two IBM Guardium bulletins name 57 CVE IDs, 42 records landed tonight under one identical title, and 15 IDs resolve to nothing
Correction, September 25, 2026: This story reported that IBM published two Guardium Data Protection bulletins on September 17, 2026, naming 57 CVE IDs between them. There were three.…
-
IBM MQ Appliance carries a 10.0 pre-authentication heap overflow with no mitigation, and its CVE record arrived eight days after the bulletin
CVE-2026-10747 is scored 10.0 because the overflow escapes the queue manager’s security authority, IBM lists no mitigation at all, and the CVE record that would put it in…
-
CISA adds a third Linux kernel flaw to KEV in one day, and NVD calls it local while the kernel’s own CNA calls it remote
CVE-2025-39682 is a kTLS receive-path bug carrying a Monday, September 21, 2026 federal deadline, and CISA’s own triage marks it automatable, which the day’s two earlier Linux kernel…
-
CISA gives two exploited Linux kernel flaws a Monday deadline, and NVD scores one 5.5 Medium and the other not at all
Both additions are local-privilege flaws that the kernel’s own scoring says an unprivileged user inside a container can reach, and both carry a forensic-triage obligation due Monday, September…
-
Netty’s ten September fixes shipped with no CVE IDs, and the records Red Hat assigned today name no Netty version
Netty patched ten flaws on September 10, 2026 without CVE IDs; Red Hat reserved and published all ten identifiers this morning, and not one of the records names…
-
Cohesity’s NetBackup Flex bugs are High in CVSS v3.1 and Critical in v4.0, and the advisory’s own text contradicts the v3.1 scope metric
Both vectors are in the same record, filed by the same vendor, and the advisory’s own description of what an attacker gets supports the Critical one. What happened…
-
Synology ships two unauthenticated DSM 9.8s and, in the same ten minutes, the missing CVE records for its April advisory
The new advisory’s CVE records appeared 99 seconds after it was posted; the records for Synology’s April advisory took 156 days and arrived in the same ten-minute window.…
-
Microsoft’s 18 cloud CVEs: seven score 10.0 with nothing to patch, and the only proof-of-concept marker is on a 7.5
Every record in the batch lists an affected version of -, so no scanner will ever match one — and the batch’s only proof-of-concept marker sits on the…
-
Eight stories, and in seven the fix is not where the CVE record points
Feast’s critical bypass has no fixed release, and that outranks a same-day SolarWinds RCE. In seven of the day’s eight stories, the fix is somewhere other than where…
-
Altium’s new 10.0 SSRF in Enterprise Server names the same fixed version its June advisories did
A 10.0 server-side request forgery in the one Altium Enterprise Server component that has to face the network was disclosed on September 16, 2026, and the fixed version…