-
Feast’s own Helm chart publishes the constant that turns off its access control, and 0.66.0 is still the newest release
A critical authentication bypass in the Feast feature store is armed by a constant that Feast’s own Helm chart writes into every deployment — and the project’s newest…
-
mport, MidnightBSD’s package manager, treated failed integrity checks as success — the fixes shipped in June and the CVE IDs arrived today
Twelve CVE records landed today for a package manager whose maintainer fixed and disclosed the flaws on June 6, 2026 — and four of them describe the same…
-
SolarWinds fixed an Access Rights Manager RCE caused by a hardcoded static key, and no published document says whether to rotate anything
SolarWinds published the advisory, the CVE record and the fixed build on the same day — and the only remediation any of them names is the upgrade. What…
-
vm2, discontinued in 2023, took 30 new CVE IDs today — every one already fixed in August
VulnCheck published 30 records for the Node.js sandbox this afternoon. Every one names a release that already fixed it, and the newest of those releases shipped on August…
-
Cisco scores an FMC root RCE 9.8 as unauthenticated, then says it only works from a host on the administrator’s own access list
CVE-2026-20242 is scored 9.8 with no privileges required, but Cisco’s own advisory says it can be exploited only from a host an administrator already put on the appliance’s…
-
Craft CMS’s two new RCE CVEs both cite vendor advisories that GitHub returns 404 for
Both CVE records published on September 16, 2026 name a craftcms/cms GitHub Security Advisory as their vendor source, and both of those identifiers return 404. What happened On…
-
Cisco’s ISE and firewall hardening releases say exploited flaws are in the grouped CVEs, without saying which
Two of the three hardening advisories Cisco posted on September 16, 2026 say some of the vulnerabilities they fix are already being exploited, and neither one says which…
-
Three federal clocks started today, all due Saturday. In seven of eleven stories, the record is the problem.
Cisco ISE is the first call. But three separate KEV additions landed today with the same Saturday deadline, and in seven of eleven stories the authoritative record is…
-
Accela says it discovered a December 2025 breach on August 31, 2026, eight months after a ransomware group named it
Accela told California on September 14 that it discovered a December 2025 breach of a file transfer portal on August 31, 2026 — eight months after a ransomware…
-
Arista publishes 25 EOS CVE records seven days after the advisories, including two unauthenticated 10.0s
Arista’s September 9 advisories became machine-readable CVE records on September 16 — 25 of them, two rated 10.0 for unauthenticated code execution, and not one where the vendor’s…
-
Acronis Backup CVE-2026-87886 enters KEV with a September 19 deadline and no published CVE record
CISA put a three-day federal clock on an Acronis privilege-escalation flaw the vendor says is under limited, targeted attack. The identifier on that clock has no record in…
-
NVD scored an Apple sandbox escape 10.0 as a remote flaw, two hours after scoring an identical one 8.4 as local
CVE-2026-65381 and CVE-2026-84580 are the same weakness class, fixed in the same three macOS releases, with the same impact line — and on September 16 NVD’s own analysts…
-
An unauthenticated service on TCP port 5058 runs root commands on Advantech EKI-1242 gateways, and the firmware updater checks no signatures
Nozomi Networks Labs published fifteen CVE records for Advantech’s EKI-1242 protocol gateways on September 16; the worst needs no credentials at all, Advantech’s own advisory lists a sixteenth…
-
Delinea posted the three missing Secret Server advisories dated a day before they appeared, and no hotfix it recommended clears all three
The Delinea advisory page that carried nothing about CVE-2026-15638, CVE-2026-15639, and CVE-2026-15640 this morning now carries all three, dated the day before they appeared — and the affected…
-
Cisco ISE authentication bypass scores a 10.0, was found in a support case, and is already being exploited
CVE-2026-76460 went on CISA’s Known Exploited Vulnerabilities catalog the same day Cisco disclosed it, carrying a September 19 federal deadline, a forensic triage obligation, and no workaround. What…