-
Three critical Secret Server CVEs cite a Delinea advisory page that does not list them, and every hotfix Delinea recommended on September 2 is inside the affected range
Delinea’s CNA published three critical Secret Server on-prem CVEs on September 15, 2026, scoring 9.5, 9.3, and 9.1. Each names a single reference — the vendor’s security advisories…
-
Exploited Pixel modem flaw added to KEV with a September 19 deadline and a forensic triage obligation
CVE-2026-58704 is a permission bypass in the Pixel cellular modem that Google says may be under limited, targeted exploitation. CISA added it to the Known Exploited Vulnerabilities catalog…
-
FreeRDP shipped 22 security fixes with no CVE IDs; VulnCheck assigned 20 of them three weeks later, and 2.x is end of life
FreeRDP 3.31.0 fixed 22 security issues on August 26, 2026 and listed every one of them under a heading called “CVE” — while each advisory’s CVE field read…
-
Ghostscript CVE-2026-39919: the fix shipped in 10.08.0 naming no CVE, and only Debian unstable has it
A heap overflow in Ghostscript’s JPEG 2000 path was quietly fixed on August 24, 2026, shipped in 10.08.0, and only got a CVE ID on September 15 —…
-
Today’s most urgent flaw has no patch you can install. The 10.0 does.
Nine stories, and the one to deal with first is a 9.8 in a C library whose only fix is a major version bump no distribution will ship.…
-
Oracle ships 714 September patches with a CVSS 10.0 in Hyperion, and every CVE record links to the pre-release announcement
Oracle’s Critical Security Patch Update for September 2026 landed Tuesday with 714 fixes and a perfect-score flaw in Hyperion Financial Management — and the one advisory URL cited…
-
Docker Sandboxes shipped the fix for a 9.4 host escape eight days before the CVE, in release notes that never mention it
CVE-2026-77179 says a guest can follow a symlink out of the shared workspace and run code on the macOS host; the record puts the first fixed version at…
-
OpenBMC’s IPMI service still answers RAKP 3 with its hardcoded default key, two months after runZero reported it
runZero published two OpenBMC IPMI flaws on Tuesday. The code that causes both is still in master this afternoon, and the affected range in the CVE records ends…
-
Octopus Deploy’s CVE record clears two 2026.3 builds its own advisory calls vulnerable
The advisory says the 2026.3 line is fixed in build 15816; the CVE record says the affected range stops at build 11816, a number that clears every 2026.3…
-
moment’s locale guard checked for slashes, not for strings, and 2.31.0 is the project’s first release since December 2023
The guard moment added in 2022 to stop path traversal in moment.locale() calls a String method on whatever it is handed, so an object that implements match walks…
-
Express’s req.ip returned attacker-supplied values when proxy-addr’s trust list used IPv4-mapped IPv6 notation
proxy-addr 2.0.8, the package’s first release in more than four years, fixes a trust-list parsing flaw that made every unauthenticated client a trusted proxy.
-
Weights & Biases fixed a path traversal in run file downloads and logged it as an artifact fix
CVE-2026-91771 lands 20 days after the fix shipped. The 0.29.0 security entry names artifact.files() and artifact.checkout() — not the run file API the pull request titled itself after.
-
Crawlab signs administrator JWTs with the string “crawlab,” and its last tagged release was July 2023
CVE-2026-90945 scores 9.8 for a JWT signing key hard-coded as “crawlab.” The affected range says “through 0.6.3” — but the file the advisory cites does not exist in…
-
In five of today’s nine stories, the version field is the part that’s wrong
Cisco’s exploited Secure Email Gateway root RCE comes due Thursday and outranks a utility breach with no number in it — and on five of the day’s nine…