-
Langflow’s component scanner ran the code it was checking and returned ‘validated: true’; the fix shipped in June and the CVE arrived Monday
IBM’s bulletin says the scanner’s DANGEROUS_IMPORTS blocklist missed socket and urllib, so submitted code ran server-side during the check and the check reported success; the fix reached PyPI…
-
CenterPoint Energy confirms an unauthorized third party took customer personal information, and the 8-K gives no number
The utility filed Monday evening under Item 8.01 rather than Item 1.05, said an unauthorized third party took personal information from an external-facing system, and gave no count,…
-
Cisco’s Secure Email Gateway root RCE went on KEV the day it was disclosed, with a September 17 deadline — and the CVE lists no 16.5 build
Cisco published the advisory Monday at 4:00 p.m. GMT, CISA put the CVE on the federal catalog the same afternoon with a Thursday deadline and a forensic-triage obligation,…
-
PraisonAI’s 16 new CVEs describe fixes that shipped in June, and CVE-2026-57127’s affected range stops ten releases short of its own description
Sixteen PraisonAI CVE records went live Monday afternoon; every fix they point at shipped in mid-June, 78 releases ago, and CVE-2026-57127’s machine-readable affected range stops ten releases short…
-
Apache Storm’s 14 new CVEs published unscored; CISA backfilled them five hours later, and CVE-2026-82434 now carries both a 10.0 and a 6.5
Fourteen Apache Storm CVE records went live Monday with almost no severity data; CISA’s Authorized Data Publisher wrote CVSS v3.1 scores into them five hours later, and on…
-
MISP LDAP and LinOTP plugins accepted an empty password as a valid login; fixed in 2.5.46, CVE assigned four days later
CIRCL assigned CVE-2026-90961 today for a 9.3 unauthenticated authentication bypass in MISP’s LDAP and LinOTP login plugins — four days after the fix shipped inside a release note…
-
Froxlor CVE-2026-90937 says 2.2.5 is fixed. The newline check first appears in 2.3.8, twelve releases later.
A critical configuration-injection flaw in the froxlor hosting panel got a CVE record today, 97 days after the fix shipped. Both the vendor advisory and the CVE say…
-
Three SIPp buffer overflows are fixed on master and in no release; 3.7.7 is still the newest tag
VulnCheck published three buffer overflows in SIPp on Sunday; all three are fixed in the master branch, and none of them are in a release, because there has…
-
Strapi fixed the WYSIWYG preview XSS in June; the CVE arrived Sunday, and the end-of-life 4.x branch still ships the flaw
CVE-2026-90561 was published Sunday against a fix that reached npm on June 17, 2026 — and against a 4.x branch that went end-of-life in April and still ships…
-
Seven of today’s nine stories describe a fix that never reaches the running install
HAProxy’s HTTP/3 smuggling flaw outranks the day’s only 9.8 because its fix is a commit rather than a release — and in seven of today’s nine stories, the…
-
Internet Download Manager’s kernel driver hands any logged-in user arbitrary registry write, and the vendor hasn’t answered
A public proof of concept turns Internet Download Manager’s own kernel driver into an arbitrary registry-write primitive for any logged-in user, and the vendor — by the CVE…
-
Nodemailer’s remote DoS was introduced by the security fix in 9.1.0, and only 10.x carries the patch
A denial-of-service flaw disclosed Friday and given a CVE ID Sunday was introduced by a security fix in nodemailer 9.1.0 — the hardening that closed one address-parsing hole…
-
Flowise’s cross-workspace credential flaw was patched in July and only got a CVE ID on Friday, six weeks later
Three FlowiseAI advisories published on August 28 with no CVE assigned got CVE IDs on Friday — six weeks after the release that fixed them, and from a…
-
snappy-java’s 7.5 out-of-bounds write is in the one decompress API that doesn’t size its own output, and the newest release is from July 2025
A 7.5 out-of-bounds write lands on the one snappy-java decompression call that makes the caller size the output buffer — and the newest artifact on Maven Central, published…
-
sngrep’s 9.8 stack overflow is fixed in master and in no release, and Debian’s newest package is the top of the affected range
A stack buffer overflow reachable from any SIP packet sngrep renders carries a 9.8, the patch exists as a commit on master, and no tagged release or distribution…