-
CISA’s coordinator marks the GitLab 10.0 as actively exploited, and GitLab’s own advisory still says nothing
The CVE record NVD published overnight carries a CISA Coordinator block dated September 11 that reads Exploitation: active — a call GitLab has not made, watchTowr has not…
-
In three of today’s eight stories, the fix on offer covers less than the flaw does
A three-day federal clock on exploited MikroTik RouterOS flaws runs out Sunday, September 13, and the catalog leaves off the bypass that opens the chain. The biggest-sounding story…
-
Anthropic’s misuse report describes one actor working through roughly thirty AI companies in four days, using victims’ own API keys
Anthropic’s new misuse report describes a financially motivated actor working through roughly thirty AI companies in about four days to reach a pre-release model, swapping in each victim’s…
-
Florida’s motor vehicle agency confirms its law enforcement driver database was breached, and names no number
Florida’s motor vehicle agency has confirmed that its law enforcement driver database was breached, says the access came through credentials a Plant City police employee had stored on…
-
GitLab patches a 10.0 unauthenticated file read, and no 18.x build in the release carries the fix
Update, September 12, 2026: NVD published its record for CVE-2026-85706 at 3:16 a.m. UTC on September 12, after this story ran. The record carries a CISA-ADP SSVC block…
-
CISA puts two more JFrog Artifactory flaws on KEV with a September 25 deadline, and the release that fixes one still leaves the other open on the same branch
CISA added CVE-2026-42016 and CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on September 11 with a September 25 deadline — and on the 7.133 branch, the release that…
-
Conduent settled the class action over its January 2025 breach with no amount disclosed, and filed it under Item 8.01 rather than 1.05
Conduent reached the agreement in principle in August 2026, but it became public on September 10, 2026, when the parties told the court — and the filing that…
-
Nutex Health’s stolen data has been published online, and the update goes back under Item 8.01 with the materiality finding unchanged
Eleven days after moving its breach disclosure up to Item 1.05, Nutex Health filed the update that the data is public under Item 8.01 — and said its…
-
CISA puts two of the three exploited MikroTik RouterOS flaws on KEV with a Sunday deadline, and leaves the SSH bypass that opens the chain off it
CISA added two of the six September MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog on September 10, with a federal remediation deadline of September 13 —…
-
IDScan.net confirms unauthorized access to its cloud and names no number — every figure in circulation comes from the marketplace that sold the data
The company’s own notice confirms unauthorized access and gives no figure at all; the 153 million and 170 million numbers in circulation come from the criminal marketplace that…
-
Knowns 0.30.0, named as the fix for five CVEs three days ago, is the top of the affected range for a 9.8 published today
The project’s own advisory scores the same flaw 10.0 and titles it a sandbox escape; the CVE record published today scores it 9.3 on CVSS v4.0 with every…
-
passport-saml-encrypted verifies SAML signatures only when an optional cert is set, and its own README example leaves it out
A 9.1 authentication bypass published this afternoon covers every version the package has ever shipped, the flaw was reported by PayPal’s own security team, and there is no…
-
Ten Renovate CVEs arrive 34 days after the fixes, in GitHub records that name no affected package
Ten CVE records for Renovate were published on September 10, 2026, for flaws the project fixed in npm on August 4 and August 7 — and the copies…
-
Red Hat discloses a crun escape to host root with no fixed release, and the record names only Red Hat’s own images
CVE-2026-84042 is described as affecting every crun build from 1.29 onward, but the record’s affected list has one entry — a Red Hat image product — and NVD…