-
Adobe stamps its ColdFusion bulletin Priority 1 while saying it knows of no exploits, and the one flaw needing no login scores third
APSB26-119 carries Adobe’s most urgent priority rating and Adobe’s own statement that it is not aware of any exploits in the wild — a combination that means the…
-
Three Ivanti ITSM records share one description and one CWE, and two score 8.8 while the third scores 9.9
Ivanti published eight Neurons for ITSM CVEs on September 8, 2026; three of them carry byte-identical descriptions and the same weakness class, two are scored 8.8 and the…
-
Both Windows zero-days added to KEV today are rated Important at 7.8, and Microsoft’s own vector marks one exploit Unproven
Both Windows flaws CISA added to the Known Exploited Vulnerabilities catalog on September 8, 2026 are local privilege escalations rated Important at 7.8, and Microsoft’s own CVSS vector…
-
United Natural Foods books its cyberattack as a $21 million credit — insurance recoveries beat costs, and the two-year total is $5 million
The June 2025 attack that halted a $31 billion food distributor now shows up in its annual results as a negative adjustment, because $45 million of insurance arrived…
-
Boston Scientific escalates to Item 1.05 and says it will miss its 2026 guidance — the filing still says nothing about data
Fourteen days after the August 25 attack, the company has made the materiality determination it expressly withheld in August and named the guidance it will miss — and…
-
Siemens patches a root-level file upload in Siveillance Control, and each of the four editions has a different fixed build
One flaw, one advisory, four editions of Siveillance Control — and the build number that means “fixed” is different in each of them, in an order that does…
-
Siemens splits one broken session token in the Reyrolle 7SR5 into three CVEs, and its own two vectors disagree on one of them
Siemens wrote the Reyrolle 7SR5’s session-token failure as three separate CVEs with three different weakness classes, and for one of them its own CVSS v3.1 and v4.0 vectors…
-
SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric
SAP’s September patch day put a 10.0 on a flaw its own record describes as a crash, and a 9.8 on one its own record describes as an…
-
A 10.0 under attack, two unfixed 9.8s, and not a version number among them
Adobe confirmed exploitation of a 10.0 and shipped a hotfix with no version number. Red Hat published two 9.8s with zero fixed products. The day’s records were clear;…
-
Six Knowns CVEs landed together on September 7 — five are fixed in 0.30.0, and one says the flaw reaches 0.33.0
VulnCheck pushed a batch of Knowns CVEs into NVD on the evening of September 7, 2026 — five of them fixed in 0.30.0, and one that says the…
-
Adobe confirms a 10.0 in Adobe Commerce is being exploited, and the fix it shipped has no version number
Adobe published APSB26-146 on Monday, September 7, 2026, confirming that a CVSS 10.0 unauthenticated code-execution flaw in Adobe Commerce and Magento Open Source is being exploited — and…
-
A failed SASL PLAIN bind leaves its identity on the connection, and 389 Directory Server hands the next bind full Directory Manager rights
CVE-2026-18922 needs no account and no unusual configuration, and Red Hat’s own product data lists 31 affected products, one unaffected, and zero with a fix. What happened Red…
-
FreeIPA’s self-managed token ACI lets an unauthenticated LDAP client into the administrators group, and Red Hat’s remediation is a firewall rule
Red Hat published CVE-2026-76578 at a 9.8 on September 7, said it confirmed the underlying technique against a default, unmodified installation, and listed no fixed package for any…
-
MediaTek grades its bulletin on CVSS v3.1 — then rates three flaws High that its own CVSS scores put at Medium
Correction, October 5, 2026. This story attributed the CVSS scores on the September records to MediaTek. They are CISA’s. The raw CVE records for CVE-2026-20500, CVE-2026-20503, CVE-2026-20506 and…
-
The SEC made Ardent Health drop $97.7 million in non-GAAP add-backs. Its 2023 ransomware carve-out survived.
Ardent Health’s Friday 8-K removes two adjustments after talks with the SEC’s Division of Corporation Finance, and leaves untouched a cybersecurity line that has run $35.6 million net…