-
h3 scored its own cookie-loop hang as Moderate; the CVE published six months later says High, and the whole gap is one availability metric
GitHub’s advisory database still shows “No known CVE” for the flaw CVE-2026-86250 describes, and every affected version — along with the only fix — is a pre-release build.…
-
Bilibili Desktop disables TLS verification process-wide and executes unsigned remote JavaScript through a 211-channel IPC bridge
The CVE published two days after the vendor was notified, the researcher’s own advisory still lists public disclosure as pending, and no fixed version is named. What happened…
-
Advantech fixed three root command injections in its WISE-6610 gateway and published no advisory for any of them
Two of the three were named today at CVSS 9.9, weeks after the firmware that closes them shipped; the third has had a working public exploit since February…
-
Six of today’s nine stories end the same way: a real fix and a record that understates it
N-able’s 10.0 supersedes yesterday’s hotfix, two WordPress 9.8s land, and in six of nine stories the fix is real while the record understates or omits it.
-
MojoX::Authentication builds its SAML binding without a trust anchor — the exact case Net::SAML2 made fatal in July
Net::SAML2 made a trust anchor mandatory on July 30 after a signature-verification bypass. Five weeks later a downstream Perl module has its own CVE for omitting one.
-
June’s curl native-CA flaw drew a 9.1 from CISA; September’s wider version of it entered NVD with no score at all
curl fixed nine flaws in 8.22.0 on September 2; NVD published all nine records four days later with no CVSS, no CWE, and no CPE.
-
A 9.8 in LearnDash MemberDash resets any administrator’s password, and the CVE’s only vendor link is a sales page
CVE-2026-16310 lets an unauthenticated visitor set the password on any WordPress account, administrators included, with no notification to the victim. NVD names no fixed version, the vendor’s release-notes…
-
Frontend Admin’s permission check fails open on a non-numeric post ID, and the fix shipped as a changelog line about permission checks
CVE-2026-75816 carries a 9.8 and lets an unauthenticated visitor take over any WordPress account on a site running Frontend Admin by DynamiApps 3.29.12 or earlier. The version that…
-
Ninja Forms, JetFormBuilder, and Redirection for Contact Form 7 all escape input before expanding shortcodes, and the proof-of-concepts land September 16
Jakub Herman found the same ordering mistake in three unrelated WordPress form plugins, WPScan’s records for all three reached NVD on September 6, 2026, and the proof-of-concepts are…
-
Bifrost’s LLM gateway loaded attacker-supplied native code without authentication, and the fix shipped as a changelog line about path normalization
JFrog’s CVE for the Maxim AI gateway landed on September 6, 2026, eleven days after the release that fixed it — a release whose notes describe the fix…
-
N-able’s second N-central hotfix in two days fixes a 10.0 pre-auth RCE that HF3 does not
N-able told on-premises N-central customers to install Hotfix 3 immediately on September 5, 2026. The next day it published a CVSS 10.0 pre-authentication remote code execution flaw that…
-
Grav CVE-2026-86193 names one affected plugin; the vendor advisory names three and fixes one
Five Grav CVEs landed at NVD on Saturday; the highest-scored one is recorded against a single plugin, while the vendor advisory it came from names three and gives…
-
libpcap 1.10.7 fixes a BPF interpreter memory write Include Security reported in 2018
The highest-scored of the seven CVEs fixed in Saturday’s release carries a commit note saying Include Security reported it in 2018. What happened The Tcpdump Group released libpcap…
-
Six of today’s twelve stories break down at the fix line, and the flaw under active attack is not one of them
MikroTik leads because it is the only thing being exploited tonight and it has a build to install. In six of the day’s twelve stories, the record cannot…
-
Catalyst Brands’ payroll-vendor breach exposed passports, A-numbers, and digital signatures, and the vendor is not named
Catalyst Brands — the parent of JCPenney, Brooks Brothers, Eddie Bauer, Aéropostale, Lucky Brand, and Nautica — filed a breach notice with California on September 4 describing a…