-
Post Grid’s new 9.8 says the flaw stops at 2.3.1, its own data says 2.3.32, and the plugin’s newest release is 2.3.24
A critical CVE published Saturday morning against a plugin on more than 30,000 WordPress sites contains two version ranges that contradict each other, and the higher one tops…
-
AVideo’s statistics endpoint returns every viewer’s password hash, and the project’s own advisory says the hash logs you in
Five more CVE records landed against the open-source video platform on Saturday afternoon, bringing the 30-day total to 46, and not one of them names a version to…
-
Mstore API checked the Firebase token’s alg, kid, aud and iss, and never verified its signature
A forged Firebase Phone Auth token signed with the attacker’s own RSA key impersonates any phone number on the store; the fix landed in 4.21.0, as one security…
-
Coolify’s OAuth callback logs a user in on an email match alone, and the affected ceiling is also the current release
CVE-2026-86117 bypasses both the password and two-factor authentication on a self-hosted platform-as-a-service, was first reported 84 days before it published, and names no fixed version. What happened NVD…
-
Three WordPress plugins reintroduced comment XSS after core sanitized it, and none of their changelogs says security
Four Wordfence-assigned CVEs published to NVD on the morning of September 5, 2026 share one sink: plugin code that rewrites comment HTML after WordPress core’s sanitizer has already…
-
Hummingbird’s debug-log guard checked for a class in the wrong namespace, and an unauthenticated cookie name became executable PHP
A guard that was written, shipped, and never once executed: the header meant to make Hummingbird’s cache debug log inert was gated on a class name PHP could…
-
IBM’s 9.8 unauthenticated SQL injection in Operational Decision Manager ships inside a monthly dependency roll-up, and one affected version gets no fix
The highest-scored vulnerability IBM disclosed this week is a first-party unauthenticated SQL injection that ends in a web shell, and it was published inside a routine monthly bulletin…
-
Cua and AutoAgent take 9.8s for unauthenticated command execution, and Cua’s named fix version changed a bind default, not the authentication
Two CVEs published minutes into Friday morning describe the same architecture — a sandbox whose job is to run commands for an AI agent, listening on every interface…
-
Seven of today’s eleven records name no version to patch, which is why an 8.8 leads over two 10.0s
Chrome’s exploited V8 bug leads on an 8.8 over Microsoft’s two 10.0s, because it is the only item today that names a build and a deadline — and…
-
IXON’s VPN client writes unauthenticated config as root, and the CVE landed 30 days after IXON cut the exploit chain from its cloud
CISA republished IXON’s August advisory on September 3 and the CVE record followed a day later, carrying a 9.6 and no mention of the server-side block IXON put…
-
Two Postgres MCP servers lost read-only mode the same day: AWS shipped a longer denylist, Postgres MCP Pro has no fix
Two CVE records published hours apart on September 4 defeat the read-only guardrail in Postgres MCP servers – one by an incomplete denylist, one by an unvisited parser…
-
IBM’s seventeen Langflow CVEs landed in three waves today, naming two different fix versions, and two of its identifiers still have no record
Eight more IBM Langflow CVE records published this afternoon after the nine this site covered at midday, in a third wave pointing at a different fix version —…
-
Google’s Agent Development Kit read any file for an unauthenticated caller, and the CVE landed 239 days after the fix
A CVE published this morning describes an unauthenticated arbitrary file read in Google’s Agent Development Kit; the code was fixed on January 8, 2026, and the record landed…
-
Chrome’s exploited V8 zero-day draws a September 18 federal deadline, and CISA filed it under Chromium
CISA added an actively exploited Chrome V8 type confusion bug to the Known Exploited Vulnerabilities catalog on September 4, 2026, with a federal remediation deadline of September 18…
-
IBM’s nine Langflow CVEs landed seven days after the bulletins that fixed them, and a tenth still has no record
IBM told Langflow operators on August 28 to upgrade to 1.11.3 and offered no workaround; the CVE identifiers that would have put that upgrade into a scanner queue…