-
Unitree confirmed two flaws in its Go2 robot’s voice assistant, and the fix for the 9.6 is older than the firmware the other record calls affected
Two CVE records published 584 milliseconds apart name the same component, share no firmware version with the report they came from, and leave no version an owner can…
-
Postiz signs sessions, invitations, and password resets with one secret, and one route will sign whatever you send it
Two critical flaws published this afternoon put a Postiz instance in the hands of anyone who can register on it, and the second one never needs the signing…
-
Wasmtime’s critical sandbox escape was closed in March by a compiler speedup nobody called a security fix
Two 9.9 Cranelift flaws reached NVD on Thursday night, and the fix for one of them shipped seven months ago as a 3 percent compile-time improvement.
-
Arista’s second exploited VeloCloud Orchestrator flaw in a month needs only a read-only account, and its whole federal clock is a weekend
CISA gave CVE-2026-114625 a federal remediation deadline of Monday, October 26, 2026 on Friday evening — and Arista’s own advisory says the minimum role an attacker needs is…
-
Collabora’s exploited Nextcloud app can only be attacked while it is not running, and disabling the app does not stop it
CISA added CVE-2026-110447 to the Known Exploited Vulnerabilities catalog on Friday, October 23, 2026, with a federal deadline of Monday, October 26 — and the vulnerable window in…
-
The only fix on record for the 8.8 in Hugging Face Datasets is an unmerged pull request from the person who found it
Every released version is in the affected range, no vendor advisory exists, and the GitHub advisory entry that dependency scanners read names no package and no versions. What…
-
Sixteen of Rapid7’s seventeen new Zimbra records name no fixed version, and all seventeen cite an advisory page that stops at 10.1.13
Seven of the records name the newest shipping release, 10.1.21, as affected, and one of them disagrees with its own machine-readable version range about whether it is. What…
-
Capcom narrows the confirmed data loss to 19 records and calls the impact investigation complete, still without saying how 196 passwords were changed
The nineteen records include saved address book information, which reaches people who never held a Capcom account. What happened Capcom published an update today, October 23, 2026, titled…
-
Quest’s 8-K says the breach did not materially disrupt operations, and its client notice the same day tells Quanum clients to fax paper orders
The client-facing notice also confirms what the filing did not: protected health information and personally identifiable information were part of the access. What happened Quest Diagnostics has published…
-
CGM CLININET is fixed in 2026.MS3 for five flaws and affected in 2026.MS3 by six more, including root code execution over HL7
Eleven CGM CLININET records landed at once this morning: five are fixed in release 2026.MS3, and six — including root-level code execution through HL7 — name 2026.MS3 itself…