-
phpMyFAQ’s passkey registration let anyone attach a credential to any account, bypassing both the password and TOTP
Twenty-eight phpMyFAQ CVE records landed in one batch on October 17, 2026. The 9.8 says the WebAuthn registration endpoints attached credentials to any account without authentication, and one…
-
Linux’s 9.3 for the PwnEscape VM escape cites host root the researchers say they never claimed in production
The CVE record for the guest-to-host kernel escape found in Vercel’s $1 million sandbox challenge is scored 9.3 CRITICAL on the strength of host root and continuous memory…
-
Atlassian rejected the CVE record behind tomorrow’s federal deadline as a possible mistake, and its own advisory still rates the flaw 9.3 critical
Atlassian withdrew CVE-2026-21589 on Friday night as “a false positive or a mistake,” and the KEV entry built on it, the federal clock that runs out tomorrow, and…
-
Three ZoneMinder command-injection records name fixed releases the project never shipped, including a 1.38.2 it withdrew
Three command-injection records published Friday evening name ZoneMinder 1.38.2, 1.36.40 and 1.39.2 as the fixed releases, and the project’s repository serves none of those tags.
-
Claude Agent SDK’s resume option let a dash-leading session ID define an MCP server, and the fix was an equals sign
A critical argument-injection record published Friday evening describes a failure the Claude Agent SDK’s permission system was never in a position to catch, and a fix that validates…
-
Seven federal deadlines land across this weekend, and five of today’s eleven stories have no version number that means fixed
Seven federal remediation deadlines fall between Saturday and Monday, two of them set on Friday afternoon. Across the day’s eleven stories, a version number was not a reliable…
-
Conduent’s $80 million breach settlement funds medical data monitoring, and names no number of people anywhere in the filing
Conduent filed the agreement under Item 1.01 on Friday evening, and the filing names a dollar figure, a court, and a fund — but no number of people.…
-
BeyondTrust’s exploited Remote Support bypass goes on KEV with a Monday deadline, and no public record names a version to patch to
CISA added CVE-2026-102764 to the Known Exploited Vulnerabilities catalog one day after disclosure, with a Monday deadline and a forensic-triage obligation — and no public record names a…
-
Fortinet’s exploited CLI path traversal is scored with no confidentiality impact, and the research CISA cited says attackers read files as root
CISA added CVE-2025-61624 to the Known Exploited Vulnerabilities catalog on October 16, 2026 with a three-day clock and a forensic-triage obligation, and the research attached to the listing…
-
DeepSeek Harness gets a 10.0 from CISA’s ADP on a record whose vendor, product and version are all “n/a”
CVE-2026-95182 carries the highest score CVSS 3.1 can produce, and the record carrying it names no vendor, no product, no version, no fix and no vendor advisory.
-
MariaDB’s three 9.9 criticals were patched in August under release announcements that named no security content
Three of the seven MariaDB records published Friday afternoon are rated 9.9 critical — and every fix has been shipping since August, under release announcements that named no…
-
SGLang’s debug filter still reaches eval() on main, and the only fix pull request was closed unmerged
A CVSS 9.2 code-injection record for SGLang published October 16, 2026 names no fixed version, the newest PyPI release shipped hours earlier and is listed as affected, and…