Developing
Story is still moving, or sourcing is thin enough that the page says so
-
OpenCode’s only account of its API key exposure is a post on X, and its own site and changelog say nothing
Multiple outlets report that OpenCode confirmed provider API keys may have been exposed for 1.4% of Console users; the company’s own website, documentation, changelog, and parent company site…
-
oc-mirror checks the OpenPGP signature error before the signed body is read, and Red Hat has shipped no fix
A forged PGP message carrying a real Red Hat release key ID passes oc-mirror’s verification and gets mirrored into a disconnected OpenShift registry; Red Hat rates it Important,…
-
Internet Download Manager’s kernel driver hands any logged-in user arbitrary registry write, and the vendor hasn’t answered
A public proof of concept turns Internet Download Manager’s own kernel driver into an arbitrary registry-write primitive for any logged-in user, and the vendor — by the CVE…
-
Bilibili Desktop disables TLS verification process-wide and executes unsigned remote JavaScript through a 211-channel IPC bridge
The CVE published two days after the vendor was notified, the researcher’s own advisory still lists public disclosure as pending, and no fixed version is named. What happened…
-
goose’s recipe security scan skips the two fields that execute commands, and today’s CVE names no fixed version
A public issue filed on July 8 is still open eight releases later, and VulnCheck assigned it CVE-2026-85623 this morning with the affected range running through a build…
-
Proxmox closed an unauthenticated login bypass in 2023 without knowing it was a security fix, and the CVE landed three years later
PSA-2026-00043-1 and CVE-2023-54391 both landed on September 1, 2026, describing an unauthenticated login bypass in end-of-life Proxmox VE 7 that the vendor says a July 2023 refactor closed…
-
Cobham Satcom’s maritime VSAT router has a public exploit and no fix, and the CVE record says the vendor never replied
A command-injection flaw in a Cobham Satcom maritime VSAT router was published with a proof-of-concept exploit, no fixed firmware, and a record stating the vendor never answered —…
-
Microsoft confirms Windows is falsely reporting Defender as turned off, names no update that caused it, and the alert ignores notification settings
Microsoft confirmed the false alerts on August 28 and listed the originating update as N/A, leaving administrators nothing to roll back and no way to suppress them. On…
-
FulcrumSec’s Manchester Airports sample shows itineraries and payment amounts that MAG’s own statement does not list as taken
A group calling itself FulcrumSec claims 86 GB from Manchester Airports Group and published a sample of upcoming flight itineraries and payment amounts — categories of data that…
-
Anthropic is telling Claude users infostealer malware stole their sessions, and the notice exists only as an email
Anthropic emailed Claude users on August 30 to say a bad actor is using commodity infostealer malware to take over their sessions and burn their usage — and…
-
Hasbro is notifying employees of exposed personal data, and its own public account of the March breach has not moved since April
Breach notification letters from Hasbro to its employees became public on August 28, 2026, filed with the Massachusetts attorney general’s office and reported by SecurityWeek and BleepingComputer. The…