-
CISA added the exploited Windows Shell zero-day as a command injection, and Microsoft’s advisory calls it a security feature bypass rated Important
CVE-2026-96951 went onto CISA’s Known Exploited Vulnerabilities catalog on the same day Microsoft shipped the fix, with a federal remediation deadline of Friday, October 16, 2026, and a…
-
GnuTLS CVE-2026-88647 names 3.8.13 as the affected version, and 3.8.13 is the release that fixed it
A MITRE-assigned record published on October 8 says the hostname verification bypass is in GnuTLS 3.8.13; the source at that tag contains the guard that stops it, and…
-
Ivanti Connect Secure KEV deadline October 16, and Volexity says the Integrity Checker Tool cannot detect the chain
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13 with a remediation deadline three days out and a forensic-triage obligation attached — and the firm…
-
IBM published seven IBM i records overnight, and its 9.9 code injection and 8.3 XSS are fixed by the same four PTFs with neither bulletin saying so
Seven IBM i vulnerability records landed within two minutes of each other, and the PTFs behind them collapse into four sets — the 9.9 and the 8.3 share…
-
SAP’s 10.0 Cloud SDK for Python fix shipped to PyPI on August 21 as a bug fix, and the 0.36 release from September still lacks it
SAP disclosed a CVSS 10.0 server-side request forgery flaw in its Python SDK on patch day, but the fixed release went to PyPI on August 21 under a…
-
GitLab’s 24 missing CVE records all landed in 6.1 seconds, and they name 19.3.5 as the fix for a branch the release patched to 19.3.4
The 24 records this publication reported missing on October 12 were all published inside a six-second window overnight, and they name 19.3.5 as the fix for the 19.3…
-
IBM’s own 9.8 code execution flaw in Maximo AI Service is missing from the summary of the bulletin that carries it
IBM’s own 9.8 unauthenticated code execution flaw in Maximo AI Service appears in a bulletin titled for third-party dependencies, and it is one of four CVE IDs in…
-
AnyDesk fixed pre-auth root code execution on Linux in June and its changelog calls it “a bug that could lead to a crash”
The fix for unauthenticated code execution as root shipped on June 23 under a one-line changelog note about a crash, and the CVE arrived 111 days later, four…
-
Ollama’s new SSRF record names a length-and-character validator, and the commit it cites shipped unannounced on September 15
The record published Monday puts Ollama’s server-side request forgery in a function that does no network work at all, and the commit it names as the fix shipped…
-
SGLang’s Nemotron image processor disables Pillow’s decompression-bomb limit process-wide, in five CVEs with no fixed release
Five CVEs landed on SGLang in a single batch on Monday, and the one worth reading twice is a single assignment inside a model-specific image processor that switches…