-
Floci’s advisory lists no patch and caps the affected range at 1.5.28, and today’s CVE record says the fix shipped in 2.2.0 on October 6
The maintainer advisory for an unauthenticated remote code execution flaw in Floci says no patched version exists and caps the affected range at a June release. The CVE…
-
Three ExtUtils-Typemaps-Default CVEs landed in one second, and CVE-2013-10076 documents a fix that shipped in December 2013
CPANSec published three CVE records for one CPAN distribution within a single second today, and the fixes they document were released 12 years and 10 months apart. What…
-
x64dbg’s MCP plugin and its CVE record disagree on which release closed the unauthenticated debugger control
The GitHub advisory says version 1.0 closed the unauthenticated remote-control flaw; the CVE record published October 9 says every version below 1.1 is affected — and a second…
-
OWASP Coraza’s JSON processor dies on one request with a fatal error recover() cannot catch
Five CVE records for the Go web application firewall library landed on October 9; the worst is an unauthenticated single-request crash a host’s recover() cannot intercept, and the…
-
MariaDB’s September advisories got seven CVE IDs on October 9, and all three 9.9 criticals were left out
Seven MariaDB CVE records appeared in the National Vulnerability Database on October 9, 32 days after the advisories they describe; the three rated 9.9 were not among them.…
-
Seven of today’s thirteen advisories name no version to upgrade to, and the most urgent one names a version that does not finish the job
Tenable’s 9.9 ships a fix version whose own release notes say installing it leaves the vulnerable listener on your domain controllers — on a day when seven of…
-
Broadcom scores the VMware VMXNET3 overflow 9.3 with PR:N, its own advisory text requires guest admin, and ZDI scores it 7.5
Three published scores, three different product lists, and a CVE record that arrived 34 days after the patch — on a flaw whose previous fix bounded the multiplicands…
-
IBM names fix versions for two of the four products in its Verify Access bulletin, and the container editions get a documentation link
The bulletin lists four affected products and names a fix version for two of them; the container editions, named as affected in every CVE record, get a link…
-
AWS closed Zenity’s AgentCore metadata finding as ‘informative,’ and the agent-takeover chain it opens has no CVE and no advisory
One prompt to a public-facing agent reached the instance metadata service and returned the execution role’s credentials, and the only published record of what AWS changed is Zenity’s…
-
Tenable fixed a 9.9 command injection in Identity Exposure, and the SaaS upgrade leaves the vulnerable listener on your domain controllers
Tenable scores the flaw in its own Active Directory monitoring product 9.9, and its release notes say upgrading the service does not replace the vulnerable listener already sitting…
-
Guava’s own advisory scores the flaw 5.9 Moderate and Google’s CVE record scores it 8.2 High, ten days apart
Guava’s maintainers published a GitHub advisory on Tuesday, September 29, 2026, rating a deserialization flaw in three of its collection classes Moderate, with a CVSS 3.1 score of…
-
Google fixed a gVisor sandbox escape with three commits that never mention security, and the project has published no advisory
Google published CVE-2026-95702 on Thursday, October 9, 2026, describing a double free in gVisor that gets code execution in the sentry — the host-side process whose job is…