-
CISA scores a Red Lion N-Tron factory credential 6.0 in its advisory and 9.2 in the CVE record it filed a day later
CISA’s advisory for Red Lion’s N-Tron 700 switches scores a persistent factory administrator credential 6.0; the CVE record the same CNA filed a day later scores it 9.2,…
-
CISA’s openPDC advisory lists ‘no fix planned’ for a 9.8 hard-coded credential, and the fix versions it names are not on the project’s releases page
CISA’s advisory for the open-source phasor data concentrator openPDC carries a no_fix_planned remediation on five of its six vulnerabilities — and on the 9.8 hard-coded administrative credential, that…
-
Nginx UI’s ten CVE records land 72 days after the fix, and one flaw exists only in the release that fixed the other eight
Ten CVE records for Nginx UI reached the CVE List this morning for fixes that shipped on July 29 and September 14 — and one of them exists…
-
Microsoft’s Azure SRE Agent record describes missing authorization and classifies it as SSRF, in a batch of seven cloud CVEs with nothing to patch
Microsoft filed seven cloud-service CVE records in a four-second window on Wednesday night, and the one covering its AI operations agent describes a missing authorization flaw while classifying…
-
FalkorDB’s only length check in four of six Securin-reported flaws is an ASSERT() that release builds compile out
Four of the six FalkorDB records Securin published overnight say the same thing about the bug’s only guard rail: it is an ASSERT(), and release builds compile it…
-
SGLang’s pickle off switch swaps the envelope for MessagePack and still calls pickle.loads, and the 0.5.21 wheel is identical to 0.5.20
SGLang ships an environment variable that reads like a safety switch. Turning it off changes the wire format from pickle to MessagePack and leaves pickle.loads() in the decode…
-
In four of today’s twelve stories, what failed was a fix the vendor had already shipped
Citrix’s new 9.5 lands on the two builds it shipped as fixes, including the one that closed Wednesday’s federal deadline — and it is one of four stories…
-
An autonomous AI pentesting agent found the bypass of a 2020 ansible-core fix, and Red Hat names no fixed version
Red Hat’s own record credits an autonomous pentesting agent with finding that a 2020 fix in Ansible’s collection installer can still be walked around, and the record names…
-
The same regular-expression anchor in fast-jwt has now produced three algorithm-confusion CVEs in 34 months
A JWT library reached the CVE List on Thursday with an advisory title that names its own predecessor: the April patch for an algorithm-confusion flaw added a trim()…
-
Citrix’s last two NetScaler fix builds are both affected by a new SAML memory overflow it scores 9.5
Cloud Software Group published a bulletin on Thursday for a new NetScaler flaw it scores 9.5 critical. The builds it lists as affected include the two most recent…
-
CISA added five legacy flaws to KEV, the oldest from 2015, with a federal deadline of Sunday, October 11
Federal remediation deadline Sunday, October 11, 2026, on five flaws disclosed between 2015 and 2023 — and two of them have no CVSS v3 score at all, so…
-
MongoDB’s encryption library returned unrecognized ciphertext as plaintext, and its public ticket says only ‘See SECBUG-4378’
MongoDB filed ten driver CVEs in 26 minutes this evening; the one that matters most to anyone using client-side encryption is scored 5.3 and documented in a Jira…