-
CISA filled in two of Splunk’s five scoreless CVE records, and its number for the 9.8 is 5.3
CISA’s enrichment pipeline reached two of the five scoreless Splunk records overnight, and on the one Splunk’s own advisory calls a 9.8 it produced a 5.3. What happened…
-
IBM DataPower Gateway treated an empty password as a successful LDAP login, and 33 of its 40 new CVEs need no credentials at all
IBM published 40 DataPower Gateway CVE records on Thursday; 33 of them need no credentials, and the highest-scoring one is an LDAP bind that treats an empty password…
-
Ollama’s unauthenticated path traversal is scored 6.9 and 9.4, and the 9.4 is the one the Docker image produces
CERT Polska published CVE-2026-103663 on Thursday with two CVSS scores — a 6.9 and a 9.4 — and the 9.4 is the one that applies to the deployment…
-
hMailServer filed 22 CVEs from its own code review and disclosed a security fix it had shipped silently in 6.3.4
The project credited every one of 22 records to its own internal review, fixed 21 of them in 6.3.6, and used the batch to disclose a fix that…
-
Broadcom filed 61 Brocade CVE records overnight; the “Frontier AI” credit on its advisories is in none of them
Broadcom published 61 Brocade CVE records between 12:44 a.m. and 7:00 a.m. UTC on October 8, and the “Frontier AI discovered” credit that appears on its own advisory…
-
In 53 of today’s records, the severity number is missing, secondhand, or two numbers that disagree
Two of today’s ten stories carry a CVSS 10.0, and only one of them tells you to do anything. The one to deal with first is SonicWall’s pre-authentication…
-
AsyncHttpClient’s final 2.x release fixes nine of thirteen new CVEs and is listed as affected by the other four
Thirteen CVE records landed against one Java HTTP client in 37 minutes, six of them about credentials reaching a party that should never have seen them, and the…
-
Splunk Enterprise ships a PostgreSQL manager whose REST API runs OS commands with no authentication
Splunk’s own record says the Patroni REST API on a search head cluster member will run attacker-supplied operating-system commands for a user who has not authenticated at all,…
-
Splunk scores five grouped CVEs on its advisory and publishes all five records with no score at all
Splunk’s advisory page rates the five grouped CVEs it published on October 7 at 9.8, 9.0, 8.8, 7.6 and 4.4; the five CVE records carry no CVSS metrics…
-
Homer fixed two 9.8s and published the advisories in June, and the CVE IDs arrived 104 days later
The fix and the public advisories both landed on June 25; the identifiers that a CVE-keyed scanner needs arrived this morning. Three CVE records for Homer, the open-source…
-
Cisco gave 20 CVE IDs to whole weakness classes, so each score is the worst flaw in an unnamed group
Four Cisco advisories group this month’s internally found vulnerabilities by weakness class, so each CVE ID covers an unstated number of them and its score belongs to the…
-
LMCache’s script sandbox hands the escape hatch to the code it sandboxes, and the newest release still ships it
Six hours after this site reported a 9.8 in LMCache with no fixed version, a second CVE Numbering Authority published four more against the same release — and…
-
SonicWall published four SMA1000 CVEs without scoring any of them; CISA’s enrichment made one a 10.0
SonicWall published four SMA1000 vulnerabilities on Wednesday morning without scoring any of them, and the severity figures now attached to the records — including a 10.0 — were…
-
Arista scored its 24 new records twice, and CVSS 4.0 disagrees with CVSS 3.1 on every single one
Fourteen Arista advisories landed in a four-minute window carrying both CVSS versions on every record, and the two frameworks put two flaws in the Critical band or five,…
-
AWS’s AgentCore toolkit wrote the injection into the agents it generated, so the 0.3.14 upgrade does not remove it
AWS patched a code-injection flaw in its Bedrock AgentCore Starter Toolkit and said in the same breath that patching is not enough, because the flaw persists in every…