-
LMCache unpickles untrusted bytes before any handler runs, and the 9.8 record names no fixed version
JFrog’s CVE-2026-105192 puts unauthenticated remote code execution in the KV-cache layer that multi-node LLM serving depends on, and the record’s affected range has no upper bound. What happened…
-
IBM’s 24 Langflow records name 1.12.3 as the fix, which shipped fourteen days earlier and is already two releases behind
Two of the 24 need no credentials to reach code execution, and the version IBM tells operators to install is from September 22. IBM published 24 CVE records…
-
OpenSSH 10.6 drew eleven CVEs the day it shipped, its release notes name none of them, and two are not fixed by 10.6
Nothing above 6.5, nine closed by the upgrade, and the two that are not are marked only by an inclusive version bound and a defaultStatus of unknown. OpenSSH…
-
HPE published 37 ClearPass and AOS-S CVEs with twelve at 9.8 or above, and not one names a fixed version
Twelve of the 37 records HPE filed on Monday afternoon score 9.8 or higher and seven need no credentials, yet the inclusive version bounds flag 6.11.15, 6.14.0 and…
-
Payload’s CVE batch grew from five records to 29 in 93 minutes, and the fix is 3.90.0, not 3.88.0
Twenty-nine CVE records landed in a 93-minute window this morning, not the five this site reported at 11:29 a.m. Central, and 23 of them name 3.90.0 as the…
-
Chrome shipped 247 security fixes at once, and an AI-assisted researcher found two of the four Criticals
Google published 247 CVE records against Chrome this afternoon, more than double its last stable update, and twelve of them credit one researcher working with an AI assistant…
-
Payload’s five CVEs all name 3.88.0 as the fix, and npm says 3.88.0 shipped on August 11
Five CVE records landed Tuesday for the headless CMS, all naming 3.88.0 as the fix – and npm says 3.88.0 shipped on August 11, in a release whose…
-
Microsoft UFO allowlisted explorer.exe, and its command guard checked only the first token
Three CVE records published October 6 describe a command allowlist that validated only the first word of the command, and an Android automation tool whose own documentation promised…
-
Smarty’s cache writer folded a null hash into its own regex, so attacker-supplied page output could forge a nocache marker and run as PHP
A null value used as an array key produced an empty alternative in Smarty’s own cache-marker regex, which let attacker-controlled page output pass itself off as compiler-generated PHP.…
-
Atlassian’s unauthenticated file read spans eight product lines, and the machine-readable record points Bamboo at 10.2.4 where the advisory says 10.2.24
Atlassian published one critical advisory on Monday night covering eight product lines, and the machine-readable half of the CVE record drops a digit from the Bamboo fix version…
-
Langflow’s two new 9.9 records name different fix versions for the same MCP command injection, and the source at 1.9.0 still has the bash -c wrapper
Two Langflow records published 30 minutes apart on Sunday night describe the same OS command injection in the MCP stdio transport, score it the same 9.9, and name…