-
Four of LibreOffice’s six new CVEs come from Calc external-data links that bypassed the link-update prompt and fetched when the file opened
Four of the six flaws The Document Foundation disclosed on October 5, 2026 trace to one Calc feature whose links were fetched the moment a document loaded, outside…
-
A NetScaler denial-of-service flaw draws a Wednesday federal deadline with forensic triage, and Citrix’s own bulletin says nothing about exploitation
Citrix scores CVE-2026-88779 as availability-only and says nothing about attacks; CISA added it to KEV the next day with a three-day clock and a forensic-triage obligation.
-
One researcher, one CNA, and one weakness class account for five of the eleven records behind today’s stories
Five of the eleven CVE records behind today’s stories came from one finder, one CNA, and one weakness class — and four of those five packages were already…
-
The Laravel google-maps package hardened its TLS default in code and still ships the config file that turns it off
Two more certificate-verification CVEs landed at 10:31 p.m. UTC on Sunday, five hours behind the three this site covered in the afternoon, and the record for one of…
-
go-micro’s source called its own disabled TLS verification insecure for months, and the new CVE names no fix short of a major version
The framework’s own TLS helper called the default insecure in its source for months, and the CVE that arrived on October 4, 2026 lists an upgrade to 6.0.0…
-
ZITADEL’s new account-takeover CVE names 4.17.3 as the fix and also marks the current release affected, and 3.x has no fix at all
Three critical ZITADEL account-takeover flaws got CVE identifiers on Sunday, 30 to 67 days after the vendor’s advisories, and the newest record contradicts itself about whether the current…
-
MindSearch runs its planner’s generated Python through exec() on an unauthenticated port that defaults to all interfaces
A new 10.0 CVE names an argument that lives in a different file, and reading the source shows the execution is the design — the defect is the…
-
Ahsay fixed a 10.0 pre-auth command injection in August and listed it nowhere in the release notes
Update, October 14, 2026: Ahsay now says 10.3.4 was not the fix. An announcement dated October 12, 2026 states that “our previous patches v9.15.2.59 and v10.3.4.0 did not…
-
Eight days, fifteen days, eighteen days, and three years: in four of today’s seven stories, the fix was public before the record was
Cisco’s exploited Catalyst SD-WAN Manager record grew from 23 affected builds to 415 twenty-five hours before today’s federal deadline. In four of the day’s seven stories, the fix…
-
Cisco expanded its Catalyst SD-WAN Manager CVE record from 23 affected builds to 415 the night before the federal deadline, and logged the change as a summary edit
Twenty-five hours before the federal deadline on an actively exploited Catalyst SD-WAN Manager bypass, Cisco pushed a CVE record that grew from 23 affected builds to 415, and…
-
ConvertX accepted a Calibre recipe — a Python file Calibre is built to execute — as a supported upload, and its CVE cites an advisory that returns a 404
A critical remote code execution flaw in the self-hosted file converter ConvertX was fixed on September 15, shipped on September 26 in a build whose notes call it…
-
Beaver Builder shipped a shortcode opt-out in July and left it off the one module that renders third-party widget output
Two CVE records landed today, five hours apart, for fixes that shipped eight days ago on one release track and three days ago on the other. Beaver Builder…
-
OpenAM’s security release labels every bundled dependency bump with a CVE and its own thirteen flaws with none
The CVE for one of them — an unauthenticated class-instantiation flaw in the legacy JAX-RPC interface — was published today, fifteen days after the fix shipped, by a…