-
H3C’s CVM upload endpoint has been exploited since October 2023, and its CVE record arrived three years later with no fixed version
VulnCheck’s new record says the Shadowserver Foundation first saw this exploited on October 14, 2023, scores it 9.8, names no patched release, and links H3C’s user manual where…
-
CERT Polska’s critical U-Boot flaw names 2026.07 as both the last affected version and the release that fixed it
CERT Polska’s record names U-Boot 2026.07 as both the last affected release and the release that shipped the fix, while the defrag bug no released version fixes scores…
-
Half of today’s ten flaws have no version to upgrade to, and two of the rest name the wrong one
Five of the ten records on today’s wire name no version to upgrade to, and two more name the wrong one. The Zammad pair leads on a Monday…
-
Microsoft’s out-of-band Exchange fix stops one mailbox user from reading everyone’s mail, and the Exchange blog never announced it
Microsoft released one security update on Friday, October 2, 2026, eleven days before Patch Tuesday, and every one of its four Exchange Server packages is labeled “version 2”…
-
Zammad’s root escalation carries NVD’s 9.8 network score and a Monday federal deadline, and both the vendor and the CNA call it local
CISA added two Zammad vulnerabilities to the Known Exploited Vulnerabilities catalog today, with a federal deadline of Monday, October 5, 2026. One is scored 9.8 as a network…
-
Half the flaws Google attributes to AI are remote code execution, and its method only counts the ones a vendor credited
Google’s threat intelligence group published its AI-era vulnerability trends report on September 30, 2026, and its sharpest number rests on a sample the report itself says is structurally…
-
Ghost’s eight new CVE records all point at 6.64.0, and Ghost’s own next advisory needs 6.65.0
Eight CVE records published this morning describe flaws Ghost fixed on September 15 and disclosed on September 17 — and a reader who acts on them lands one…
-
CODESYS names 4.23.0.0 as the fix for twelve embedded runtimes, and 4.23.0.0 has not been released
Both CODESYS advisories published on September 30, 2026 name version 4.23.0.0 as the remediation for their embedded product lines, and 4.23.0.0 is not out.
-
Mooncake fixed a 9.8 unauthenticated memory read-write in a performance commit, and the 9.4 beside it is unfixed in the newest release
Two critical CVE records landed against Mooncake overnight: the 9.8 was already closed in August by a commit about connection-lane scheduling that never mentions security, and the 9.4…
-
AI coding agents published 13,000 internal screenshots to public GitHub repos, and the tool behind a third of them warns against exactly that
Glow Labs says AI coding agents routed screenshots through public GitHub repositories to get around a missing upload API — and the tool a third of the affected…