-
Hitachi gave HiRDB Version 10 three fix points for five 9.8 flaws and gave Version 9 none
Hitachi published nineteen CVE records on October 27, 2026, nine of them scored 9.8, and in all seven HiRDB advisories the Version 10 line gets three fix points…
-
Supermicro published nine BMC CVEs in two advisories, and neither names a vulnerable firmware version
Supermicro disclosed nine BMC vulnerabilities across two advisories dated October 26, 2026, both of which say “Eight security issues have been discovered,” and neither of which contains a…
-
NVIDIA scores a NeMo Agent Toolkit auth flaw 10.0, and the fix has been on PyPI since September 10
NVIDIA’s October 27, 2026 bulletin scores a missing-authentication flaw in its NeMo Agent Toolkit at a flat 10.0, and the release that fixes it has been the current…
-
Kener’s fix warns that 15 published example secrets can forge sessions on your status page, and its own compose file still ships one of them
CVE-2026-116747 describes a JWT secret that falls back to the literal string DUMMY_SECRET; the patch reveals the larger problem is operators who set the placeholder Kener’s own documentation…
-
rembg’s background remover handed back the server’s own files inside the PNG mask, because its model downloader passed None where a hash belongs
CVE-2026-115924 reached the feed on Monday, 54 days after the fix went to PyPI and 48 days after the maintainer’s advisory, which still lists no patched version. What…
-
Two JOSE libraries published key-parsing denial of service on the same day, and one of them was trying to factor the modulus you sent it
erlang-jose shipped eight CVEs and its first release in eleven months on Monday; go-jose’s RSA parsing flaw reached the CVE feed the same day, twelve days after the…
-
Forescout’s endpoint agent stops checking server fingerprints past the third appliance entry, and the newest build Forescout documents sits inside the affected range
Forescout published CVE-2025-13833 on Monday afternoon against its own Windows endpoint agent, said nothing about a fixed build, and pointed the only reference at a customer login page.…
-
OpenHands’ unauthenticated root sandbox was fixed by two port-mapping lines, and the empty API-key default its CVE names is unchanged
VulnCheck published a 9.3 critical against the OpenHands Software Agent SDK on Monday describing two conditions — a sandbox server bound to every interface and an empty API-key…
-
The Rust zip crate’s 10.0 is a filename mismatch between two of its own readers, and four of its five new CVEs are fixed only in a major version
Five CVE records landed against the Rust zip crate on Monday afternoon — one of them a 10.0 for an archive that reads one way to a component…
-
Mautic patches nine flaws and says the 9.9 becomes code execution on the default Apache setup of its own Docker image
Mautic published nine security advisories in seventeen minutes on Monday morning, and the critical one says the difference between writing a file and running it is the Apache…
-
Fortinet’s FortiSandbox record names a 4.2 branch the advisory never lists and flags a functional exploit the page calls not exploited
Fortinet published CVE-2026-107656 on October 26 at 1:45 p.m. UTC, thirteen days after the advisory it points to. The record and the advisory disagree about which versions are…