-
FortiMail’s exploited 9.8 landed on KEV with a Sunday deadline, and Fortinet’s advisory calls every fix “upcoming”
CISA gave federal agencies until Sunday, October 4, 2026 to remediate a 9.8 unauthenticated file write that Fortinet says is being exploited — and the advisory’s own Solution…
-
Red Hat Satellite’s provisioning endpoint checks that a token exists in the database, not that the requester sent one
Red Hat shipped 31 CVE fixes for Satellite 6.19 on October 1, 2026, and three of them lead to the same place: the root passwords Satellite holds for…
-
Fortra prints 6.5 on a BoKS advisory whose own vector computes 7.9, and labels it High
Seven of the eight BoKS advisories Fortra published October 1 score exactly as their vectors compute; the eighth is off by 1.4 points, across a band boundary.
-
Fortra’s BoKS upgrade does not secure the Active Directory passwords its own flaw generated
The warning, and the fixed version, appear only in the CVE record; Fortra’s advisory page for the 9.9 carries neither.
-
Fleet’s device API accepted hostnames and hardware serials as authentication tokens, and the fix shipped sixteen days before the CVE existed
Fleet patched a critical authentication bypass in its iOS device API on September 15, 2026 and published an advisory that said “No known CVE”; the identifier arrived on…
-
WAGO’s new CODESYS advisory reproduces two scores that CERT@VDE’s own CVE records contradict, one too high and one too low
WAGO’s advisory published Thursday morning prints 8.3 for one CODESYS flaw and 5.5 for another; the CVE records for those same flaws, assigned by the same organization that…
-
WAGO’s 9.8 BACnet advisory names 4.8.9 as the fix, while its companion advisory the same morning requires 4.10.0
An unauthenticated attacker can read or overwrite any file on eleven WAGO controller families by naming it in a BACnet object, and the two advisories WAGO released on…
-
In seven of today’s nine stories, the version data is wrong, missing, or names the wrong package
The thing to deal with first is not the biggest number on today’s page. Cisco’s authentication bypass in Catalyst SD-WAN Manager scored 9.8, and two records filed this…
-
OrdaSoft’s Joomla CCK shipped its upload allow-list commented out, and the 10.0 record for it links no advisory
The CVE record Joomla filed this afternoon for a 10.0 unauthenticated remote code execution in OrdaSoft’s Joomla CCK extension says the control that would have stopped it was…
-
Joomla fixed 16 core flaws including an MFA bypass on September 25, and the CVE records did not appear until September 29
Joomla shipped 5.4.9 and 6.1.4 on Friday, September 25, 2026, closing 16 flaws in the CMS core including an MFA bypass — and the CVE records for all…
-
Cisco Catalyst SD-WAN Manager draws an October 3 federal deadline, and NVD overrode Cisco’s own affected-version list
CISA added Cisco’s actively exploited Catalyst SD-WAN Manager bypass to the Known Exploited Vulnerabilities catalog on Wednesday, September 30, 2026, and set the federal deadline at Saturday, October…
-
VulnCheck has now filed ten CVEs against LightLLM, nine in seventeen days, and the project has answered none of them
VulnCheck filed three more LightLLM records this afternoon, bringing the catalog to ten CVEs against one inference server — nine of them in seventeen days, six scored 9.8,…
-
Joomla scores a JCTables SQL injection 10.0, flags it Attacked, and names the fixed version as the affected one
The CVE record Joomla filed for a 10.0 SQL injection in the JCTables extension carries an exploit-maturity flag reading “Attacked,” a CISA SSVC block reading “none,” and a…
-
Apache patched an unauthenticated SOAP authentication bypass in WSS4J and scored none of its four CVEs
Four WSS4J CVEs landed inside four minutes, including one that lets an unauthenticated attacker forge a signed SOAP message. Apache filed all four with textual severity and no…