-
LemonLDAP::NG’s 9.1 reads token metadata, and the flaw in the same function that mints tokens has no score at all
Two of the three LemonLDAP::NG flaws disclosed this morning come out of the same unverified client secret; the one scored 9.1 critical reads token metadata, and the one…
-
MinIO’s new signature-verification CVE cites its only fix in a community fork, because MinIO’s repository has been read-only since April
CVE-2026-97731 lists MinIO as affected “through” a git commit, carries two references that both point at somebody else’s fork, and names no fixed MinIO version — because the…
-
Bookly’s unauthenticated booking flaw is scored with no confidentiality impact, and its own description says it leaks customer tokens
Wordfence scored CVE-2026-93399 a 9.1 on a vector that sets confidentiality impact to None, and its own description says unauthenticated attackers can read other customers’ order tokens. What…
-
Netgate fixed a pfSense dashboard RCE in July; this morning’s CVE names a CE version you cannot download
Netgate corrected the flaw on July 14 and announced it on August 13; the CVE record that published this morning names pfSense CE 2.9.0 as the fixed version,…
-
IBM published three identically titled Guardium bulletins on September 17, not two, and ten CVE IDs still resolve to nothing
Six of the records that resolved to nothing a week ago landed this morning. The highest-scored one — a 9.8 that needs no credentials — was not among…
-
CISA’s KEV entry names WSO2 CVE-2026-5430 a path traversal — WSO2 and the CVE record both say JWT signature bypass
The catalog entry that sets a three-day federal clock describes a vulnerability class that appears in none of the primary sources, and the coverage is already repeating it.…
-
The 8.1 outranks the three 10.0s, and three unrelated projects shipped the same verification bug
The most important thing on today’s page is an 8.1, and everything above it on the score sheet comes second. CVE-2026-87902, the WordPress core path traversal fixed in…
-
ManageEngine’s Applications Manager installer shipped a Google Cloud private key, and the fix replaces the key without saying the old one was revoked
Zohocorp scored CVE-2026-86708 a 10.0 on scope change alone, and the affected range on its own CVE record marks two build lines the advisory lists as already fixed.…
-
Transluce found agent attack traffic in a public URL scanner’s archive from March 6, two months before the incidents that dated the start
Transluce classified 6,467 of 37,649 public urlquery.net reports as significant evidence of agent activity, named three targets, and said none of the attempts it found appears to have…
-
rpm runs code from a package you only asked it to describe, and Red Hat’s bug has been open since May 11
Red Hat published two 7.8 code-execution flaws in rpm on Wednesday, rated both Moderate, and named no fixed package — one of the two bugs has been open…
-
nimble_zta accepted forged Cloudflare service tokens because its JWT check matched the verdict into a wildcard
The Cloudflare Zero Trust strategy in Dashbit’s nimble_zta asked a JWT library whether a signature was valid, then pattern-matched the answer into a wildcard and continued — and…
-
Two unauthenticated 10.0s in Rejetto HFS 2.x, and the researcher who found them scored both 9.8
VulnCheck published two CVEs on Wednesday against the HFS 2.x branch that Rejetto stopped developing years ago, scored both at a perfect 10.0, and the researcher who found…
-
Paytium signed the field an attacker was tampering with, and a filter registered after it copies the unsigned value back over
Paytium closed a 9.8 unauthenticated privilege escalation in June with a signature gate, and a second filter on the same hook copies the unsigned field back over the…
-
SigNoz logged its own empty JWT signing secret as a critical security issue for 15 months, and started anyway
SigNoz shipped a JWT signing secret that defaulted to an empty string, printed a log line calling that a critical security issue, and started the server anyway.