-
Zoho’s CVE record for OpManager MSP clears three build ranges its own advisory says are vulnerable
The CVE record Zoho assigned for CVE-2026-19599 says everything below 12.8.711 is affected; Zoho’s own advisory says three build ranges above 12.8.711 are affected too, and a third…
-
Two of twelve Tomcat CVEs are earlier security fixes that failed, and the batch’s 9.8 is the one Apache calls “moderate”
Apache made twelve Tomcat vulnerabilities public on September 23, 2026; two of them exist because earlier security fixes did not hold, and the highest CVSS score in the…
-
WordPress rates CVE-2026-87902 a 9.2 critical, but the only score reaching NVD is CISA’s 8.1 — and exploitation started on patch day
Update, September 26, 2026: CISA added CVE-2026-87902 to its Known Exploited Vulnerabilities catalog on Friday, September 25, 2026, with a federal remediation deadline of Monday, September 28 and…
-
The two flaws worth acting on tonight were both fixed weeks before the advisory said so
Deal with mcp-atlassian first, and the fix has been on PyPI since July 10. The advisory carrying CVE-2026-77244 published September 22 at 10.0: the token verifier returns success…
-
A missing return statement let EthPress log an attacker in as any wallet-linked WordPress admin
CVE-2026-19125: the signature check works, its failure branch builds a WP_Error, assigns it to a local variable, and never returns — so execution falls through to the line…
-
Laravel-Mediable added phpt to its upload blocklist and missed pht, the one Apache actually runs
CVE-2026-93352 is scored 9.8 as an incomplete patch for CVE-2026-49972: the blocklist gained phpt, which almost no web server executes, and missed pht, which Apache on Debian and…
-
Microsoft fixed an Outlook RCE in September’s updates and left the CVE out of the bulletin for 15 days
CVE-2026-70125 appeared on September 23, 2026 with a revision note on Microsoft’s own record saying it was “inadvertently omitted from the September 2026 Security Updates” — 15 days…
-
IBM’s highest-scored Financial Transaction Manager flaw is described as reading files, and scored as taking the system
CVE-2026-18169 is the highest-scored entry in IBM’s fifty-CVE Financial Transaction Manager bulletin, and its description and its vector do not agree about what it does. What happened IBM…
-
orval escaped OpenAPI defaults for single quotes, then replaced the quotes with backticks, and ${…} went live at import time
The escaping helper left backticks and ${} alone on purpose, because everything it protected sat inside single quotes — and then one line converted those quotes to backticks.…
-
IBM’s payments AI agent accepts unauthenticated writes to its runbook store, and IBM scores the payment impact Low
IBM’s own description of CVE-2026-18875 says an unauthenticated attacker can steer the agent’s tool calls into unauthorized payment actions. IBM’s own CVSS vector rates the integrity impact Low.…
-
Apache published three Tomcat Native CVEs without a CVSS score, and CISA’s scores invert Apache’s own severity ranking
Apache assigned no CVSS score to any of the three Tomcat Native flaws it disclosed on September 23, 2026 — only the words “Important,” “Moderate” and “Important” —…
-
SolarWinds scores an unauthenticated RCE 9.8 and says only a non-default configuration is affected, without naming it
CVE-2026-28324 carries a vector that says no privileges, no user interaction, low attack complexity — and a description that says you are only affected if your installation is…
-
GitHub Enterprise Server’s notebook SSRF returns no response body, and GitHub scored the response time 9.3 anyway
The URL validator checked scheme and host and forgot the port; what comes back is not the internal service’s answer but how long it took, and GitHub says…
-
Reachy Mini installs a Hugging Face Space for any host on the network, and the advisory names no fixed version
CVE-2026-96455 published this morning against Pollen Robotics’ desktop robot: the daemon’s app-installation endpoint has no authentication, the wireless model binds it to every interface, and the advisory’s affected-versions…