-
mcp-atlassian’s token verifier accepted any non-empty string, and the 10.0 advisory came 74 days after the fix
The advisory for CVE-2026-77244 published on September 22, 2026. The commit that fixed it shipped in version 0.22.0 on July 10 — and it closed five other classes…
-
Four catalog additions, three vendors, one Friday deadline, and three CVE records less than a day old
CISA added four exploited vulnerabilities from three vendors to the catalog this evening, all due Friday, September 25 — and F5’s comes first because neither its fix nor…
-
Google’s MCP toolbox SDK takes a 9.1 for a token cache fixed in July, and the affected range names a repo that ships three differently versioned packages
CVE-2026-19202 describes a real credential-disclosure flaw in Google’s MCP toolbox SDK, and the artifacts on PyPI show the fix shipped seventy-five days before the record was published. What…
-
F5’s BIG-IP APM flaw was on CISA’s catalog five hours after publication, and both the fix and the mitigation still require a support ticket
CVE-2026-94127 went from first publication to a federal remediation deadline in five hours, and the fix and the mitigation are both things you have to open a support…
-
Check Point’s management-server path traversal got a CVE and a three-day federal clock on the same day, and the attacks it cites are from July 23
CVE-2026-93616 was published on Tuesday afternoon and was in CISA’s catalog by Tuesday evening with a Friday deadline — and the attacks Check Point cites as evidence for…
-
Arista’s exploited 10.0 in VeloCloud Orchestrator has a three-day federal clock, and two of its four affected trains have no fix
CISA gave federal agencies until Friday, September 25, 2026 to remediate an actively exploited flaw in Arista’s VeloCloud Orchestrator, and Arista’s own advisory names fixed builds for two…
-
F5’s 9.8 in BIG-IP APM is fixed by three engineering hotfixes, and the only published mitigation is an iRule you have to phone support for
F5 published a 9.8 unauthenticated remote code execution flaw in BIG-IP APM whose three fixed builds are engineering hotfixes and whose only stated mitigation is an iRule you…
-
SGLang’s unauthenticated code execution record stops at 0.5.14, and the sink is still in the 0.5.20 wheel that shipped four days ago
SGLang’s diffusion orchestrator unpickles whatever arrives on an open network socket, and the record describing it carries no severity score and an affected range that stops six releases…
-
Ninja Forms fixes an unauthenticated object injection that only fires when an administrator exports to CSV
The payload goes in through any public form and sits in the database until an administrator runs a routine export, which is when it deserializes — and the…
-
Eight CVEs land on Perl’s Net::IDN::Encode and the fix ships only as a trial release
CPANSec published eight CVE records against Perl’s internationalized-domain-name library on Tuesday morning, and every one of them tells you to upgrade to a release that cpan and cpanm…
-
oc-mirror checks the OpenPGP signature error before the signed body is read, and Red Hat has shipped no fix
A forged PGP message carrying a real Red Hat release key ID passes oc-mirror’s verification and gets mirrored into a disconnected OpenShift registry; Red Hat rates it Important,…
-
vLLM shipped 0.30.0 seven hours after four CVEs capped at 0.29.0, and the code all four name is still in it
Four VulnCheck records against vLLM’s disaggregated serving path published Monday night; 0.30.0 landed on PyPI seven hours later with the five unchecked lookups, the bare assertion, and the…
-
NVD rewrote its own score on an exploited kernel flaw from 7.1 local to 9.8 remote, on the day the federal deadline expired
NVD replaced its CVSS vector on CVE-2025-39682 at 12:00 p.m. UTC on September 21, 2026, three metrics at once, and the kernel CNA’s reasoning it adopted had been…
-
Fourteen stories, and six different ways a “fixed version” is not a fix
Deal with the Zyxel switches first. CISA added CVE-2026-7273 to the Known Exploited Vulnerabilities catalog on Monday, September 21, and set the federal remediation deadline at Thursday, September…