-
GreyNoise ties 18,566 stolen government records to a WordPress core chain whose two halves carry opposite severity scores
GreyNoise says an adversary used a two-CVE WordPress core chain to take at least 18,566 records from a western government in July; the two halves of that chain…
-
Zyxel GS1900 flaw lands on KEV with a three-day clock, and its CVE description names one of ten affected models
CISA gave federal agencies until Thursday to fix an exploited Zyxel switch flaw, and the CVE description defenders will scope from names one of the ten models Zyxel’s…
-
Telegram Desktop’s XSS record ends its affected range at a beta build, and the first stable release with the fix is 7.0.1
MITRE published CVE-2026-94488 on September 21, 2026 at 5:29 p.m. UTC, roughly the same minute it reserved the identifier. The record concerns a cross-site scripting flaw in Telegram…
-
KubeEdge ran node upgrades through a shell so it could redirect the log, and the version field in the upgrade job went through with it
KubeEdge extends Kubernetes out to edge nodes — factory floors, base stations, vehicles, retail sites — and it upgrades those nodes the Kubernetes way, with a custom resource.…
-
Fluent Bit’s Secure Forward never checked the server’s half of the shared key, and the 9.2 patch didn’t add it either
Fluent Bit’s out_forward plugin ships logs to a Fluentd or Fluent Bit aggregator. When it is configured with Shared_Key or Empty_Shared_Key, it runs the Fluentd Secure Forward handshake…
-
ntopng scores its command injection as needing a login, and its GET endpoints mean an attacker needs none
The CVSS vector for CVE-2026-82412 says an attacker needs a low-privileged account; the advisory says the vulnerable endpoints answer GET requests and ntopng only checks CSRF tokens on…
-
Conda’s 8.8 arbitrary file write was fixed in a June release whose changelog calls it entry point validation
The GitHub advisory published today scores the flaw 8.8 and calls it “realistic supply-chain RCE”; the release that fixed it lists one line, “Validate Python entry point definitions…
-
Apache MINA’s “Fully addressed” fix reached one branch of three, and the two it missed are still listed as patched
Apache assigned a second CVE today for a flaw it already fixed once: the override that closed CVE-2026-47065 went into the 2.2 branch and nowhere else, so the…
-
Temporal’s worker controller runs a command from the caller’s request, and the setting operators think disables it does not gate that path
CVE-2026-89139 scores 8.7: write access in one namespace becomes command execution on the host that holds every namespace’s persistence credentials, and the allowlist that is supposed to prevent…
-
The MISP record describing full remote code execution scores 5.1, and three unrelated records carry its vector character for character
MISP’s own release notes call background-job argument injection the most severe of twenty-seven confirmed fixes; its CVE record scores it below three stored cross-site scripting bugs published this…
-
Open VSX left the host out of its cache key, so one forged header replaces the extension download URLs every client gets
An anonymous request carrying a spoofed X-Forwarded-Host replaces the VSIX, signature, and public-key URLs that every other client receives for the next hour. What happened The Eclipse Foundation…
-
Eight stories, and not one of them could be told from the record alone
Patch Forminator first: an 8.5 that ends in code execution on 600,000 WordPress sites, shipped under the changelog line “Fix: Security improvements.” The unfixed getID3 XXE inside WordPress…