-
Fuji Electric’s V-SFT takes seven memory-corruption CVEs at 8.4, and the fixed build appears only in a download page’s title
JPCERT/CC published seven memory-corruption CVEs against Fuji Electric’s V-SFT this morning, all scored 8.4 under CVSS 4.0, and none of the seven records — nor the JVN advisory…
-
open62541 9.2 lets a malicious OPC UA server overflow the client, and the fix shipped in August as a size check with no CVE
The patch has been shipping since August 20, 2026, two releases back, described in the notes as rejecting definitions that overflow a size field. What happened On Saturday,…
-
llama.cpp’s heap overflow is patched by an API refactor that never mentioned security, and the fix its finder wrote is still an open pull request
The record says so itself: “the root cause is detected-and-aborted, not prevented-by-design.” What happened At 11:00 p.m. UTC on Sunday, October 25, 2026, VulDB published CVE-2026-116096 against llama.cpp,…
-
Both rclone reporters declined to assert an affected range, and the CVE records published Sunday assert one anyway
One rclone advisory says “We have not established a lower bound and do not claim one.” The CVE record written from it begins at version 0. What happened…
-
Plack’s fix for CVE-2026-115825 was never indexed on CPAN, because the release declared the version before it
Five CVEs landed on Perl’s two main PSGI web servers inside two minutes with no CVSS score among them, and in both packages the version the record names…
-
All five of Parse Server’s new CVEs name an alpha build as the 9.x fix, and for six days no stable release carried three of them
Each of the five records points at a different alpha build on the 9.x line, none at a stable release — and between October 10 and October 16,…
-
Snipe-IT’s Google SSO signed deactivated users back in at their old permissions, and the project rated it Moderate
Snipe-IT published the flaw on October 8, 2026 and rated it Moderate; the CVE that VulnCheck assigned to it this morning scores it 8.1 under CVSS v3.1 and…
-
vLLM’s KV-cache leak was fixed by deleting the connector, and all ten of today’s CVEs name a June release as the fix
Ten vLLM records published this morning by VulnCheck all name 0.24.0 as the fixed version — a release that shipped at the end of June — and the…
-
WP Stripe Checkout accepted unverified webhooks by default; Chikkili Google Pay has no fix and was closed October 14
Two WordPress payment plugins disclosed in the same batch let unauthenticated callers mark a store’s orders paid — one shipped with signature verification off by default, the other…
-
Unitree confirmed two flaws in its Go2 robot’s voice assistant, and the fix for the 9.6 is older than the firmware the other record calls affected
Two CVE records published 584 milliseconds apart name the same component, share no firmware version with the report they came from, and leave no version an owner can…