-
Upgrading LangBot to 4.10.11 does not replace the 24-bit recovery key it was released to fix
The new generator only runs when no key exists, so an installation that already has one keeps its 16.7-million-value secret and gets a warning written to stderr at…
-
ESPnet’s fix for its 8.8 checkpoint code execution flaw refuses to run on the PyTorch version its own metadata still allows
The patched release swaps torch.load for a wrapper that raises an error on anything below PyTorch 2.6, while ESPnet’s own package metadata still declares torch>=2.3.1 — and on…
-
Really Simple Security’s email 2FA can be cleared by an unauthenticated request — the fix has been in 9.8.1 since September 1
A 7.5 record published this morning describes a way to strip an account’s completed email second factor without a session; the code fix has been shipping since September…
-
HAProxy’s HTTP/3 smuggling fix is a commit, not a release — 3.3.14 and 3.4.4 are both inside the affected range
A remote, unauthenticated HTTP/3 client can desynchronize HAProxy’s reused backend connections, slip requests past a frontend deny rule, and swallow other users’ Authorization headers — and the newest…
-
Two Monday deadlines outrank a day of nines and a seventeen-record batch
Eleven stories ran today, and the loudest of them were loud on the numbers: a 10.0, two 9.9s, a pair of 9.8s on a perimeter VPN appliance, and…
-
GitLab’s second 9.9 is reachable by anyone with Duo Chat access, and hands over Advanced Search credentials
The record GitLab published overnight names the AI assistant as the entry condition and instance credentials as the payoff — two details that were not in the release…
-
Flatpak’s Critical sandbox escape waited 32 days for a CVE, and the one Flatpak CVE issued in between was a different flaw
For a month the upstream project called it Critical with no identifier attached, while the one Flatpak CVE published in that window described a different bug, scored it…
-
Socket Firewall did not verify TLS to the registries it guards, and before 1.1.334 verification could not be turned on
A CVE record published overnight says an attacker in the path could have rewritten the allow and block decisions the firewall exists to enforce, and that for some…
-
vLLM ran attacker model code with trust_remote_code set to False, and the CVE arrived 17 days after the fix
One model loader handed the safety flag to a function that never accepted it, the argument vanished into **kwargs, and untrusted model code ran anyway. What happened NVD…
-
ConnectWise’s 9.9 ScreenConnect flaw is in the client, not the server, and federal agencies have until Monday
CISA put the ScreenConnect file-transfer flaw on its Known Exploited Vulnerabilities catalog on Thursday with a Monday deadline and a forensic-triage obligation, and the thing that has to…
-
GitLab’s 10.0 went on KEV Thursday with a Monday deadline, and NVD’s record still doesn’t carry it
CISA added the GitLab path traversal to its Known Exploited Vulnerabilities catalog on Thursday with a remediation deadline of Monday, September 14, 2026 — a date this site…
-
AVideo’s 17 new CVE records all end at the same commit hash, and the last tagged release is from April 2024
Seventeen CVE records for the self-hosted video platform AVideo landed in NVD this afternoon, and all seventeen draw the affected-version line at the same 40-character git commit hash…
-
Frontegg SAML SSO accepts unsigned SAML responses, there is no fix, and WordPress.org closed the plugin September 4
CVE-2026-75800 reached the National Vulnerability Database at 6:16 a.m. UTC on September 12, 2026 carrying a 9.8, and the plugin it describes was already gone from the WordPress…
-
The Events Calendar took three releases to close a 9.8, and no changelog line says “remote code execution”
Two unauthenticated 9.8 remote code execution flaws in a plugin on more than 600,000 sites became public this morning, and the changelog entries that fixed them describe hardened…
-
Check Point’s two 9.8 VPN flaws are scoped by hotfix take number, and its own CVE records leave out Spark
Both flaws let an unauthenticated attacker run code on a perimeter appliance, and neither CVE record names a fixed version — the affected boundary is a Jumbo Hotfix…