-
N-able says the N-central flaws give full platform access, and its own CVSS vector says one of them needs an account
N-able shipped N-central 2026.3 HF3 on September 5 saying an unauthorized party could gain full access to the platform, while the two CVE records it published the same…
-
MikroTik withheld the RouterOS advisory to buy patching time, and working exploits were published the next day
CERT Polska says a two-bug chain it calls MikroTrick is being used to take over RouterOS devices with SSH exposed, with successful attacks traced back to at least…
-
Mail Mint’s 9.8 was fixed in a release whose security note is about something else, and the record points the gadget chain at a bundled PostHog SDK
The unauthenticated deserialization was fixed on September 1 in a release whose only security bullet describes a different change, and the one file the record cites outside the…
-
Post Grid’s new 9.8 says the flaw stops at 2.3.1, its own data says 2.3.32, and the plugin’s newest release is 2.3.24
A critical CVE published Saturday morning against a plugin on more than 30,000 WordPress sites contains two version ranges that contradict each other, and the higher one tops…
-
AVideo’s statistics endpoint returns every viewer’s password hash, and the project’s own advisory says the hash logs you in
Five more CVE records landed against the open-source video platform on Saturday afternoon, bringing the 30-day total to 46, and not one of them names a version to…
-
Mstore API checked the Firebase token’s alg, kid, aud and iss, and never verified its signature
A forged Firebase Phone Auth token signed with the attacker’s own RSA key impersonates any phone number on the store; the fix landed in 4.21.0, as one security…
-
Coolify’s OAuth callback logs a user in on an email match alone, and the affected ceiling is also the current release
CVE-2026-86117 bypasses both the password and two-factor authentication on a self-hosted platform-as-a-service, was first reported 84 days before it published, and names no fixed version. What happened NVD…
-
Three WordPress plugins reintroduced comment XSS after core sanitized it, and none of their changelogs says security
Four Wordfence-assigned CVEs published to NVD on the morning of September 5, 2026 share one sink: plugin code that rewrites comment HTML after WordPress core’s sanitizer has already…
-
Hummingbird’s debug-log guard checked for a class in the wrong namespace, and an unauthenticated cookie name became executable PHP
A guard that was written, shipped, and never once executed: the header meant to make Hummingbird’s cache debug log inert was gated on a class name PHP could…
-
IBM’s 9.8 unauthenticated SQL injection in Operational Decision Manager ships inside a monthly dependency roll-up, and one affected version gets no fix
The highest-scored vulnerability IBM disclosed this week is a first-party unauthenticated SQL injection that ends in a web shell, and it was published inside a routine monthly bulletin…
-
Cua and AutoAgent take 9.8s for unauthenticated command execution, and Cua’s named fix version changed a bind default, not the authentication
Two CVEs published minutes into Friday morning describe the same architecture — a sandbox whose job is to run commands for an AI agent, listening on every interface…
-
Seven of today’s eleven records name no version to patch, which is why an 8.8 leads over two 10.0s
Chrome’s exploited V8 bug leads on an 8.8 over Microsoft’s two 10.0s, because it is the only item today that names a build and a deadline — and…
-
IXON’s VPN client writes unauthenticated config as root, and the CVE landed 30 days after IXON cut the exploit chain from its cloud
CISA republished IXON’s August advisory on September 3 and the CVE record followed a day later, carrying a 9.6 and no mention of the server-side block IXON put…
-
Two Postgres MCP servers lost read-only mode the same day: AWS shipped a longer denylist, Postgres MCP Pro has no fix
Two CVE records published hours apart on September 4 defeat the read-only guardrail in Postgres MCP servers – one by an incomplete denylist, one by an unvisited parser…
-
IBM’s seventeen Langflow CVEs landed in three waves today, naming two different fix versions, and two of its identifiers still have no record
Eight more IBM Langflow CVE records published this afternoon after the nine this site covered at midday, in a third wave pointing at a different fix version —…