-
goose’s recipe security scan skips the two fields that execute commands, and today’s CVE names no fixed version
A public issue filed on July 8 is still open eight releases later, and VulnCheck assigned it CVE-2026-85623 this morning with the affected range running through a build…
-
Lightstar ships SmartIT Desktop Manager agent credentials in its source code, and the fix is a major version upgrade
Taiwan’s TWCERT/CC published an advisory on September 4, 2026 covering four vulnerabilities in SmartIT Desktop Manager, an endpoint management suite from Lightstar. All four are the same failure:…
-
python-jose still lets a public key serve as an HMAC secret, because the 2024 fix checked the key format instead of the key
VulnCheck published CVE-2026-85394 against the python-jose JOSE library on September 3, 2026, at 7:17 p.m. UTC. The record describes an algorithm-confusion bypass, and its last sentence is the…
-
MOOS marine autonomy middleware takes 33 CVEs at once, and the fix for the unauthenticated bus is an unmerged pull request
Thirty-three CVE records landed on the MOOS robotics middleware family on September 3, 2026, in one contiguous block running from CVE-2026-85424 to CVE-2026-85456. All were assigned by VulnCheck…
-
Four deadlines expire Saturday, which is why the day’s four fresh 9.8s are not the lead
Six of today’s ten stories trace to one September 2 KEV batch. Four are due Saturday, September 5, and in three of them the record does not cleanly…
-
Two CNAs backfilled thirteen CVEs onto Craft CMS advisories that say “No known CVE,” and one record’s description belongs to a different bug
Thirteen Craft CMS CVEs appeared on September 2, 2026 from two CVE Numbering Authorities, neither of them Craft — one advisory drew two separate CVE IDs, and a…
-
Delinea patches a 9.8 FIDO2 registration bypass in on-prem Secret Server, and NVD deferred the record a day later with no version data
Delinea’s on-premises Secret Server takes a 9.8 authentication bypass at the FIDO2 registration step, and NVD deferred the record the next day, leaving it with no machine-matchable version…
-
Cisco’s IOS XR hardening release groups an internal audit into seven CVEs across every release, and the first fix that is not an SMU has not shipped
Two of the seven are scored 9.8, one CVE ID stands for thirteen distinct weakness types, and Cisco revised the fixed-release list within six hours of publishing it.…
-
Cisco scores the Nexus 9000 Silicon One root RCE at 9.8, and neither the advisory nor the CVE record names a fixed release
Cisco’s September 2 advisory scores CVE-2026-20212 at 9.8 and names ten switch SKUs, but its Fixed Software section points at an interactive tool instead of a release number,…
-
Artifactory’s 9.8 bypass is KEV-listed and due September 5, five days before the medium-severity CVE whose fixed build is inside its affected range
CISA added CVE-2026-82329 to the KEV catalog on September 2, 2026 with a September 5 due date — five days earlier than the deadline on an Artifactory CVE…
-
Switchvox draws a September 5 federal deadline, and Sangoma’s release notes mark the cloud edition fixed while NVD’s record covers only on-premises
CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities catalog on September 2, 2026 with a September 5 due date, and Sangoma’s own release notes check “Cloud” alongside “On-Prem”…
-
LiteLLM’s MCP endpoint answered a failed key check with an empty auth object, and CISA put it on a September 16 clock
When LiteLLM’s key validation failed on its MCP endpoint, the code substituted an empty authorization object and let the request through — CISA added it to the KEV…
-
Starlette’s BadHost is KEV-listed at CVSS 6.5, and CISA filed the FastAPI dependency under a bug class it is not
Three independent scorers rate CVE-2026-48710 a 6.5 medium, CISA’s catalog calls it request smuggling, and the researchers who found it call it an authentication bypass — it is…
-
Kestra is on a three-day federal clock for a command injection CVE whose actual flaw is a filter calling endsWith
CISA catalogs CVE-2026-49869 as an OS command injection flaw, but what an attacker actually exploits is a filter that checks whether a request path ends with the word…