-
Six of today’s eight stories turn on the distance between the fix and the record
F5 published seven records at once, but the two flaws to handle first were fixed in March and July. Today is only the day the record caught up.
-
Jolokia’s 2018 JNDI denylist is bypassed three ways, and the fix denies every proxy target by default
CVE-2026-84218 defeats the 2018 denylist three different ways, and Jolokia 2.6.2 — released September 2, 2026 — closes it by refusing every proxy target that has not been…
-
A joined cluster can write lines into submariner’s ipsec.conf and run as root on the gateway, and Red Hat lists no fixed version
CVE-2026-66786 reached the public CVE record on September 2, 2026, carrying a 9.1 that Red Hat marks as a draft, a severity rating of Moderate, and no fixed…
-
Seven AI coding agents run attacker code from a repository’s .git/config, and four still have no fix
OpenAI published three Codex CVEs on September 1, 2026. A day later, the research behind one of them said Qwen Code, Grok Build, Hermes Agent, and a second…
-
rpm’s filename-to-shell path draws three more command-injection CVEs, and escaping the shell would not have stopped one of them
Red Hat published three command-injection records in rpm’s build and extraction tooling on September 1 and 2, all credited to the same AI-driven research effort that produced a…
-
F5 njs access control fails open on an exception; nginx-saml parses attacker XML before checking the signature
F5 published seven CVE records on September 2, and the sharpest is an access-control module that lets the request through when its own code throws an exception.
-
Amelia’s booking plugin let anyone become a WordPress administrator, and its changelog has said “resolved a security vulnerability” six times this year
CVE-2026-9055 describes an unauthenticated path from anonymous visitor to WordPress administrator in Amelia Premium 8.0 through 9.6.2 — fixed on July 7, 2026 in a release the vendor’s…
-
Team Password Manager’s March fix for unauthenticated account takeover was announced in a browser-extension release note, and the CVE arrived 176 days later
The fix shipped on March 10, 2026 and was announced five days later as the third bullet in a post about a Chrome extension release; the CVE describing…
-
Proxmox closed an unauthenticated login bypass in 2023 without knowing it was a security fix, and the CVE landed three years later
PSA-2026-00043-1 and CVE-2023-54391 both landed on September 1, 2026, describing an unauthenticated login bypass in end-of-life Proxmox VE 7 that the vendor says a July 2023 refactor closed…
-
The version number was the whole story six times today
The item to act on tonight is JFrog Artifactory, and not for the reason the wire makes it look like. CVE-2026-82329 is a 9.8 authentication bypass that watchTowr…
-
Park Dental Partners filed its breach under the SEC item reserved for material incidents, then said it has found no material impact
The 8-K was accepted at 4:05 p.m. ET on September 1, two business days after the company found unauthorized access on its network — and it went in…
-
HPE’s Aruba switches take unauthenticated code execution at 9.8, and the page naming the fixed version does not render without JavaScript
HPE published 81 CVE records for AOS-CX and Fabric Composer inside one hour on September 1, and every one of them names the last affected version rather than…
-
Forescout ported a PLC exploit to a second WAGO model with Claude for $535 and eight and a half hours, then bricked the device
Forescout’s Vedere Labs published the experiment on Tuesday, September 1, 2026: a five-year-old Siemens Nucleus FTP overflow, moved from one WAGO controller to another with Claude Code and…
-
Langflow’s 9.8 root RCE is being exploited for OpenAI and AWS keys, and the project’s own advisory list has never mentioned it
VulnCheck’s decoy Langflow hosts logged more than 50 exploitation attempts within hours on August 30, 2026 and 360 by the following day. The CVE record for the flaw…
-
Artifactory’s new 9.8 authentication bypass is being exploited, and the version that clears its September 10 federal deadline is still vulnerable
JFrog patched CVE-2026-82329 on August 28, 2026. watchTowr says attackers were minting themselves administrator tokens by September 1 — and the Artifactory builds that close the flaw already…