-
Nokri’s job board theme accepts an empty password-reset token again, eighteen months after Wordfence disclosed the same flaw
CVE-2026-18550 describes an unauthenticated administrator takeover through an empty reset token — the same root cause Wordfence published as CVE-2024-12824 in March 2025, in the same theme. What…
-
Kyverno got six CVEs in 38 seconds from a third-party CNA, and the lowest-risk one is scored 3.7 and 9.3 on the same record
The Kubernetes policy engine’s own GitHub advisories, most of them published in April, still say “No known CVE” — including the one a third-party CNA rated 9.0 critical…
-
NovoCure discloses a mid-August breach under Item 8.01 and writes its own Item 1.05 trigger into the filing
Over 1,400 U.S. patient records were exposed as internal ID numbers with no names attached, fewer than 50 with identifying information, and the oncology-device maker says no treatment…
-
Cobham Satcom’s maritime VSAT router has a public exploit and no fix, and the CVE record says the vendor never replied
A command-injection flaw in a Cobham Satcom maritime VSAT router was published with a proof-of-concept exploit, no fixed firmware, and a record stating the vendor never answered —…
-
Four of today’s nine stories are about the gap between a fix and the record of it
Rails’ patch stops the file read and leaves the code execution, and it is still the thing to act on tonight. The two bigger-sounding stories both got smaller.
-
A 9.8 CVE for hulumi describes the project’s own CI sandbox, not anything users install
CVE-2026-82857 carries a 9.8 CVSS v3.1 base score for an over-permissive IAM policy in the hulumi project’s own AWS sandbox account — a resource nobody who installs hulumi…
-
Nutex Health moved its breach disclosure to Item 1.05 seven days after filing it under 8.01
Nutex Health disclosed the same data-theft incident twice in seven days — first as an Item 8.01 “other event,” then, in an after-close filing on Monday, under Item…
-
Eclipse Theia’s AI agent could write files outside the workspace, and the release that fixed it called the change a breaking API change
A path-traversal flaw let Theia’s AI Agent Mode write and delete files anywhere the backend user could reach, and the release that closed it described the change only…
-
Eight MCPHub CVEs published in one second today, and the critical one was fixed in May
GitHub pushed eight CVE records for the Model Context Protocol hub into the National Vulnerability Database this afternoon, their fixes spread across six releases shipped between April 22…
-
Microsoft confirms Windows is falsely reporting Defender as turned off, names no update that caused it, and the alert ignores notification settings
Microsoft confirmed the false alerts on August 28 and listed the originating update as N/A, leaving administrators nothing to roll back and no way to suppress them. On…
-
Rails’ KindaRails2Shell patch stops the file read, not the code execution: a stolen signing key still runs on a fixed server
Rails fixed the file read on July 29. VulnCheck says the deserialization gadget it exposed still runs on a patched server for anyone holding the stolen key. Ruby…
-
The Justice Department edited its China hacking announcement to say seven agencies were targets, not victims
The August 26 release named NASA, the Federal Reserve, and the Senate as victims of QTFY. Two days later it said they were among the targets, and the…
-
ToolJet’s cross-tenant flaw is scored 9.9 and 2.4 on the same CVE record, by the same scorer
Seven ToolJet authorization CVEs landed this morning. On the worst of them, the same scorer published a 9.9 and a 2.4 in the same record, and the vendor’s…