-
Nodemailer’s new critical CVE marks 8.0.3 as fixed. The shipped 8.0.3 still has the vulnerable line
A CVE published this morning rates a five-month-old Nodemailer flaw at 9.8 and names 8.0.3 as the version that fixes it. The 8.0.3 tarball on the npm registry…
-
In six of today’s ten stories, the authoritative record has nothing to say at all
cPanel patched a flaw that turns any hosting account into root on the entire server, and three days later the CVE identifier still has no record anywhere. Yesterday…
-
FulcrumSec’s Manchester Airports sample shows itineraries and payment amounts that MAG’s own statement does not list as taken
A group calling itself FulcrumSec claims 86 GB from Manchester Airports Group and published a sample of upcoming flight itineraries and payment amounts — categories of data that…
-
Anthropic is telling Claude users infostealer malware stole their sessions, and the notice exists only as an email
Anthropic emailed Claude users on August 30 to say a bad actor is using commodity infostealer malware to take over their sessions and burn their usage — and…
-
Nineteen Chrome and Edge extensions drain crypto wallets, and five were bought from the developers who built them
Socket says five of the nineteen Chrome and Edge extensions in a wallet-draining campaign it published on August 27 were working tools bought from their original developers and…
-
VulnCheck published thirteen MCP server CVEs in thirteen seconds, and the argocd-mcp record that followed on Saturday scores 10.0
Thirteen Model Context Protocol CVE records went into NVD from a single assigning authority inside a thirteen-second window on August 27; a fourteenth, scoring 10.0 against Argo CD’s…
-
Boston Scientific says implanted cardiac devices still work, but patients implanted since August 25 are not transmitting
The company’s own updates say implanted devices still function and existing remote monitoring still works — but new communicators cannot be activated and new insertable cardiac monitors cannot…
-
AjaxPro shipped a deserialization fix in November 2021. The CVE now on a federal clock still says no fixed version exists.
CVE-2021-23758 entered CISA’s catalog on August 26 with a September 9 federal deadline, and the two databases agencies query disagree about whether a patched version exists.
-
Unitree G1 robots take root code execution from Bluetooth range, and no one has named a fixed firmware version
Two CVE records published August 27 describe unauthenticated root code execution on the Unitree G1 EDU humanoid, one reachable from Bluetooth range with no pairing. Neither the records,…
-
cPanel says a parked-domain flaw gives any account root on the whole server, and the CVE it names has no record
cPanel patched a flaw that turns an ordinary hosting account into root on the entire server. Three days later the CVE identifier in the advisory title has no…
-
WPMU DEV Dashboard’s second unauthenticated admin bypass this month hits the sites the first one missed
A CVSS 9.8 authentication bypass published August 28 affects WPMU DEV Dashboard sites connected to the WPMU DEV Hub, exactly the population the plugin previous unauthenticated admin bypass…
-
PaperCut needed a second emergency patch, and the record spent the day contradicting its own authors
PaperCut’s zero-day needed a second emergency patch because researchers bypassed the first one, and it outranks the 8.7 million-record breach that sounds bigger. The day’s thread: the authoritative…
-
TranslatePress leaked administrator password-reset links to any visitor, and the release that fixed it is missing from the vendor changelog
A translation plugin on more than 400,000 WordPress sites stored administrator password-reset links in a table any visitor could read, and the release that fixed it does not…
-
Wordfence’s Avada advisory says exploitation needs particular site content; its researchers told reporters every Avada install is exploitable
The CVE record for a CVSS 9.8 unauthenticated remote code execution flaw in the Avada theme conditions exploitation on site content an administrator has to have created; the…