-
PraisonAI’s approval gate can be satisfied by the workflow asking for it, and the fix three of today’s records name was never released
Sixteen more PraisonAI CVE records went live today; six of them are flaws in the approval and sandbox layer meant to stop an agent from running dangerous tools,…
-
Capcom says customer-set passwords were not compromised, and 196 accounts had their passwords changed without authorization
The same notice that counts 11,774,247 exposed records also says the login passwords on 196 accounts were changed without authorization. What happened Capcom Co., Ltd. published a notice…
-
Quest Diagnostics disclosed its Quanum breach in a day, and the one materiality sentence in the filing is about operations, not the patient records
The filing confirms a breach in a day, names no scale, and the one sentence containing the word “materially” is about operations. What happened Quest Diagnostics Incorporated filed…
-
Microsoft’s three new cloud 10.0s name no date the flaw existed, and one contradicts itself on the metric carrying most of its score
Microsoft published six cloud-service CVEs on October 22, three of them scored a perfect 10.0, and none of the six names a date on which the flaw existed…
-
Incus shipped the LTS fixes for two critical host escapes with no security note, and a third-party CVE is the only record naming them
Incus patched two critical host-escape flaws on its 7.0 and 6.0 long-term-support branches in mid-October, published no security note with either release, and the only public document naming…
-
Better Auth’s magic-link bypass now has two CVE IDs eight days apart, and its own advisory still says no known CVE
GitHub’s CNA published a second CVE ID today for the Better Auth authentication bypass that VulnCheck already identified on October 14, so one flaw in one npm package…
-
EDK2’s 9.5 pre-boot RCE is fixed in master, carried by no stable tag, and its own advisory says not patched
TianoCore published a 9.5 Critical overflow in EDK II’s PXE boot driver on October 22, and its advisory’s patched-versions field reads “Not patched currently” — a week after…
-
Joomla scores the YOOtheme Pro image handler a perfect 10.0 and marks it attacked, and CISA’s own block in the record says exploitation none
Joomla’s CVE record for the YOOtheme Pro image handler scores it a perfect 10.0, marks exploitation as ATTACKED, and cites one URL: the vendor’s homepage. What happened NVD…
-
Google scores its Brotli decoder flaw 9.2, Node.js calls it high, and Debian ships an affected copy in every release
Google’s own CVE record for the Brotli decoder flaw scores it 9.2 Critical, cites only Node.js’s advisory, and names fix versions that Debian has not shipped in any…
-
State Bank of India calls its data loss immaterial in a filing that says the extent is not yet established
State Bank of India told the exchanges it has lost customer data and that the incident is not material, in a filing that also says the authenticity, completeness,…
-
Cisco gives Unified CM Release 14 no fixed version for eight new CVEs, and each score is the worst flaw in an unnamed group
Cisco’s October voice hardening release carries eight CVE IDs for an unstated number of flaws, each scored at the severity of the worst one in its group, and…
-
GitLab’s second 10.0 regex overflow in nine days names the October 12 fix as affected, and reaches back to 7.0
GitLab’s new integer overflow in the regular expression compiler is scored 10.0 and reaches every release since 7.0, and the three releases that fixed the near-identical 10.0 nine…