-
Red Hat scored its StreamsHub Console flaw 9.9 and gave it four workarounds, and its own page names no affected product
Red Hat scored this 9.9 and shipped four workarounds with it. Its own customer-facing page for the flaw carries no affected-products table, no errata, and no fixed version…
-
DrayTek confirmed the Vigor2960 fixes in August, and the two records scored 9.9 today name no fix version
Nine CVE records landed on one DrayTek firmware build in three hours. Six name 1.5.1.7 as the fix; three name nothing, and two of those three are the…
-
SiteGuard’s confirmed-exploited command injection is scored local-access-only, and CISA’s record entry says exploitation none
Update, October 21, 2026: Later on October 20, after this story published, CISA added CVE-2026-106931 to the Known Exploited Vulnerabilities catalog. NVD now shows cisaExploitAdd of 2026-10-20 and…
-
Thirteen AI agent framework records published in ten seconds, and in most of them the shipped default is the vulnerability
One researcher team, one CNA, nine AI agent projects: a batch of records published in a ten-second window overnight, in which the thing being reported is almost never…
-
Letta’s 9.8 record points at a PyPI package that no longer contains the Letta server
Two records published overnight put a 9.8 and an 8.1 on Letta’s self-hosted defaults, and anchor both to a Python package index name that has shipped a different…
-
Nikkei’s 1.83 million leaked records include 1.68 million its own notice says identify nobody
Nikkei’s own notice breaks the figure down: about 150,000 records carry a name or contact detail, and the other 1.68 million carry identifiers the company says cannot identify…
-
Eptura’s Archibus fix version shipped before the flaw was reported, and the supported release below it is still waiting on a patch
Rapid7’s three Archibus records all stop at version 2025.02, a release that shipped roughly six months before the flaws were found and that Eptura’s public release-notes index does…
-
Cognition’s unauthenticated-RCE record names a July release as the fix, and only half the flaw was in it
The record pairs missing authentication with an unsafe default, names a July release as the fix, and the project’s own documentation says the missing authentication is the architecture.…
-
CheckCle fixed its unauthenticated-database flaw in February, and no release or container image since carries the fix
CheckCle fixed its unauthenticated-database flaw 39 hours after a stranger reported it in a public issue, and in the 235 days since has cut no release and pushed…
-
Rank Math PRO’s clean and backdoored downloads carry the same version number, and the 9.8 record names only that version
CVE-2026-111862 published Monday afternoon lists 3.0.123 as the affected version, while its own description says that version alone cannot establish whether a site was compromised. What happened Rank…
-
Mercury 10.0: a missing comma unblocked two endpoints, and the second record’s fix version is the release that fixed it
Two unauthenticated remote code execution flaws in mljar’s Mercury got CVE IDs today, 59 and 49 days after the fixes shipped, and a diff of the published wheels…
-
Google’s Agent Mesh shipped a default policy binding every enrolled member to every service, and the CVE records arrived six weeks later
Google published two CVE records early Monday for its Sovereign Agent Mesh project, one of them for a default configuration that bound every authenticated mesh member to every…
-
Apache Camel scores CVE-2026-78162 a 10.0 and its own advisory page calls it Medium
The CVE record Apache published on Monday morning scores the camel-hazelcast deserialization flaw at the top of the CVSS 4.0 scale; the Camel project’s own advisory page for…