-
Apache Camel published 39 advisories in 64 minutes, and a scanning tool is the credited finder on 27
Apache Camel published 39 CVE records between 10:03 and 11:07 a.m. UTC on Monday, October 19, and the project’s own advisory pages name a scanning tool rather than…
-
In all nine of today’s stories, the authoritative record is unscored, wrong, or missing
Fourteen CVE records published today carry no severity metric at all, two fixes shipped without being called security fixes, and the 9.8 that needs acting on tonight names…
-
OpenCode’s only account of its API key exposure is a post on X, and its own site and changelog say nothing
Multiple outlets report that OpenCode confirmed provider API keys may have been exposed for 1.4% of Console users; the company’s own website, documentation, changelog, and parent company site…
-
Gitea ships twelve security advisories with 28.2.0 and a severity score on none of them
Twelve records published inside eleven minutes on Sunday evening, one of them an unauthenticated panic anonymous visitors can reach, and not one of the twelve carries a severity…
-
BIRD accepts IPv6 FlowSpec rules for address space a peer never announced, scored 2.3 low with no fixed release
CVE-2026-112112 describes a BGP peer getting IPv6 FlowSpec filtering rules accepted for address space it was never authorized to touch, then scores that 2.3 and marks every downstream…
-
JQ::Lite escaped the quotes in a user’s regular expression, and a (?{ }) code block never needed one
The pattern was compiled as Perl source text instead of as a pattern, so a (?{ … }) block inside it ran at match time — and the…
-
WSO2’s new code execution record carries no score, 579 days after the vendor rated the same flaw 6.4 and administrator-only
The CVE record published this afternoon describes arbitrary code execution and “full compromise of the system” with no CVSS score at all. WSO2’s own advisory, up since March…
-
Stable Diffusion web UI executes Python from a YAML file beside the safetensors model, and the record scores it 6.3 where the reporter asked for 8.8
Four records published today against AUTOMATIC1111’s web UI; the code execution comes from a same-basename YAML sidecar, and the inert file in the attacker’s package is the safetensors…
-
OttoKit’s new 9.8 names 1.1.41 as the fixed version, and 1.1.41 shipped three days before the flaw was reported
The CVE record published this morning marks version 1.1.41 unaffected; the plugin’s own changelog attaches no security entry to 1.1.41 and credits the researcher in 1.1.42, a week…
-
BMC fixed a total login bypass in Helix Network Management in August and filed it as resolved issue DRR69-3214
CVE-2026-111283 arrived 53 days after the patch, from a third-party CNA, because the researcher offered to route it through one.
-
OpenTelemetry’s Python HTTP exporter read an empty certificate variable as “skip TLS verification” for five years
CVE-2026-112006, published Sunday, covers five years of releases; the fix shipped September 25 inside a refactor whose release notes never mention TLS.
-
Four fix versions in today’s records were never released, and the record behind Sunday’s federal deadline is gone
A federal deadline falls Sunday on a record Atlassian withdrew, and three of today’s nine stories name a fixed version the project never shipped.
-
Coder advisory promised a patched 2.33.12 that was never released, and the CVE record repeated it 68 days later
Coder’s own advisory, published August 10, told operators on the 2.33 line to upgrade to 2.33.12. That release does not exist and never has. On October 17 a…
-
FreeRDP’s 60-advisory release carried no CVE IDs, and 62 records have arrived in the 25 days since
FreeRDP 3.32.0 closed 60 separately reported security issues on September 23 and carried no CVE identifiers. Sixty-two have arrived since, two of them yesterday – and the advisory…
-
Fireworks AI says customer API keys were captured from evaluation-job environment variables, and deleting the stored secret does not revoke them
Fireworks AI’s October 9, 2026 bulletin confirms an intruder read the environment variables of customer evaluation jobs, capturing API keys and third-party secrets. It names no account count,…