Patch Soon
High severity, patch available, no exploitation observed
-
Ultimate Member’s unauthenticated 9.8 shipped a fix 29 days before its CVE existed, and CISA’s enrichment already marks it automatable
The plugin named the unauthenticated object injection in its own September 29 changelog, with no identifier, alongside five other security fixes.
-
Eclipse Che’s unauthenticated 9.8 was fixed with 321 added lines and zero deletions, and the auth default is still false on main
The patch adds 321 lines and deletes none: the shell construction that caused the injection is untouched, a 21-character blocklist now sits in front of it, and the…
-
Dell’s 35 new Data Domain CVEs name four unauthenticated 9.8s, and all 136 of their version ranges are unparseable
Thirty-five CVE records for Dell’s backup appliance landed this morning, four of them unauthenticated 9.8s, and all 136 of their machine-readable version ranges are written in a way…
-
jackson-databind’s June deserialization fix is incomplete, and the three builds it named as fixed still accept the attack
The June fix for a jackson-databind allow-list bypass left the same door open, and the bypass of that fix scores higher than the bug it was meant to…
-
Thunderbird 159 fixes seven email-client flaws, and two of them leak Windows credentials from merely displaying a message
Six of the seven are the same bug worn seven ways: Thunderbird fetching a location that a sender, an RSS feed, a calendar server, a news link, or…
-
Chrome’s 52-fix update credits one reporter on all four criticals and 16 of 33 external bugs
Twelve of the 33 external credit lines name an AI lab’s security program, one of them printing the reporter’s own attribution instruction verbatim, and not one of the…
-
Veeam’s fix build for the 9.0 cross-tenant SQL injection is listed as affected by two other CVEs in the same article
Veeam disclosed nine vulnerabilities across three products on Tuesday, October 27, 2026. In Backup for Microsoft 365, the build named as the fix for a 9.0 cross-tenant SQL…
-
Tanium’s two 8.8s let a user with read-only Tanium permissions run code on endpoints, and the CVE records say none of it
Tanium published 31 CVEs in an eight-minute window on Tuesday afternoon. Every record describes its flaw in one sentence that names no attack path. The advisory pages behind…
-
Hitachi gave HiRDB Version 10 three fix points for five 9.8 flaws and gave Version 9 none
Hitachi published nineteen CVE records on October 27, 2026, nine of them scored 9.8, and in all seven HiRDB advisories the Version 10 line gets three fix points…
-
NVIDIA scores a NeMo Agent Toolkit auth flaw 10.0, and the fix has been on PyPI since September 10
NVIDIA’s October 27, 2026 bulletin scores a missing-authentication flaw in its NeMo Agent Toolkit at a flat 10.0, and the release that fixes it has been the current…
-
Kener’s fix warns that 15 published example secrets can forge sessions on your status page, and its own compose file still ships one of them
CVE-2026-116747 describes a JWT secret that falls back to the literal string DUMMY_SECRET; the patch reveals the larger problem is operators who set the placeholder Kener’s own documentation…
-
rembg’s background remover handed back the server’s own files inside the PNG mask, because its model downloader passed None where a hash belongs
CVE-2026-115924 reached the feed on Monday, 54 days after the fix went to PyPI and 48 days after the maintainer’s advisory, which still lists no patched version. What…
-
Two JOSE libraries published key-parsing denial of service on the same day, and one of them was trying to factor the modulus you sent it
erlang-jose shipped eight CVEs and its first release in eleven months on Monday; go-jose’s RSA parsing flaw reached the CVE feed the same day, twelve days after the…
-
The Rust zip crate’s 10.0 is a filename mismatch between two of its own readers, and four of its five new CVEs are fixed only in a major version
Five CVE records landed against the Rust zip crate on Monday afternoon — one of them a 10.0 for an archive that reads one way to a component…