The Record
stories where the finding is the state of the record
-
Mozilla reserved 167 CVE IDs for Firefox 159, abandoned them four minutes later, and rejected all 167 today
The IDs Firefox 159 actually shipped under begin four minutes and two IDs later, and the 167 abandoned records are now in NVD as rejections with no vulnerability…
-
Asterisk fixed twenty flaws in June and the CVE records landed this week, including one caused by a 2022 fix never carried forward
The fixes shipped on June 25; the CVE IDs that would have put them in front of a scanner arrived this week, and one of the twenty exists…
-
Adobe’s Campaign Classic bulletin prints 9.8 beside a vector that scores 10.0, and Adobe’s own CVE record says 10.0
Adobe published eight critical vulnerabilities in Adobe Campaign Classic on Tuesday, October 27, 2026. Its bulletin scores the worst of them 9.8. Its own CVE record for the…
-
Mozilla shipped 167 Firefox CVEs in one release, none of them scored, and NVD deferred them within the hour
Firefox 159 shipped Tuesday with 167 CVEs — 42 percent of every CVE ID published worldwide that day — and not one of them carries a CVSS score,…
-
Supermicro published nine BMC CVEs in two advisories, and neither names a vulnerable firmware version
Supermicro disclosed nine BMC vulnerabilities across two advisories dated October 26, 2026, both of which say “Eight security issues have been discovered,” and neither of which contains a…
-
OpenHands’ unauthenticated root sandbox was fixed by two port-mapping lines, and the empty API-key default its CVE names is unchanged
VulnCheck published a 9.3 critical against the OpenHands Software Agent SDK on Monday describing two conditions — a sandbox server bound to every interface and an empty API-key…
-
Fortinet’s FortiSandbox record names a 4.2 branch the advisory never lists and flags a functional exploit the page calls not exploited
Fortinet published CVE-2026-107656 on October 26 at 1:45 p.m. UTC, thirteen days after the advisory it points to. The record and the advisory disagree about which versions are…
-
llama.cpp’s heap overflow is patched by an API refactor that never mentioned security, and the fix its finder wrote is still an open pull request
The record says so itself: “the root cause is detected-and-aborted, not prevented-by-design.” What happened At 11:00 p.m. UTC on Sunday, October 25, 2026, VulDB published CVE-2026-116096 against llama.cpp,…
-
Both rclone reporters declined to assert an affected range, and the CVE records published Sunday assert one anyway
One rclone advisory says “We have not established a lower bound and do not claim one.” The CVE record written from it begins at version 0. What happened…
-
Plack’s fix for CVE-2026-115825 was never indexed on CPAN, because the release declared the version before it
Five CVEs landed on Perl’s two main PSGI web servers inside two minutes with no CVSS score among them, and in both packages the version the record names…
-
All five of Parse Server’s new CVEs name an alpha build as the 9.x fix, and for six days no stable release carried three of them
Each of the five records points at a different alpha build on the 9.x line, none at a stable release — and between October 10 and October 16,…
-
Unitree confirmed two flaws in its Go2 robot’s voice assistant, and the fix for the 9.6 is older than the firmware the other record calls affected
Two CVE records published 584 milliseconds apart name the same component, share no firmware version with the report they came from, and leave no version an owner can…
-
Sixteen of Rapid7’s seventeen new Zimbra records name no fixed version, and all seventeen cite an advisory page that stops at 10.1.13
Seven of the records name the newest shipping release, 10.1.21, as affected, and one of them disagrees with its own machine-readable version range about whether it is. What…
-
CGM CLININET is fixed in 2026.MS3 for five flaws and affected in 2026.MS3 by six more, including root code execution over HL7
Eleven CGM CLININET records landed at once this morning: five are fixed in release 2026.MS3, and six — including root-level code execution through HL7 — name 2026.MS3 itself…