Topic
The practice of identifying, reporting, and publicly documenting security flaws—often via CVE identifiers—so vendors can patch them before wide exposure.
Sansec disputes Adobe's 30-day patch window for CVE-2026-103849, a maximum-severity flaw in Magento and Adobe Commerce. It has seen no attacks yet but expects mass exploitation soon, citing StyleSmuggler's three days from hotfix to mass attacks.
Reality
Calif published a working exploit that gets root on OpenBSD 7.9 past KARL, SMAP and SMEP by chaining two flaws patched on September 14 and 30. Neither flaw has a CVE, and The Hacker News reports no evidence of attacks.
Reality
Researcher Joe Grand says he told Ledger of an implanted Nano X on March 4, 219 days before the Oct. 9 CryptoBilis wallet losses. The case that Ledger gave no public warning rests on Grand's criticism and Mark Karpelès saying he has seen none.
Reality
CERT Polska disclosed MikroTrick, a chain of two RouterOS flaws that gives unauthenticated admin on routers whose SSH faces the internet. Attacks were already under way at disclosure. Reachable SSH is the one condition the chain needs.
Reality
LiteLLM 1.83.9 fixes two Check Point-reported flaws, CVE-2026-35029 and CVE-2026-59823, that affect every older version of the gateway. A DEV Community patch guide pairs the upgrade with key rotation and an audit of what the gateway held.
Reality
Noma Security reported that Claude Code Desktop's preview ran scripts in HTML files over 256KB, a flaw Anthropic fixed in 1.30096.1. Those scripts could read SSH keys, AWS credentials and GitHub tokens, so previewed repo files should be handled as untrusted code.
Reality
Check Point Research disclosed two LiteLLM flaws, CVE-2026-35029 and CVE-2026-59823, both fixed in version 1.83.9. On older versions a basic account is enough to take over the gateway or capture provider API keys, according to Check Point's testing.
Perspective Coverage
3 publishersReality
Munim, Inc.'s census of 30 self-hosted AI projects found 195 of 618 maintainer advisories missing from GitHub's global database under their own IDs. Dependabot and pip-audit read that database. The author infers OSV tools share the gap, and his direct OSV sweep is still running.
Reality
Three chained webOS flaws give a same-network attacker root on certain LG smart TVs without a PIN, according to an SSD Secure Disclosure advisory. LG has issued a fix, but only two models were tested.
Reality
Artifex fixed Ghostscript CVE-2026-39919 in 10.08.0 on September 8, closing a heap overflow present in versions 9.21 through 10.07.1. Wordfence, which found the flaw, has seen no exploitation in the wild yet.
Reality
Docker fixed critical Docker Hub flaw CVE-2026-105445 under four hours after a report, ending a 765-day exposure window. Docker says it found no evidence of exploitation; the open check for teams is whether anyone of theirs was named owner in a conversion.
Perspective Coverage
4 publishersReality
Rapid7 reported more than 80 vulnerabilities in Zimbra Collaboration Suite and is releasing them in stages while fixes land on different schedules. The first five include a login-limit bypass and flaws that work from one ordinary compromised account.
Reality
Siemens published 17 ICS advisories on Patch Tuesday, with critical flaws in Simatic S7-1500 CPUs, Industrial Edge and Ruggedcom Crossbow SAC. Some are patched; for others Siemens has issued only mitigations.
Reality
Rapid7 disclosed CVE-2026-108065, a CVSS 9.8 SQL injection in Channel Software WebAlliance that lets an unauthenticated attacker read user PII and passwords. With admin database rights, the same request runs system commands on the server.
Reality
Fridges and freezers in several hundred French supermarkets were warmed overnight on 11 October 2026, with losses in the tens of millions of euros. Pen Test Partners points to Danfoss AK-SM and AK-SC controllers and a login derived from the date.
Reality
Grid-tech vendors have had to report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act since 11 September 2026. SBOMs and vulnerability handling become mandatory on 11 December 2027.
Reality
CERT/CC rates Thelia 2.6.0 and 2.6.1 critical for multiple admin-reachable paths to remote code execution. No vendor patch is available, so each shop has to limit its own exposure.
Reality
GitLab released critical patches 19.4.2, 19.3.5 and 19.2.8 on October 12 to fix a CVSS 10.0 code-execution flaw. Self-managed installations are told to upgrade immediately, while GitLab.com is already patched and Dedicated customers need do nothing.
Reality
Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical. The 11.3.6 and 12.0.3 releases that fixed August's 10 flaws are affected. Fixes are in 11.3.7 and 12.1.0.
Reality
Flock became one of more than 550 CVE Numbering Authorities, able to assign and grade CVEs for its own license plate readers and cameras. It earlier deemed a set of physical-access flaws not material.
Reality
Security · September 10, 2026 · Confirmed17 publishers
Security · October 9, 2026 · Confirmed5 publishers
Security · October 6, 2026 · Confirmed15 publishers
Build · October 8, 2026 · Confirmed2 publishers
Security · September 30, 2026 · Confirmed21 publishers
Security · August 15, 2026 · Confirmed5 publishers
Security · September 29, 2026 · Confirmed2 publishers
Security · October 5, 2026 · Confirmed3 publishers
Build · September 24, 2026 · Confirmed2 publishers
Security · September 30, 2026 · Confirmed3 publishers
Security · September 18, 2026 · Confirmed5 publishers
Leadership · October 1, 2026 · Confirmed2 publishers