Company
Black Duck is a software composition analysis and application security testing vendor, known for its Black Duck SCA tool and annual open source risk research.
LiteLLM 1.83.9 fixes two Check Point-reported flaws, CVE-2026-35029 and CVE-2026-59823, that affect every older version of the gateway. A DEV Community patch guide pairs the upgrade with key rotation and an audit of what the gateway held.
Reality
Check Point Research disclosed two LiteLLM flaws, CVE-2026-35029 and CVE-2026-59823, both fixed in version 1.83.9. On older versions a basic account is enough to take over the gateway or capture provider API keys, according to Check Point's testing.
Perspective Coverage
3 publishersReality
CISA now flags CVE-2025-14733 as used in ransomware attacks, nine months after WatchGuard shipped the fix. Shadowserver's scans show the exposed population fell from more than 115,000 to nearly 9,000, and that remainder is the target set.
Reality
A default self-hosted Artifactory install trusted an empty string as a join key. Because JFrog supports non-expiring tokens, an upgrade can leave a forged administrator token valid.
Reality
A dev.to guide walks through checking a self-hosted LLM tool's memory floor, offline behaviour and license before you integrate it. The checks worth the time read artifacts the maintainers wrote for themselves.
Reality
BOD 26-04 revoked the federal CVSS requirement on June 10. The two decision fields CISA promised, automatability and technical impact, go out through Vulnrichment; the KEV feed does not carry them, so every defender does the join.
Reality
The bypass needs no credential, and exploitation followed JFrog's 28 August disclosure by three days. ZoomEye's fingerprint puts 17,874 Artifactory services on the internet, though only self-hosted instances on affected versions are in scope.
Reality
Writing in Forbes, OpenVPN chief executive Francis Dinha names Turbo VPN and VyprVPN among providers found on a 2019 build and puts the exposure in what vendors did with the code after they took it.
Reality
Two or three of the 95 were genuine, and reviewers had to read all of them to find out. The EU's 24-hour ENISA clock starts on September 11, 2026, and only evidence of active exploitation starts it.
Reality
Zimperium's 2026 heist report tracks 34 malware families against 1,243 financial brands. The capability mix has moved from stealing credentials to owning the handset and encrypting it.
Reality
Archiving a project with a billion Docker pulls turned an object store into an audit finding. Docker's extended support does not remove the migration, it moves the deadline out to 2031.
Reality