Topic

Vulnerability Advisories

Coordinated disclosure artifacts: CVE records, CISA ICS advisories and their sequential revisions.

Current stories

securityConfirmed3 publishers

Checkmarx finds malicious npm package function-flag still installable after 37,000 downloads

Checkmarx says function-flag, malicious since July 2025 and downloaded more than 37,000 times, is still on npm with no advisory flagging it. Advisory-based scanners have nothing to match, so finding it means checking lockfiles for the campaign's eight names.

Publishers:orca.security securityweek.com thehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 43%
Operator: Operator 50%
Investor: Investor 7%

Reality

Evidence70
Adoption20
Hype gap+15
Incentives55
Confidence68

buildOne report1 publisher

CVE-2026-76441 lets unauthenticated attackers reach restricted functions on Cisco email gateways

CERT-In rates CVE-2026-76441 critical for letting unauthenticated remote attackers into restricted functions on Cisco email gateways 15.5 and earlier. The gateway inspects mail in both directions, so the fix belongs ahead of the next scheduled window, using the release Cisco's own advisory names.

Publishers:dev.to

Reality

Evidence45
Adoption: Not scored
Hype gap+5
Incentives: Not scored
Confidence50

buildOne report1 publisher

Confirmed exploitation moves the Adobe Commerce RCE to the front of CERT-In's patch queue

CERT-In's September 16 advisory covers eleven Adobe product lines and fourteen vulnerability classes. Adobe says one of them, an unauthenticated remote code execution flaw in the commerce line, is already being exploited.

Publishers:dev.to

Reality

Evidence58
Adoption52
Hype gap−5
Incentives32
Confidence55

securityOne report1 publisher

A crafted FTP command takes Schneider's Modicon M340 and five communication modules offline

CISA's ICSA-26-260-04 gives fixed firmware for four of the six affected Schneider parts and lists the BMXNGD0100 and BMXNOC0401 as affected in every version, with a remediation plan for those still being written.

Publishers:cisa.gov

Reality

Evidence70
Adoption25
Hype gap0
Incentives58
Confidence66

securityOne report1 publisher

CISA revises the Mitsubishi FA advisory a fourth time for one UDP denial-of-service bug

CVE-2025-3511 lets a crafted UDP packet stall CC-Link IE TSN modules. Update D restates the fixed-version thresholds model by model, which is the reconciliation work that three earlier revisions did not force.

Publishers:cisa.gov

Reality

Evidence64
Adoption: Not scored
Hype gap−7
Incentives22
Confidence55