Skip to content
Today
Sign in

Topic

Vulnerability Disclosure

The practice of identifying, reporting, and publicly documenting security flaws—often via CVE identifiers—so vendors can patch them before wide exposure.

Sign in to follow

Current stories

securityConfirmed3 publishers

Two LiteLLM flaws let a basic user account take over the gateway or capture AI provider keys

Check Point Research disclosed two LiteLLM flaws, CVE-2026-35029 and CVE-2026-59823, both fixed in version 1.83.9. On older versions a basic account is enough to take over the gateway or capture provider API keys, according to Check Point's testing.

Publishers:blog.checkpoint.com infosecurity-magazine.com itpro.com

Perspective Coverage

3 publishers
Builder
Builder 32%
Operator
Operator 51%
Investor
Investor 17%

Reality

Evidence58
Adoption70
Hype gap+15
Incentives50
Confidence65
productConfirmed3 publishers

Docker Hub account conversions carried personal access tokens to a new owner for 765 days

Docker fixed critical Docker Hub flaw CVE-2026-105445 under four hours after a report, ending a 765-day exposure window. Docker says it found no evidence of exploitation; the open check for teams is whether anyone of theirs was named owner in a conversion.

Publishers:bleepingcomputer.com docker.com scworld.com thehackernews.com

Perspective Coverage

4 publishers
Builder
Builder 34%
Operator
Operator 51%
Investor
Investor 15%

Reality

Evidence68
Adoption
Not scored
Hype gap+8
Incentives50
Confidence72
leadershipOne report1 publisher

GitLab patches a CVSS 10.0 code-execution flaw across its 19.2, 19.3 and 19.4 lines

GitLab released critical patches 19.4.2, 19.3.5 and 19.2.8 on October 12 to fix a CVSS 10.0 code-execution flaw. Self-managed installations are told to upgrade immediately, while GitLab.com is already patched and Dedicated customers need do nothing.

Publishers:docs.gitlab.com

Reality

Evidence68
Adoption
Not scored
Hype gap0
Incentives
Not scored
Confidence72

Earlier coverage

  1. Crafted certificate lets an agent in Vercel Sandbox leak data past its network allowlist, AIR says

    Security · October 13, 2026 · One report1 publisher

  2. Chainguard's Mythos harness finds a vLLM flaw that lets one client dictate another's output

    Security · October 13, 2026 · One report1 publisher

  3. Attackers had 24 days to diff Zimbra's quiet 10.1.20 fix before CVE-2026-73570 was disclosed

    Build · October 13, 2026 · One report1 publisher

  4. Super Forms' second critical flaw in 2026 lets a form submission delete WordPress directories

    Build · October 11, 2026 · One report1 publisher

  5. AnyPwn exploit gives attackers pre-auth root on unpatched AnyDesk Linux hosts

    Security · October 9, 2026 · One report1 publisher

  6. One skipped escape call left Telegram Desktop's HTML export open to stored XSS for 28 months

    Build · October 10, 2026 · One report1 publisher

  7. DeepSeek Harness lets a sandboxed agent escalate itself to full access via an unauthenticated API

    Build · October 10, 2026 · One report1 publisher

  8. ShieldCrash bypasses Microsoft's second patch in the same Defender escalation chain

    Security · September 10, 2026 · Confirmed17 publishers

  9. Telegram Desktop let one clicked link copy a whole account over its local socket

    Build · October 10, 2026 · One report1 publisher

  10. SAML role decides which NetScaler appliances Citrix's new RCE flaw can reach

    Security · October 9, 2026 · Confirmed5 publishers

  11. Chained PaperCut flaws reportedly let attackers run code before login

    Build · October 9, 2026 · One report1 publisher

  12. Lava finds more than 12,000 NVIDIA GPUs publishing telemetry to the open internet

    Security · October 9, 2026 · One report1 publisher

  13. Three teams break into a fully patched Pixel 10 remotely at Pwn2Own Ireland

    Security · October 9, 2026 · One report1 publisher

  14. Splunk's Patroni API flaw lets unauthenticated attackers run commands on search head clusters

    Security · October 9, 2026 · One report1 publisher

  15. Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flaw

    Security · October 6, 2026 · Confirmed15 publishers

  16. openPDC's Docker image carries all six CVEs listed in CISA advisory

    Security · October 8, 2026 · One report1 publisher

  17. AgentCore's region-wide default role let one public agent's stolen credentials reach every agent in the account

    Build · October 8, 2026 · Confirmed2 publishers

  18. OpenAI told Services Australia about its AI agent's break-in 84 days after it happened

    Leadership · October 7, 2026 · One report1 publisher

  19. Talos discloses eight patched flaws, including two Foxit Reader code-execution bugs

    Security · October 7, 2026 · One report1 publisher

  20. Microsoft's AI-driven FORGE lab helped find 140 Windows CVEs in five months

    Security · October 7, 2026 · One report1 publisher

  21. NetScaler attackers tunnel into internal networks with a new Python proxy

    Security · September 30, 2026 · Confirmed21 publishers

  22. Defender's SYSTEM race is back: ShieldBreak PoC says Microsoft's July fix never held

    Security · August 15, 2026 · Confirmed5 publishers

  23. Samsung's October Galaxy patch fixes critical flaws in the Android 17 it is rolling out

    Product · October 6, 2026 · One report1 publisher

  24. Spreadsheet database ranges let LibreOffice and OpenOffice run Java code on open

    Security · October 6, 2026 · One report1 publisher

  25. Unsloth Studio executed a model's Python code during a routine config check

    Security · September 29, 2026 · Confirmed2 publishers

  26. Two local-only flaws expose Johnson Controls EasyIO FG devices to full unauthorized access

    Security · October 6, 2026 · One report1 publisher

  27. Hitachi Energy SOI versions 2.0.0 to 2.2.0 carry a remote code execution flaw in bundled ActiveMQ

    Security · October 6, 2026 · One report1 publisher

  28. Dell patches unauthenticated root flaw CVE-2026-86360 in its PowerEdge update tool

    Security · October 5, 2026 · Confirmed3 publishers

  29. GitHub limits private vulnerability reports per day to spare maintainers' review time

    Product · October 5, 2026 · One report1 publisher

  30. Apple patches a Screen Sharing flaw that hands network attackers root on an unpatched Mac

    Product · October 5, 2026 · One report1 publisher

  31. skip_block_zeroing let a 4 KiB write return 60 KiB of another tenant's disk

    Build · September 24, 2026 · Confirmed2 publishers

  32. CISA warns a single unauthenticated request can root MikroTik RouterOS below 7.24

    Security · September 30, 2026 · Confirmed3 publishers

  33. Manufacturers selling into the EU now owe ENISA a 24-hour warning on exploited flaws

    Security · September 18, 2026 · Confirmed5 publishers

  34. DIVD says an AI agent chained two Zammad zero-days to root on its helpdesk host

    Build · October 4, 2026 · One report1 publisher

  35. Monthly vulnerability disclosures more than double since start of 2026, GTIG finds

    Leadership · October 1, 2026 · Confirmed2 publishers

  36. HFS leaks the Math.random() state that signs its admin cookies

    Build · October 3, 2026 · One report1 publisher

  37. Fortra's BoKS lets an attacker rederive AD service-account passwords offline

    Build · October 3, 2026 · One report1 publisher

  38. Unbound 1.26.1 fixes a DNSSEC heap overflow its vendor says could allow remote code execution

    Build · October 3, 2026 · One report1 publisher

  39. CrewAI deletes its code-sandbox blocklist after ctypes.CDLL(None) bypassed all nine names

    Build · October 3, 2026 · One report1 publisher

  40. Four MCP servers drew CVEs for exposing every tool without authentication

    Build · October 3, 2026 · One report1 publisher