standard
CVSS is an industry-standard framework for scoring the severity of software security vulnerabilities on a 0-10 scale based on exploitability and impact.
No evidence-backed relationships are recorded.
Fortinet confirmed a 9.8-rated, unauthenticated file-write zero-day in FortiMail that attackers are using to drop a reboot-surviving ld.so.preload rootkit. Patching closes the hole but leaves any implant already on the appliance in place.
Reality
MITRE rated CrewAI's nine-name code-sandbox blocklist a CVSS 8.1 flaw, bypassed by a call that executes no import. The fix removed the feature, so teams running agent-written code need isolation at the OS or process level.
Reality
NVD logged CVEs for four MCP servers in about 35 hours, each because every tool it exposes needs no authentication. A fifth MCP flaw, LiteLLM's authentication bypass, is already on CISA's exploited-vulnerabilities list.
Reality
vm2's maintainer patched a CVSS 9.5 flaw in 3.12.2 where the module allowlist matched an approved path as a bare prefix and cleared a neighboring package. With NodeVM's default host context, the unapproved sibling ran with full Node authority.
Reality
CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
Perspective Coverage
7 publishersReality
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
OpenSSL patched 14 flaws, led by CVE-2026-84782, a CVSS 8.2 DTLS handshake bug that lets an unauthenticated remote peer pull fragments of heap memory. Only software that speaks DTLS is exposed, so VPN, VoIP and IoT products go first in the patch queue.
Perspective Coverage
4 publishersReality
Cisco Talos says three threat clusters are exploiting a CVSS 10.0 pre-auth root bypass and a 5.3 hard-coded credential in Secure Firewall Management Center. A patch policy with a severity cutoff above 5.3 would have skipped the credential fix on the console that pushes policy to every managed firewall.
Reality
Ranking by KEV, then EPSS, then CVSS puts a 6.5 with 0.61 exploit odds ahead of a 9.1 at 0.02 in a Dev.to triage guide's worked example. The order is sound, though the backlog savings it promises rest on five hypothetical findings and CVE-wide statistics the post does not source.
Reality
Unauthenticated attackers can drop PHP onto WordPress sites running Forminator 1.56.1 or earlier. The install base is 600,000; the exposed subset depends on how the forms were built.
Reality
Disclosures doubled year over year while actually-exploited vulnerabilities rose 8%. The arithmetic retires patch-everything SLAs and leaves exploitability triage as the defensible option.
Perspective Coverage
3 publishersReality
Three of the Crosswork flaws score a flat 10.0, and Cisco says each CVE bundles several underlying defects. No exploitation reported in the wild so far.
Perspective Coverage
3 publishersReality
Elementor 4.3.0 and 4.3.1 carry a CSRF flaw that lets an attacker turn one link, clicked by a logged-in admin, into a rogue administrator account. Version 4.3.2, released this week, closes the query-string bypass.
Perspective Coverage
3 publishersReality
Microsoft shipped 22 updates, six of them scored 10.0, mostly in Entra ID, Exchange Online and Azure. Fixed server-side is not the same as verified in your tenant.
Perspective Coverage
5 publishersReality
Wordfence and Patchstack disclosed five critical bugs in WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP. Only one of them fires with no configuration precondition. That is what sets the patch order.
Reality
Check Point assigned the CVE identifiers and the 9.8 scores itself and shipped fixes on September 9, so there is no outside read on how reachable the bugs are. Customers on R81.10 get neither a hotfix nor Live Patch.
Perspective Coverage
5 publishersReality
ExPatch says Telegram Desktop wrote bot button text into HTML chat exports without escaping it from March 2024 until a July fix, and updating the app leaves every file the earlier builds wrote unchanged on disk.
Reality
WSO2 published the fix in May. watchTowr saw forged tokens arrive at its honeypot in September. Its own replay against a correctly targeted deployment came back with the credentials the gateway holds.
Reality
SolarWinds fixed two pre-authentication RCEs in Observability Self-Hosted 2026.2.3, rated CVSS 9.8 and 8.8. Operators have no public detail to check either flaw's precondition against, so for most teams upgrading is the quickest way to know where a monitoring server stands.
Reality
Security · September 22, 2026 · 4 publishers
Security · September 24, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher
Build · September 23, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Security · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Build · September 22, 2026 · 1 publisher
Build · September 21, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 19, 2026 · 2 publishers
Build · September 19, 2026 · 1 publisher
Security · September 19, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Security · September 18, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Science · September 18, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Security · September 17, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Security · September 16, 2026 · 4 publishers
Build · September 16, 2026 · 1 publisher
Build · September 15, 2026 · 1 publisher
Security · September 15, 2026 · 1 publisher
Security · September 15, 2026 · 1 publisher
Security · September 14, 2026 · 1 publisher
Build · September 12, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher