cve

Weaviate published 1.38.21, 1.39.12 and 1.40.1 on October 12 and 13; the notes cite two CVE fixes, list no breaking changes or features, and do not describe the CVEs.

The Argo CD project released patched versions on October 6, 2026 covering eight security advisories; GitHub lists four as Critical with a 9.9 CVSS score. Older minor lines get no patch.

The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.

pgvector 0.8.7 fixes CVE-2026-103484, a buffer overflow in IVFFlat index builds affecting 0.8.6 and earlier; users are urged to upgrade.

Node.js shipped 11 CVE fixes across three High-severity HTTP/2 and Permission Model bugs on July 29, after two delays, while EOL versions 18 and 20 get nothing upstream.

SQLite's own CVE tracker and the National Vulnerability Database both rejected six reports as AI-hallucinated after a JFrog researcher found the underlying code and PoCs didn't exist or didn't work.

Adobe's July 1 updates fix seven CVSS 10.0 flaws—six in ColdFusion, one in on-premises Campaign Classic—that can lead to arbitrary code execution.

Node.js shipped v22.23.0, v24.17.0 and v26.3.1 on June 18, fixing 12 CVEs including two high-severity WebCrypto and TLS flaws. Node 20, EOL since April, gets no patch.

F5 patched CVE-2026-42530, a CVSS 9.2 use-after-free in NGINX's HTTP/3 module, alongside a second 9.2 buffer overflow. Neither is known to be exploited.

June 2026's update tops the previous record of 177 CVEs and includes CVE-2026-45657, a wormable 9.8 kernel use-after-free.

An unauthenticated PHP code-injection bug in the Everest Forms Pro plugin, patched in March, has been exploited since April 13 to plant rogue administrator accounts on WordPress sites.

CISA added the 2022 Linux kernel cgroups release_agent flaw CVE-2022-0492 to its KEV catalog on June 2, 2026, with a June 5 federal patch deadline.