WHY ARE THERE SO MANY CVES (we know why)
November 4, 2026 at 5:43 PM
WHY ARE THERE SO MANY CVES (we know why)
checking on the day's CVEs
Tupperware Avalanche Surprise
Alt: Tupperware Avalanche Surprise
static.klipy.com
November 5, 2026 at 10:25 PM
checking on the day's CVEs
We got CVEs for Microsoft Paint now
www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...
www.cve.org
November 6, 2026 at 5:47 AM
We got CVEs for Microsoft Paint now
www.cve.org/CVERecord?id...
www.cve.org/CVERecord?id...
but mom can we have a new exploit?
no, dear, we have CVEs at home
no, dear, we have CVEs at home
November 6, 2026 at 10:10 PM
but mom can we have a new exploit?
no, dear, we have CVEs at home
no, dear, we have CVEs at home
November 8, 2026 at 3:42 PM
this is basically me in the morning sipping my pour over coffee in the rising morning sun while the fog rolls out. fresh cves to examine, new system cards to analyze.
November 10, 2026 at 4:12 PM
this is basically me in the morning sipping my pour over coffee in the rising morning sun while the fog rolls out. fresh cves to examine, new system cards to analyze.
Python's CVEs Triple. Anthropic Funds a New Security Developer
https://developers.slashdot.org/story/26/11/08/0558256/pythons-cves-triple-anthropic-funds-a-new-security-developer?utm_source=rss1.0mainlinkanon&utm_medium=feed
Python's CVEs Triple. Anthropic Funds a New Security Developer
In the last year CVEs have increased 3x for Python and its package manager Pip, according to Python's security developer in residence Seth Larson. "And the amount of malware published and removed from the Python Package Index (PyPI) is up 60%." Securing Python's ecosystem is getting more complex, ...
developers.slashdot.org
November 8, 2026 at 3:42 PM
Python's CVEs Triple. Anthropic Funds a New Security Developer
https://developers.slashdot.org/story/26/11/08/0558256/pythons-cves-triple-anthropic-funds-a-new-security-developer?utm_source=rss1.0mainlinkanon&utm_medium=feed
krb5-1.22.3 is released, with fixes for 21 CVEs
oss-sec: krb5-1.22.3 is released, with fixes for 21 CVEs
Posted by Alan Coopersmith on Nov 09 https://mailman.mit.edu/pipermail/kerberos-announce/2026q4/000212.html announces:
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt advises:
seclists.org
November 10, 2026 at 12:44 AM
krb5-1.22.3 is released, with fixes for 21 CVEs
"curl took a bold move by deciding to publish low and medium vulnerabilities findings publicly as issues for full transparency and we encourage other open source maintainers to follow their lead."
🪅
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
🪅
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
After 7-months, Glasswing Overwelms Maintainers with Underwhelming Findings | Blog | VulnCheck
Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0.5% of all CVEs published this year, with only two identified as exploited in the wild. Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.
www.vulncheck.com
November 9, 2026 at 10:34 PM
"curl took a bold move by deciding to publish low and medium vulnerabilities findings publicly as issues for full transparency and we encourage other open source maintainers to follow their lead."
🪅
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
🪅
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
Able2Shell - N-Central N-Able
CVEs/0-Days/N-Central N-Able at main · Oracle-Security/CVEs
A repository of exploits that I have discovered. These are disclosed responsibly and vendors have been contacted. In any instance where it works against the live version, the vendor has not respond...
github.com
November 9, 2026 at 7:15 PM
Able2Shell - N-Central N-Able
Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
A mountain of CVEs, a certificate cleanup, and yet more work for Microsoft's patching teams
www.theregister.com
November 9, 2026 at 3:06 PM
Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
cvefeed.io/dashboard/
Feedodido.
Feedodido.
CVEFeed – CVE and Vulnerabilities database, Exploits & Cybersecurity Analytics
CVEFeed provides the CVEs Vulnerabilities database, EPSS exploit predictions, CISA KEV catalog, CWE, and CAPEC databases. Stay ahead of cyber threats in real time. Our mission is to help organizations...
cvefeed.io
November 7, 2026 at 11:05 PM
cvefeed.io/dashboard/
Feedodido.
Feedodido.
Even my 3D printer had a few CVEs last month.
This is the fall of CVEs
This is the fall of CVEs
November 5, 2026 at 12:38 AM
Even my 3D printer had a few CVEs last month.
This is the fall of CVEs
This is the fall of CVEs
Join @lachie.bsky.social & me Tue 12:20pm at #KubeCon to discuss everyone's favorites: LTS, EOL, CVEs!
"Shiny new releases may bring shiny new bugs. Where stability is top priority, the frenetic pace of an upgrade treadmill may not match your real needs."
events.linuxfoundation.org/kubecon-clou...
"Shiny new releases may bring shiny new bugs. Where stability is top priority, the frenetic pace of an upgrade treadmill may not match your real needs."
events.linuxfoundation.org/kubecon-clou...
November 6, 2026 at 10:23 PM
Join @lachie.bsky.social & me Tue 12:20pm at #KubeCon to discuss everyone's favorites: LTS, EOL, CVEs!
"Shiny new releases may bring shiny new bugs. Where stability is top priority, the frenetic pace of an upgrade treadmill may not match your real needs."
events.linuxfoundation.org/kubecon-clou...
"Shiny new releases may bring shiny new bugs. Where stability is top priority, the frenetic pace of an upgrade treadmill may not match your real needs."
events.linuxfoundation.org/kubecon-clou...
Haha, even Microsoft memes about the CVEs by saying Paint, of all things, has one
Oh
Oh
November 5, 2026 at 9:11 PM
Haha, even Microsoft memes about the CVEs by saying Paint, of all things, has one
Oh
Oh
AI turns new vulnerabilities into exploits within hours. Upgrading to patch is too slow.
In real codebases, Socket can patch 25 to 50% of critical CVEs today without upgrading a single package. Every patch is human-reviewed. Critical patches are free.
socket.dev/features/pat...
In real codebases, Socket can patch 25 to 50% of critical CVEs today without upgrading a single package. Every patch is human-reviewed. Critical patches are free.
socket.dev/features/pat...
November 7, 2026 at 11:43 PM
AI turns new vulnerabilities into exploits within hours. Upgrading to patch is too slow.
In real codebases, Socket can patch 25 to 50% of critical CVEs today without upgrading a single package. Every patch is human-reviewed. Critical patches are free.
socket.dev/features/pat...
In real codebases, Socket can patch 25 to 50% of critical CVEs today without upgrading a single package. Every patch is human-reviewed. Critical patches are free.
socket.dev/features/pat...
If someone sends you a security report and you go on to fix the bugs in it, credit them. Even if you don't issue CVEs. Even if you'd have found some yourself eventually. One line in a commit message costs nothing, and it's how people decide whether to report to you next time. 🧵1/2
November 10, 2026 at 9:59 AM
If someone sends you a security report and you go on to fix the bugs in it, credit them. Even if you don't issue CVEs. Even if you'd have found some yourself eventually. One line in a commit message costs nothing, and it's how people decide whether to report to you next time. 🧵1/2
LTS buys time, not immunity from EOL or CVEs. Join me and @bridgetkromhout.bsky.social at #KubeCon to talk stability, support, and security.
Nov 10, 12:20 PM MST • Salt Palace, 255 BC
events.linuxfoundation.org/kubecon-clou...
Nov 10, 12:20 PM MST • Salt Palace, 255 BC
events.linuxfoundation.org/kubecon-clou...
November 6, 2026 at 11:35 PM
LTS buys time, not immunity from EOL or CVEs. Join me and @bridgetkromhout.bsky.social at #KubeCon to talk stability, support, and security.
Nov 10, 12:20 PM MST • Salt Palace, 255 BC
events.linuxfoundation.org/kubecon-clou...
Nov 10, 12:20 PM MST • Salt Palace, 255 BC
events.linuxfoundation.org/kubecon-clou...
never did i think before i'd be subscribing to mailing lists on purpose but the recent deluge of CVEs has finally driven me to subscribe to debian-security-announce >~<
which- if u run any publicly facing servers or services i recommend u do the same for your relevant host environment mrrp-
which- if u run any publicly facing servers or services i recommend u do the same for your relevant host environment mrrp-
November 7, 2026 at 11:47 PM
never did i think before i'd be subscribing to mailing lists on purpose but the recent deluge of CVEs has finally driven me to subscribe to debian-security-announce >~<
which- if u run any publicly facing servers or services i recommend u do the same for your relevant host environment mrrp-
which- if u run any publicly facing servers or services i recommend u do the same for your relevant host environment mrrp-
Welp. Another 1000+ CVE release from #Microsoft to go along with 110 CVEs from #Adobe. Looks like one bug in Outlook is being exploited. I'll have my full thoughts about the release out soon(ish)
November 10, 2026 at 6:29 PM
Welp. Another 1000+ CVE release from #Microsoft to go along with 110 CVEs from #Adobe. Looks like one bug in Outlook is being exploited. I'll have my full thoughts about the release out soon(ish)
we're bleeding cves every few days. maybe it's best that i don't work on infrastructure after all
November 5, 2026 at 4:23 PM
we're bleeding cves every few days. maybe it's best that i don't work on infrastructure after all