CVE
TrialTechniques
Common Vulnerabilities and Exposures, a standard identifier system for publicly known security vulnerabilities.
Why it's here
Placed in Trial: 18 article(s) of evidence from 4 source(s), led by security coverage, with 5 in the last 30 days. Confidence 82%.
Evidence (18)
- 8The New Stack·10/11/2026securityClaude scanner flags 29,000 possible open source bugs
Anthropic says its new OSS Scanner has identified more than 29,000 candidate vulnerabilities across widely used open source projects over six months. However, human reviewers and maintainers have only confirmed and patched a small fraction so far, highlighting a large verification backlog and an optional fast-track workflow for sending unvalidated reports directly to maintainers.
- 9Hacker News·10/5/2026securityApple Patches Actively Exploited macOS Screen Sharing Flaw
Apple fixed CVE-2026-65400, a high-severity macOS vulnerability in the screen sharing feature that could let an unauthenticated attacker gain access to a Mac. Security officials in the Netherlands reported active exploitation on multiple systems exposed to the internet, with root access obtained and Monero mining malware installed.
- 9InfoQ·10/3/2026securityGitLab Vulnerability Actively Exploited to Exfiltrate Data
CVE-2026-85706 is a critical path-traversal flaw in self-managed GitLab CE/EE that allows an unauthenticated remote attacker to read arbitrary files. The issue has moved from theoretical risk to confirmed active exploitation, increasing urgency for affected organizations to patch and review exposure.
- 8The New Stack·10/3/2026securityAI Accelerates Exploits, Exposing Limits of CVE-Based Vulnerability Tracking
The article argues that AI is shrinking exploit development time while software volume and vulnerability discovery continue to rise, making traditional vulnerability management too slow and manual. It says organizations should move from counting CVEs to assessing which flaws create meaningful risk in their specific environment.
- 8Hacker News·9/25/2026securityAvast Antivirus Sandbox Escape Exploitation Detailed
This second part of the Avast research describes the full exploitation of CVE-2025-13032 on Windows 11. The writeup explains how a double-fetch bug in an Avast kernel driver was turned into a pool overflow, kernel read/write primitive, and SYSTEM-level privilege escalation.
- 9Hacker News·9/4/2026securityActively Exploited RCE in Chromium Sandbox
A vulnerability identified as CVE-2026-85046 affects Chromium-based browsers and is described as an actively exploited sandbox remote code execution issue. The report indicates the flaw impacts all Chromium versions, making it a high-priority security concern for browser users and vendors.
- 8Hacker News·9/4/2026securityGovernment Rails Site Hit Hours After CVE Patch
A government website running Ruby on Rails was reportedly exploited within hours of a security patch being released for a Rails CVE. The incident highlights how quickly attackers can weaponize newly disclosed vulnerabilities when patching and exposure are delayed.
- 7Hacker News·9/2/2026securityAisle Finds Six curl CVEs After OpenAI and Anthropic Found None
Aisle says it identified six security vulnerabilities in curl after OpenAI and Anthropic had previously reported none. The item highlights a contrast in results from different AI-assisted or automated vulnerability discovery efforts on the same open-source project. curl is a widely used internet transfer library, so confirmed CVEs can have broad downstream impact.
- 6Hacker News·8/31/2026securityCurl disputes a requested CVE for a niche hostname bug
The curl project says it has received its first CVE dispute since becoming a CNA, and it believes the reported issue does not warrant a CVE. The disputed bug concerns wildcard certificate hostname matching for URLs using a leading-dot hostname, a case curl describes as highly niche and unlikely to affect most users.
- 5Hacker News·8/28/2026open_sourceMaintainers push back against AI-generated open-source noise
A maintainer argues that some contributors are using AI tools to generate low-effort pull requests and security reports to improve their GitHub profiles rather than help the project. The post says this has increased recently, leading the maintainer to reject or scrutinize such submissions more aggressively, especially when they appear to offer little substantive value.
- 4Hacker News·8/23/2026securityAI models help root an Amazon Fire HD 10 tablet
A user reported spending $266 on AI model usage to help find and validate a root exploit for an Amazon Fire HD 10 tablet used as a kiosk. The effort centered on a known Mali GPU kernel vulnerability, CVE-2022-38181, which had been patched by Amazon in later firmware but remained exploitable on the user's version. The write-up describes how multiple AI models assisted with analysis after conventional methods and months of manual investigation had stalled.
- 7The New Stack·8/3/2026securityApple caps open security reports as AI-assisted bug findings surge
Apple has introduced limits on how many security reports some researchers can keep open at once, with a 30-day wait after the cap is reached. The policy change comes after an influx of AI-assisted submissions, including a real macOS vulnerability reported by Bynario using GPT-5.5 that Apple later fixed as CVE-2026-43760.
- 7The New Stack·7/28/2026securityAI is reshaping open source security and maintainer support
Frontier AI models are increasing the volume of security findings in open source software, creating a backlog that maintainers and enterprises must triage and fix faster. The article argues that first-party support from project maintainers is becoming a more important part of enterprise risk management because AI has made vulnerability discovery far faster than traditional workflows.
- 7The New Stack·7/10/2026securityRapidFort and ReversingLabs pair up on supply-chain package validation
RapidFort announced a partnership with ReversingLabs to offer a curated open-source dependency library catalog with hardening and independent validation. The goal is to help developers avoid malicious packages that may have no CVEs but still compromise builds, credentials, or CI pipelines.
- 7The New Stack·7/9/2026securityCISA pushes deeper SBOM checks for hardened images
The article discusses updated 2025 CISA guidance saying SBOMs should include all components, including transitive dependencies, with no minimum depth, plus configuration files and fork lineage. It argues that security teams should validate hardened container images with quick “sniff tests” to catch incomplete inventories, improve vulnerability response, and reduce supply chain risk.
- 8Hacker News·7/8/2026securityOpenBSD use-after-free bug enables local root escalation
A vulnerability identified as CVE-2026-57589 affects OpenBSD through version 7.9 in sys/kern/sysv_sem.c. The flaw is a use-after-free in sys_semget() that can allow a local attacker to escalate privileges to root, with a MITRE-assessed CVSS 3.1 score of 7.4 high.
- 8Hacker News·7/8/2026securityHidden authentication backdoor found in multiple Tenda firmware versions
CERT/SEI reports that several Tenda firmware versions contain an undocumented backdoor in the web management login flow, allowing admin access without valid credentials. The issue is tracked as CVE-2026-11405, and mitigation is limited to workarounds because no vendor patch is available yet.
- 8GitHub Blog·6/29/2026securityGitHub Advisory Database faces record vulnerability backlog
GitHub says its Advisory Database processed a record volume of vulnerability reports in May 2026, driven by surges in private vulnerability reports, repository advisories, and CVE requests. Review times have lengthened, but published advisories remain human-validated and existing alerts continue to work normally.