Newsheise Security
CVSS: NIST schränkt Bewertung von IT-Sicherheitslücken ein
Teaser from the source
Das US-amerikanische NIST betreibt die Schwachstellendatenbank NVD. Der Rückstau an Analysen ist groß, die Kritik des Rechnungshofes harsch.
This is the RSS-feed teaser. Read the full article at the original source.
Read at heise SecurityMore on CVSS
Other advisories
- CriticalCVE-2026-90865Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4
- CriticalCVE-2026-103409Juniper Session Smart Router and Conductor: two CVSS 9.8 flaws give unauthenticated root (CVE-2026-103409, CVE-2026-103406)
- CriticalCVE-2026-110264Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs
- CriticalCVE-2026-79850HPE ArubaOS (AOS-8 / AOS-10): eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws
- Criticalpwn_watch:linux-kernel-zdi-reports-leaked-to-lkmlLinux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)
- CriticalCVE-2026-110264GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
- Not ratedosv:ECHO-f83a-f1a3-51c1The CVE has been rejected by the assigning CNA (Red Hat, CVSS 0.0): per upstream security policy binutils treats its input as trusted, so no security boundary is crossed. No fix exists upstream or in any Debian suite.
- LowCVE-2026-60589Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vect
Other news entries
- CISA Confirms Hackers Exploiting WordPress Core Flaw During Software UpgradesNewsThe Hacker News
- Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command BackdoorsNewsThe Hacker News
- Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet CredentialsNewsThe Hacker News
- Linux kernel RCE CVE-2026-98432NewsFortinet PSIRT
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private KeyNewsThe Hacker News
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawNewsThe Hacker News
- Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other DistributionsNewsThe Hacker News
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left OpenNewsThe Hacker News
Source: https://www.heise.de/news/CVSS-NIST-schraenkt-Bewertung-von-IT-Sicherheitsluecken-ein-11314492.html
ID