CISA Ends Vulnerability Bulletins, Shifts to Risk-Based Prioritization

🕵️ RESEARCH & DEEP DIVES

• CISA Ends Weekly Vulnerability Bulletins, Shifts to Risk-Based Prioritization
  CISA will discontinue its weekly vulnerability bulletins effective Sept. 28 as it pushes organizations toward risk-based prioritization.

  • Affects security teams that rely on CISA's weekly vulnerability roundups, particularly smaller organizations with stretched resources.
  • Effective Sept. 28, new vulnerabilities will remain listed on CVE.org, with actionable updates coming via the KEV Catalog, CISA Alerts and Advisories, and vendor security alerts.
  • The shift follows surging vulnerability volumes driven partly by AI-assisted flaw hunting; Microsoft recently disclosed nearly 1,000 vulnerabilities in a single monthly update, and bug bounty submissions have doubled or tripled.
  • A CISA analysis of 2024-2025 data found attackers exploit only a small subset of disclosed vulnerabilities, the basis for prioritizing real-world risk over CVSS severity scores.
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

• Frappe LMS path traversal in SCORM file serving (CVE-2026-54343) fixed in v2.52.1
  A path traversal flaw in Frappe LMS lets remote attackers read arbitrary server files and is fixed in version 2.52.1.

  • Affects Frappe Learning Management System (LMS) versions prior to 2.52.1.
  • Remote attackers can read files outside the public/scorm directory that are accessible to the server process; flaw is CWE-22 path traversal, rated HIGH 8.7 on CVSS v4.0.
  • The bug sits in SCORMRenderer.render in lms/page_renderers.py, which constructs and opens a server-side path without first confirming it stays within public/scorm.
  • Fixed in Frappe LMS release v2.52.1.
  Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• New RatHat Android malware uses AI to automate device control — BleepingComputer

• ‘Doom Loop’: OpenAI and Microsoft Admits LLMs Are Destroying the Web and Built on Theft — 404 Media

• Inside the Modern SOC: Defending the Cross-Environment Pivot — Palo Alto Unit 42

• Cisco alerts customers to second actively exploited zero-day in as many days — CyberScoop

• Vvveb oEmbedProxy vulnerable to server-side request forgeryVvveb is a powerfu... — CVE ThreatInt

• yutu: Arbitrary File Write via MCP caption-download Toolyutu is an AI-power... — CVE ThreatInt

• JabRef CAYW Sublime Text integration permits operating-system command injecti... — CVE ThreatInt

• SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Com... — CVE ThreatInt

• Stored XSS via SVG UploadSQLBot is an intelligent Text-to-SQL system based on... — CVE ThreatInt

• SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary Fil... — CVE ThreatInt

• SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through... — CVE ThreatInt

• PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchS... — CVE ThreatInt

• OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.c... — CVE ThreatInt

• Booking for Appointments and Events Calendar – Amelia (Premium) through 2.4.4 - Au... — CVE ThreatInt

• Booking for Appointments and Events Calendar - Amelia through 2.4.5 - Missing Auth... — CVE ThreatInt

• Motors – Car Dealership & Classified Listings through 1.4.120 - Missing Authorizat... — CVE ThreatInt

• SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Na... — CVE ThreatInt

• Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the en... — CVE ThreatInt

• Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF bloc... — CVE ThreatInt

• Run open weight models on Amazon Bedrock in AWS European Sovereign Cloud — AWS Security Blog

• SAIL Library Critical Memory Corruption (CVE-2026-54627) — thehackerwire.com (discovered)

• Agrus Scanner 1.0 - open-source Windows network scanner that finds every AI service (and MCP server) on your network. Recently updated: detection signatures now update themselves — r/cybersecurity

• How should I prepare for a SOC/Detection role in a cyber crisis simulation? — r/cybersecurity

• How AI Can Be Used for Cognitive Warfare — r/cybersecurity

• AI agents trust MCP tool descriptions the way browsers trust TLS certs. Attackers are starting to exploit that. — r/cybersecurity

• New Position Not sure of my skills — r/cybersecurity