Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
40 matching stories — incident, in Secrets Detection — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Published on 2 October 2026, `CVE-2026-104859` in npm package `@nx/docker` lets untrusted `repositoryName`, `registryUrl`, `--dockerVersion`, and `NX_DOCKER_IMAGE_REF` values break out of interpolated `docker tag`, `docker images`, and `docker push` shell strings during Nx release jobs. The 22.7.8 and 23.1.1 fixes switch those calls to argv arrays with `execFile()` and `execFileSync()`.
Published on 1 October 2026, CVE-2026-103251 in the npm package n8n broke the trust boundary between the normal community-package install flow and the Redis pub-sub path used by queue mode. In affected builds, anyone who could write to the Redis bus could send a forged install message and make every cluster node download, install, and load an attacker-chosen npm package without the usual validation, checksum, permission, or safety checks.
CVE-2026-93207 is a critical Linux kernel SUNRPC bug where a malformed RPCSEC_GSS credential can leave reused server-side state holding a borrowed XDR pointer plus a stale length, opening a path to remote memory corruption in exposed RPC services.
A brief summary of CVE-2026-47774, a high severity HTTP/2 memory exhaustion vulnerability in Envoy proxy that achieves a 5,700:1 amplification ratio through cookie header size bypass and HPACK compression abuse. Includes PoC details, patch analysis, and detection strategies.
A brief summary of CVE-2026-42530, a Use After Free vulnerability in NGINX's HTTP/3 QPACK encoder stream handling that enables unauthenticated denial of service and conditional remote code execution against servers running NGINX Open Source 1.31.0 and 1.31.1.
A short review of CVE-2026-42055, a high severity heap buffer overflow in NGINX's HTTP/2 proxy and gRPC modules that can cause worker process crashes and potential remote code execution under specific non-default configurations.