Loading story…
AISLE’s public CVE discovery registry added 45 auditable CVE IDs after a prior July ledger review, according to a Bugflation audit of the company’s disclosures. The newly public entries were presented as vulnerabilities discovered by AISLE’s AI-native engine, with the count limited to CVEs that were already visible in public records and excluding assigned-but-not-yet-public identifiers.
The disclosed CVEs span multiple software projects, including Ninja Forms, FFmpeg, libssh, cJSON, RabbitMQ, and several smaller projects. Bugflation also noted a reconciliation issue in the RabbitMQ range: RabbitMQ independently lists CVE-2026-67418 through CVE-2026-67421, while CVE-2026-67416 appears publicly only in AISLE’s registry and was flagged for recheck.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
An audit of AISLE’s public CVE discovery registry found that 45 auditable public CVE IDs were added after the July 20 ledger pass. The additions were presented as self-reported discoveries by AISLE’s AI-native engine across multiple software projects.
At the time of the audit, RabbitMQ independently listed CVE-2026-67418 through CVE-2026-67421, while CVE-2026-67416 remained only in AISLE’s public registry. The AISLE-only RabbitMQ entry was flagged for recheck during reconciliation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Apache Software Foundation updated its Apache HTTP Server `2.4` vulnerability record to include fixes in version `2.4.68`, with two CVEs credited to AISLE Research. Apache’s official security page lists the flaws among `httpd` vulnerabilities affecting the `2.4` branch, while separate reporting notes that the issues were accepted as distinct CVEs and tracked under Apache’s upstream severity classifications. The disclosures indicate the vulnerabilities were addressed as part of the `2.4.68` release and formally attributed by Apache to AISLE Research, adding to the project’s broader stream of externally reported security findings. Public reporting did not provide deep technical exploitation details, but the references show the issues were recognized by Apache as legitimate security defects requiring remediation in supported `httpd` deployments.
Jul 20, 2026
CISA expanded its Known Exploited Vulnerabilities catalog in a series of June updates, adding four newly exploited issues across enterprise and software platforms. The agency first listed **CVE-2026-45247** in Mirasvit Full Page Cache Warmer, a deserialization flaw that can enable unauthenticated remote code execution through a crafted serialized PHP object in the `CacheWarmer` cookie. It then added **CVE-2026-42271** in BerriAI LiteLLM, a command injection bug that can let any authenticated user, including low-privilege internal-user key holders, execute arbitrary commands on the host. CISA directed organizations to apply vendor mitigations, follow **BOD 22-01** guidance for cloud services, or discontinue use if mitigations are unavailable. CISA later added three more exploited vulnerabilities: a **Google Chromium V8** out-of-bounds read/write flaw that could allow sandboxed remote code execution via a crafted HTML page, an **Arista EOS** packet decapsulation vulnerability, and a **Cisco Catalyst SD-WAN Manager** flaw that could allow an authenticated local attacker to execute arbitrary commands as root. The KEV catalog count rose from **1,610** to **1,617** across the updates, and CISA assigned remediation deadlines ranging from **2026-06-06** to **2026-06-23**. Separate GitHub commits also showed Rack maintainers fixing multipart parsing denial-of-service issues tracked as **CVE-2025-61770**, **CVE-2025-61771**, and **CVE-2025-61772**, but those fixes were not part of the KEV additions described in the June catalog changes.
Jun 29, 2026
ENISA announced that the **NATO Cyber Security Centre** and AI startup **AISLE** have become **CVE Numbering Authorities** under the **ENISA Root**, giving them the ability to assign `CVE` identifiers to disclosed software vulnerabilities. NATO’s authority covers eligible flaws across the NATO enterprise, while AISLE is limited to vulnerabilities discovered in its own products. The move expands the organizations able to name and track vulnerabilities and adds to ENISA’s growing role in the CVE ecosystem. The designation comes amid broader changes in vulnerability management after continuity and governance concerns around the CVE program in 2025 and as AI speeds up vulnerability discovery. ENISA now oversees 20 numbering authorities under its root, including organizations added directly and others transitioned from the MITRE Root, while parallel initiatives such as CIRCL’s **Global CVE Allocation System (GCVE)** highlight a wider push to diversify how software flaws are cataloged and tracked.
Aug 10, 2026