AISLE's September registry wave adds 28 CVEs

AISLE publishes 28 new CVEs across rpm, glibc, tftp-hpa, curl, undici, Environment Modules, Snipe-IT, phpMyFAQ, device-mapper-multipath, SSSD, and GLib2.

Bug class: Memory safety, denial of service, validation, and application-security vulnerabilities
Affected codebase: Multiple open-source projects
Credited system: AISLE
Source snapshot: September 16, 2026
Coverage: September registry rows visible by September 16, 2026
Attribution: Self-reported attribution
AI role: Discovery
Severity: high

Source status: AISLE's live registry exposed 28 September CVE pages at the September 16 cutoff. Bugflation records the exact identifiers rather than AISLE's changing headline total.

Summary

The September snapshot adds 28 exact CVEs: two in rpm, four in glibc, one in tftp-hpa, six in curl, two in undici, one in Environment Modules, four in Snipe-IT, two in phpMyFAQ, one in device-mapper-multipath, four in SSSD, and one in GLib2/GIO.

AISLE’s page currently advertises 397 assigned CVEs while 392 unique CVE IDs are present in the page data. Bugflation does not import either aggregate. It indexes this auditable month slice and retains the five-ID discrepancy as a source caveat.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.