Free diagnosis

Vulnerability advisories

Preventive advisories are kept separate from reported incidents and are not included in the incident counts of the incident database. Each item reflects its review time; consult the official sources for current fixes and affected versions.

100 advisoriesLatest review:

  • Apple Safari 27.2 security update (33 CVEs in WebKit and other components, including arbitrary code execution and a Web Content sandbox escape)

    Advisory · Reviewed:

    Official disclosure and status: Apple released Safari 27.2 on October 26, 2026 (US time) and published security content listing fixes for 33 CVEs the same day. Availability of the fix does not mean it has been installed on any individual device.

    Details and recommended actions
    • Affected products: Safari 27.2 is available for macOS Sequoia and macOS Tahoe. Fixed components include WebKit (including Canvas, JavaScript Bindings and Process Model), WebRTC and LinkPresentation.
    • Impact: eight CVEs may lead to arbitrary code execution when processing maliciously crafted web content (CVE-2026-112697, 112655, 112651, 112623, 112659, 112639, 112637 and 112626); one may let a remote attacker break out of the Web Content sandbox (CVE-2026-113897); two may disclose process memory (CVE-2026-112699 and 112680). Others involve memory corruption, unexpected termination of processes or Safari, and use of a media format restricted in Lockdown Mode (CVE-2026-113952).
    • Exploitation and harm: Apple's notice does not say that any of these issues may have been exploited. Exploitation in the wild, a named compromised organization and confirmed information leakage are not established. Unconfirmed does not mean it did not happen.
    • Action: update Safari to 27.2 on the affected macOS releases and verify the installation. Release of a fix and its deployment on each device must be checked separately.

  • Two critical PHP vulnerabilities: security fixes released and attack attempts observed

    Advisory · Reviewed:

    PHP's October 21 announcement confirms releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution and were rated CVSS v4.0 9.2 in the advance notice. The history of the transition from a planned release to published fixes is preserved.

    Details and recommended actions
    • Technical details and scope: PHP attributes CVE-2026-109618 to partially initialized internal request data during out-of-memory handling and cleanup, and CVE-2026-109619 to stale global state tied to freed memory. PHP environments handling web requests include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team identifies especially high risk for mod_php. Cloudflare describes servers running PHP 5.4 or later as affected.
    • Attack attempts observed: Cloudflare's October 21 official blog reports attack traffic directed at its customers and attackers changing payloads in attempts to bypass protection. This is evidence of attempted exploitation, not proof of successful intrusion, a breach at a named organization, or leaked records. IPA's earlier notice said exploitation had not been confirmed at the time of that advance warning; its statement is distinguished from the later observations.
    • Additional communication: the user-supplied Sanae Takaichi X post remains linked to this advisory. Kyodo's October 21 report published at 22:16 JST says she urged preparations for prompt patching on X that evening. The post was not retrieved directly; its reported contents are corroborated by the news report rather than claimed as a direct read.
    • AWS intelligence follow-up (published October 21): Amazon Threat Intelligence observed PHP2Shell exploitation attempts in MadPot beginning October 17, four days before public disclosure, and further attempts after the October 21 patch release. AWS says success against actual target systems is unknown. Review logs and processes from October 17 onward and deploy the released PHP fixes. Observed attempts are not evidence of successful breaches or data leakage.
    • Unit 42 post-exploitation follow-up (official article updated October 23, 2026 at 12:30 p.m. PDT, equivalent to October 24 at 04:30 JST): In its PHP2Shell research, Unit 42 observed activity consistent with an agentic AI attacker after an intrusion targeting a European government entity. Within about two hours of initial exploitation, attackers accessed password hashes and MFA secrets, built an NTLM-relay tunnel into Active Directory, and attempted Domain Admin privilege escalation. This vendor-observed activity does not establish which individual CVE enabled the initial intrusion, a victim headcount or the number of leaked personal records. Apply the PHP security patches and review web/PHP worker activity from October 17, credential access and abnormal Active Directory relays or privilege changes. Unit 42 hunting queries may match unrelated web vulnerabilities; a match alone does not prove either PHP CVE was exploited.
    • Action: promptly deploy PHP 8.5.12, 8.4.27, 8.3.36 or an equivalent vendor-fixed package. PHP states that there is no complete mitigation and updating is the only safe option. PHP 8.1 and older are no longer supported by the PHP project; consult vendor backports or upgrade to a supported branch. Cloudflare reports default WAF protection from October 21 at 03:02 UTC (12:02 JST), but WAF does not replace patching.
    • QNAP product scope (official follow-up, October 22, 2026): QNAP confirmed that the same CVE-2026-109618 and CVE-2026-109619 also affect QTS 6.1.0 and 5.2.11 or earlier; QuTS hero h6.1.0, h6.0.x and h5.2.11 or earlier; QuTScloud c5.2.9 or earlier; QuMagie 2.10.1 or earlier; Note Station 3 3.9.14 or earlier; QNE (ADRA) 1.0.7 or earlier; QVR Surveillance 3.0.3 or earlier (ARM32); and TVR OS 1.0.4 or earlier. PHP itself was patched on October 21, but QNAP product fixes were still under development on October 22, with fixed releases and dates unannounced. Until patches are published, remove internet exposure, disable port forwarding and UPnP, restrict device access to VPN or trusted networks, disable unneeded PHP-based services, and inspect for compromise. These are temporary mitigations, not substitutes for subsequent patching. QNAP had received no reports of exploitation targeting its products at disclosure.
    • Cisco product-specific follow-up (official v1.4 advisory updated October 22, 2026 at 23:00 GMT / October 23 at 08:00 JST): For the existing CVE-2026-109618 and CVE-2026-109619 vulnerabilities, affected Cisco products include Ultra-Reliable Wireless Backhaul (URWB), Expressway Series and Expressway Select Series. A URWB fix, 27.1.1, is expected in February 2027; Expressway 15.5.21 has an undetermined release date. Neither should be described as already released or applied. URWB exploitation requires administrative authentication, and Cisco rates this product CVSS v3.1 6.6. Catalyst Center and Meraki Dashboard remain under investigation, not confirmed affected. Cisco PSIRT says it is not aware of exploitation against Cisco products. Treat this as a follow-up to the same advisory, not an additional incident.
    • SoftBank emergency-alert delivery interruption (official notice of October 23, 2026): While responding to an unspecified PHP vulnerability, SoftBank suspended emergency alert messages for SoftBank, Y!mobile and LINEMO customers at 06:47 JST on October 23. Earthquake, tsunami, disaster and evacuation warnings cannot arrive via this channel during maintenance, so the provider recommends Yahoo! Disaster Alert and alternative services. Completion on October 26 is a plan, not a verified restoration. The announcement did not identify a CVE or confirm exploitation or leakage, and a direct causal link to CVE-2026-109618 or CVE-2026-109619 is unverified. This does not constitute a distinct security incident.
    • NEC Aterm products not affected (official notice, October 26, 2026): NEC's AtermStation said it checked the impact of CVE-2026-109618 and CVE-2026-109619 on Aterm products and services and confirmed that they are not affected. On some Aterm series devices the Quick Setup Web screen URL may show "/index.php", but NEC explains that the affected PHP is not used. NEC says it will publish any new information on the same page. This product-specific not-affected follow-up is appended to the existing advisory and is not a separate incident.

  • Unauthenticated remote code execution in Microsoft QUIC HTTP/3 for .NET on Windows (CVE-2026-105016, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Official disclosure and status: The Microsoft .NET team published CVE-2026-105016 on October 13, 2026. A patched component and .NET security servicing updates are available; deployment on any individual system has not been verified. Disclosure does not establish an intrusion date.

    Details and recommended actions
    • Affected products and prerequisites: .NET 8.0, 9.0, 10.0 and 11 RC2 applications on Windows that use the vulnerable Microsoft QUIC (MsQuic) HTTP/3 network path. The vendor's affected-package table specifically lists Microsoft.Native.Quic.MsQuic.Schannel 2.5.11-ci.156755675. A crafted IPv6 QUIC packet must reach the affected receiving path. This does not imply that every .NET application or Windows installation is exposed.
    • CVE, CVSS and impact: CVE-2026-105016. Microsoft rates it CVSS v3.1 9.8 (Critical; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A heap-based buffer overflow (CWE-122) may permit remote code execution without authentication or user interaction.
    • Exploitation and harm: The vendor's original notice establishes the flaw and its remediation, but does not establish exploitation in the wild, a named compromised organization, or confirmed information disclosure. No confirmed exploitation is not a claim that exploitation is impossible.
    • Fixed version, mitigation and action: Install the latest security servicing update for the affected supported .NET runtime or SDK and restart the application. If directly referenced, update Microsoft.Native.Quic.MsQuic.Schannel to 2.5.11-ci.159417053 or later. Rebuild and redeploy affected self-contained applications with patched components. Inspect the installed runtime with dotnet --info and distinguish patch availability from actual deployment.

  • eMudhra intermediate CA key compromise and Firefox certificate protections

    Advisory · Reviewed:

    Officially disclosed October 20, 2026. Mozilla received a report at 20:06 UTC on October 17 concerning private keys associated with eight eMudhra intermediate CA certificates. Compromised keys could enable forged HTTPS certificates and site impersonation. Successful abuse or actual user data leakage was not established by the reviewed notices.

    Details and recommended actions
    • Scope and uncertainty: eMudhra says its investigation is limited to a specific set of intermediate CA certificates and that root CA private keys are unaffected. No CVE or numeric CVSS score was established for the original key incident. Firefox CVE-2026-113470 concerns the certificate block-list mechanism, not the original key compromise.
    • Defensive response: Mozilla distributed OneCRL blocks on October 17. Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 extend protection to clients that cannot receive remote blocks, while NSS 3.131.1 updates the trusted certificate list.
    • Recommended action: update browsers and NSS as applicable and inspect custom trust stores or environments with remote updates disabled. Do not claim confirmed abuse of fraudulent certificates without evidence.
    • Counting: one security advisory, excluded from incident counts.
    • Significant October 22 update: eMudhra announced a board decision to voluntarily exit its global SSL/TLS certificate business. It stated that the affected intermediate CAs were revoked within 14 hours of discovery, had issued no end-entity certificates, and that its infrastructure and data had not been breached. G1 RSA roots will remain operational during customer migration, and affected clients are to be offered partner replacement certificates at no charge. The withdrawal decision is not evidence that all customers have already completed the transition.
    • Critical Python packaging follow-up (Python packaging maintainers' October 20 notice, reviewed October 24): The eMudhra / emSign intermediate CA incident affects TLS trust for Python tooling. The packaging community recommends at least certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1, plus rebuilding container images with refreshed certificate bundles. pip loads its vendored certifi in addition to the system trust store, so OS-level CA distrust alone does not remove the risk in older pip installations. Check and upgrade existing virtual environments. Python security releases 3.15.1, 3.14.9 and 3.13.17 include pip 26.2.2. Neither malicious TLS interception of named users nor successful deployment to any particular system was established. This CA problem must not be confused with the separate LiteLLM release pipeline compromise.
    • Oracle product-specific follow-up to the same eMudhra CA incident: On October 21, 2026, Oracle issued Security Alert CVE-2026-91403 for JSSE trust of the affected intermediates. Oracle rates it CVSS v3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Unauthenticated network exploitation through reachable JSSE APIs can expose or modify critical data. The Oracle risk matrix lists affected Java SE 8u511 and 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; GraalVM for JDK 17.0.21 and 21.0.13; and GraalVM Enterprise Edition 21.3.20. This is a product-specific consequence of the same CA problem, not evidence of a confirmed compromise or data leak at a named organization, and is not an additional incident.
    • Oracle JDK additional mitigation (vendor guidance updated October 23, 2026): Oracle has issued Java updates and certificate-distrust guidance. Its instructions require action before restarting the JVM even with JDK builds 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.33.0.2 or 8u511 b32. Check each installed runtime, back up the keystore, then either remove the affected emsigneccrootcag3 and comodoaaaca root certificates or enable TLS revocation checking (checkRevocation and CRLDP) as Oracle instructs, followed by a restart. Check separate Java Web Start guidance if applicable. A published update does not mean an individual deployment is patched.
    • Google/Firebase vendor guidance updated October 23, 2026 (reviewed October 24): The eMudhra CA issue also affects Flutter/Dart, certain Cloud Firestore client SDKs and the Firebase App Distribution Gradle plugin because they embed TLS certificate bundles. An OS or browser block alone does not repair already distributed application binaries. Update Dart to 3.13.7 or later and Flutter to 3.47.8 or later for Android, Windows and Linux, then rebuild and republish. For Apple Firestore SDK use 13.1.1 or later or 12.19.3; FlutterFire cloud_firestore 7.1.0 or later (backports 6.10.1 for Apple, 6.10.2 for Windows); Unity 14.1.0 or 13.17.1; and C++ 14.1.0 or 13.13.1. Rebuild, republish and ensure users update. The App Distribution Gradle plugin requires 5.3.1 or later but does not require republishing the application for that plugin-only fix. Google states that Firestore and App Distribution backends were not affected. No organization-specific exploitation or completed patch installation is established.
    • Electron vendor advisory published October 22, 2026 (reviewed October 24): The same eMudhra issue gives rise to product-specific CVE-2026-115570 / GHSA-jr5w-w6x2-84p9, rated CVSS v3.1 7.4 (High) by the vendor. Affected releases are below 42.11.16; from 43.0.0-alpha.1 to below 43.8.1; from 44.0.0-alpha.1 to below 44.9.1; and from 45.0.0-alpha.1 to below 45.0.0-beta.6. If an attacker can use a compromised-CA certificate and intercept application TLS, an HTTPS service can be impersonated and information viewed or altered. Fixed versions 42.11.16, 43.8.1, 44.9.1 and 45.0.0-beta.6 protect Chromium networking and Node.js tls, https and fetch. The vendor offers no application-side workaround. Real-world exploitation and victim breaches are unconfirmed; this is a follow-up to the existing CA advisory, not an additional ADV or incident.
    • Apple official guidance (reviewed October 24): Apple began automatically blocking twelve affected TLS intermediate certificates on October 19 and emSign ECC Root CA - G3 on October 23. Safari, Mail and Apple networking frameworks are protected automatically. However, some macOS and Xcode command-line tools, including curl, git and python3, use /etc/ssl/cert.pem; that trust file will be updated in a future OS release, not yet a completed patch. Apple provides an optional administrator workaround, which requires following vendor instructions and backing up the certificate store because removing trusted roots may disrupt legitimate TLS connections.
    • October 25, 2026 maintainer GHSA follow-up to the existing eMudhra CA incident: certifi 2019.03.09 through versions before 2026.10.19 is affected and fixed in 2026.10.19 or later; uv before 0.13.4 is affected and fixed in 0.13.4 or later. Both developer GHSAs are GitHub Reviewed CVSS v4.0 9.1 (Critical), with no assigned CVE for either GHSA. An attacker possessing a compromised intermediate CA key and an on-path position could impersonate HTTPS endpoints, but actual interception or victim disclosure is unconfirmed. Refresh embedded trust bundles in container images and virtual environments. This follow-up retains the stable advisory ID and does not add an independent incident or advisory.
    • Python security follow-up published October 24, 2026 (CVE-2026-115557): Python announced an explicit ssl-module denylist for compromised eMudhra intermediate CA keys. GitHub Advisory Database rates this CVSS v4.0 9.4 (Critical). An attacker able to exploit the compromised keys and intercept TLS could impersonate HTTPS endpoints, exposing or altering traffic; actual exploitation and named victims are unconfirmed. CPython PR #160042 was merged to main on October 24, but backports to versions 3.11 through 3.15 were being prepared and conflicts were reported. Neither a stable version containing this exact patch nor deployment of it is verified. Follow official security releases and upgrade when available while retaining certifi/pip and trust-store mitigations. This is an update to the existing eMudhra ADV, not a separate incident or advisory.

  • Postiz media path traversal and forged authentication tokens (CVE-2026-115932/115933, max CVSS v3.1 9.9)

    Advisory · Reviewed:

    Official disclosure and status: GitHub Advisory Database published both CVEs on October 24, 2026, when Postiz maintainers released v2.25.3 to fix PSA-2026-E9AHFV and PSA-2026-YT2HMH. Disclosure is not an intrusion date.

    Details and recommended actions
    • Affected product and prerequisites: Self-hosted Postiz containing vulnerable code before the v2.25.3 fixes. Both flaws require an ordinary user account, which an attacker may register when self-registration is enabled. Exact initial affected-version boundaries are not confirmed.
    • CVE-2026-115932: Improper media path validation (CWE-22) can let ordinary users make the server access files outside the upload area and attach them to outbound posts on connected services such as Discord. GitHub Advisory Database rates it CVSS v3.1 9.6 (Critical).
    • CVE-2026-115933: Signing untrusted user-provided claims (CWE-290) may let ordinary users forge session, invitation and password-reset tokens and bypass authentication or authorization. GitHub Advisory Database rates it CVSS v3.1 9.9 (Critical).
    • Exploitation: Maintainer fixing commits and security advisories document the flaws, but the inspected primary sources do not confirm exploitation in the wild, named compromised organizations or proven information disclosure.
    • Fixed release, mitigation and action: Upgrade immediately to maintainer-released Postiz v2.25.3 (October 24). The earlier v2.25.2 fixes the separate pre-existing CVE-2026-115931 but does not include both new fixes. Restrict self-registration and media connections pending patching and audit suspicious outbound transfers and token activity. Such restrictions are incomplete mitigation, not a substitute for the patch. A released patch does not establish deployment.
    • Counting: Two distinct new CVEs grouped into one preventive ADV, separate from the previous Postiz ADV; neither increments AI/LEAK incident counts.

  • Linux Btrfs xattr metadata corruption (CVE-2026-98959, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Official disclosure and update: Linux CNA published CVE-2026-98959 at 21:19 JST on October 23, 2026 and updated it at 23:09 JST on October 24. Publication does not confirm a real-world intrusion.

    Details and recommended actions
    • Affected product and prerequisites: Linux kernel Btrfs (fs/btrfs/xattr.c). Replacing an extended attribute with a differently sized value when CRC32C-colliding names share one item can leave metadata fields uninitialized. The CNA also describes an attack path through writable NFSv4.2 exports using AUTH_SYS, but not every Btrfs deployment exposes this path.
    • CVE, score and potential impact: CVE-2026-98959 has Linux CNA CVSS v3.1 9.8 Critical. Metadata corruption can abort transactions and force read-only mode; specified configurations may allow adjacent data exposure or mishandling of security.capability attributes. No confirmed victim data loss, disclosure or privilege escalation is established.
    • Exploitation status: The CNA publishes a reproducer and upstream corrections, but no confirmed exploitation in the wild, compromised organization or victim count in the primary record.
    • Fixes and response: CNA lists fixed boundaries 6.6.160, 6.12.113, 6.18.57 and 7.2.11. Verify distribution fixes and backports, patch and reboot. Pending updates, reduce access to writable Btrfs-backed NFS exports, particularly AUTH_SYS configurations. Released corrections are not proof of installation.

  • Linux mlx5e AF_XDP double-free vulnerabilities (CVE-2026-99078 and CVE-2026-99079, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Official disclosure and update: The Linux CNA published both CVEs at approximately 21:23 JST on October 23, 2026 and updated them around 23:10 JST on October 24. Publication and review are not confirmed intrusion dates.

    Details and recommended actions
    • Affected product and prerequisites: Linux kernel Mellanox/NVIDIA mlx5e driver with AF_XDP zero-copy and XDP redirect enabled. CVE-2026-99078 affects striding-RQ MPWQE refill and CVE-2026-99079 affects cyclic-RQ refill. Under receive-ring pressure and failed allocation, a refill retry can release stale XSK pointers twice. Exposure is conditional, not universal to Linux installations.
    • CVEs, scoring and impact: The Linux CNA rates each CVE CVSS v3.1 9.8 Critical. Sustained remotely sent traffic may produce duplicate ownership and kernel heap corruption, potentially causing denial of service and, in specified conditions, disclosure or arbitrary memory writes. Potential technical consequences do not establish a real victim.
    • Exploitation status: Maintainer fault-injection and packet-load tests reproduce the defect and verify the fixes. Primary records do not establish exploitation in the wild, named compromised organizations or confirmed information theft.
    • Fixes and response: Linux CNA identifies fixed boundaries 6.6.160, 6.12.113, 6.18.57 and 7.2.11 plus upstream commits. Confirm distribution security updates and backports, apply the relevant patch and reboot. Pending the fix, restrict exposed mlx5e AF_XDP zero-copy paths. Upstream correction is distinct from deployment.

  • Unauthenticated PHP object injection in WordPress Paytium (CVE-2026-114196, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Official disclosure: Patchstack CNA published CVE-2026-114196 on October 24, 2026 at 08:00:13 UTC. The developer records a Paytium 5.0.6 fix dated October 21. Publication is not a confirmed intrusion.

    Details and recommended actions
    • Affected versions and conditions: Paytium WordPress plugin (paytium) through 5.0.5. The developer fixed PHP object injection in the pt_form_field [x-checkbox-y] parameter. Code execution depends on the availability of suitable application gadget chains.
    • CVE, CVSS and potential impact: CVE-2026-114196, Patchstack CNA CVSS v3.1 9.8 Critical. Network vector with no privileges or user interaction required; confidentiality, integrity and availability may be severely affected.
    • Exploitation status: The published CVE record and maintainer fix are verified, but exploitation in the wild, site compromise, data leakage and victim counts remain unconfirmed.
    • Released fix and action: Update to Paytium 5.0.6 or later and review anomalous public-form requests. A released fix does not establish deployment at any site.

  • Unauthenticated blind SQL injection in WordPress Product Filter by WBW (CVE-2026-112866, CVSS v3.1 9.3)

    Advisory · Reviewed:

    Official disclosure: Patchstack CNA published CVE-2026-112866 on October 24, 2026 at 08:00:11 UTC. The maintainer changelog records an SQL injection fix in version 3.4.7 dated October 20. Neither date establishes a breach.

    Details and recommended actions
    • Affected versions and conditions: Product Filter by WBW WordPress plugin (woo-product-filter) through 3.4.6. Unauthenticated blind SQL injection may be possible through frontend filtering, depending on deployment.
    • CVE, CVSS and potential impact: CVE-2026-112866, Patchstack CNA CVSS v3.1 9.3 Critical. Network vector, no privileges or interaction required, changed scope, high confidentiality impact, no integrity impact and low availability impact; database information may be inferred.
    • Exploitation status: The official CVE record and maintainer SQL injection fix are verified; exploited websites, actual data leaks and victims are unconfirmed.
    • Released fix and action: Update to published version 3.4.7 or later and inspect unusual filtering requests and database logs. Fix publication is not confirmation of deployment.

  • Unauthenticated Bun HTTP/3 QPACK amplification denial of service (GHSA-cf8x-9m69-3gg3)

    Advisory · Reviewed:

    Official disclosure: Bun maintainers published GHSA-cf8x-9m69-3gg3 on October 24, 2026 and rated it High. The advisory lists no CVE or numerical CVSS score. Related research was published October 20.

    Details and recommended actions
    • Affected versions and conditions: Bun >=1.3.14 and <1.4.4, when Bun.serve explicitly enables HTTP/3 (http3: true) or fetch explicitly uses HTTP/3. QPACK decompression can create an unbounded expansion of compressed headers. HTTP/3 is disabled by default, and HTTP/1.1 and HTTP/2 are unaffected by this flaw.
    • CVE, CVSS and impact: No assigned CVE or numeric CVSS (maintainer-rated High, CWE-770). Unauthenticated remote peers or malicious HTTP/3 servers can exhaust memory and stall CPU processing. Maintainer tests exhausted a 2 GB-limited process after about 6 MB of traffic and stalled responses for more than a minute with a roughly 20 KB request.
    • Exploitation: The maintainer's reproductions do not establish confirmed in-the-wild exploitation, named victims or data exfiltration.
    • Fixed release and response: Upgrade to released Bun 1.4.4 or later, then rebuild affected bun build --compile executables which embed the runtime. Until upgraded, disable externally reachable HTTP/3 and avoid untrusted HTTP/3 fetch endpoints.

  • open62541 OPC UA client integer overflow and heap corruption (CVE-2026-116014, CVSS v4.0 9.2)

    Advisory · Reviewed:

    Official disclosure: VulnCheck CNA published CVE-2026-116014 on October 24, 2026 at 11:40 UTC. Maintainers had already shipped the fixed release open62541 v1.5.7 on August 20, 2026. October 24 is the CVE publication, not a newly released patch.

    Details and recommended actions
    • Affected versions and prerequisites: open62541 OPC UA clients >=1.5.0 and <1.5.7, when a malicious OPC UA server supplies oversized custom DataType definitions via UA_Client_getRemoteDataTypes(). A 16-bit memSize overflow in UA_DataType_fromStructureDescription() can cause heap corruption during decodeBinaryStructure(). Not every OPC UA server is exposed to this issue.
    • CVE, CVSS and impact: CVE-2026-116014, VulnCheck CNA CVSS v4.0 9.2 (Critical) and v3.1 8.1 (High). Affected clients may crash or possibly execute code under suitable conditions.
    • Exploitation: The official CVE and maintainer patch establish the flaw but do not confirm in-the-wild exploitation, a named breached facility or data theft.
    • Fixed release and response: Upgrade to already released v1.5.7 or later and verify downstream libraries, embedded SDKs and statically linked executables include the fix. Restrict untrusted OPC UA server connections and segment OT networks pending update.

  • Unauthenticated SQL and PHP object injection in WordPress Newsletters (two CVEs; max CVSS v3.1 9.8)

    Advisory · Reviewed:

    Official disclosure: Patchstack CNA published CVE-2026-111402 and CVE-2026-94075 on October 24, 2026 at 08:00 UTC. The maintainer lists both fixes in the Newsletters 4.18.2 changelog on WordPress.org. Disclosure is not a confirmed breach date.

    Details and recommended actions
    • Affected products and conditions: Tribulant Software Newsletters WordPress plugin (newsletters-lite), through version 4.18.1. The first issue is unauthenticated SQL injection in subscriber profile management, and the second is unauthenticated PHP object injection when dismissing a database-update notice. Practical reachability depends on deployment conditions.
    • CVEs, CVSS and potential impact: Patchstack CNA CVSS v3.1 rates CVE-2026-111402 at 9.3 (Critical; confidentiality and availability impact) and CVE-2026-94075 at 9.8 (Critical; confidentiality, integrity and availability impact). Unconditional remote code execution in every installation is not established.
    • Exploitation: The official CVE records and maintainer changelog confirm the defects and fixes but do not establish in-the-wild exploitation, a named compromised site or verified subscriber data theft.
    • Fixed release and response: Upgrade promptly to released version 4.18.2 or later and review access to subscriber-management endpoints. A published fix does not establish deployment on a given site.

  • Node.js fixes ten vulnerabilities including Brotli RCE

    Advisory · Reviewed:

    Published October 21, 2026: ten issues in Node.js 22.x, 24.x and 26.x, including four High issues. Brotli decoder RCE CVE-2026-111497, DNS issue CVE-2026-105482 and TLS bypass CVE-2026-105483 and CVE-2026-106069 are High. CVE-2026-105483 affects 24.x and 26.x only.

    Details and recommended actions
    • Other CVEs: CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071 and CVE-2026-106073. Individual CVSS scores for the other nine issues have not been verified. Upgrade to 22.23.4, 24.22.1 or 26.12.1. Active exploitation and victim incidents are not established.
    • October 23, 2026 government advisory follow-up: Singapore's Cyber Security Agency (CSA) assessed CVE-2026-111497 at CVSS v3.1 9.8 (CSA rating). If an application decompresses attacker-controlled Brotli input via node:zlib, an out-of-bounds decoder write may cause a crash, process-memory disclosure, or remote code execution. Affected versions are Node.js 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1. Fixed security releases were published October 21; update to a fixed version. The October 23 alert does not establish confirmed exploitation or a new victim incident.
    • October 23, 2026 vendor follow-up (same CVE, broader product scope): Envoy's official GHSA-3wvj-j6qm-62mr confirms that CVE-2026-111497 also affects deployments of Envoy configured to decompress Brotli. The advisory lists affected versions v1.39.2, v1.38.5, v1.37.7 and v1.36.11, with fixes in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12. Envoy's own advisory reports CVSS v4.0 9.2 (Critical), separate from CSA's CVSS v3.1 9.8 rating for Node.js. The cited vendor advisory does not establish exploitation in the wild or a specific affected organization. This updates the existing advisory for the same CVE; it adds no separate advisory or incident.
    • October 23, 2026 Bun vendor follow-up (reviewed October 25, 2026): The same Brotli decoder flaw, CVE-2026-111497, also affects Bun >=1.0.21 and <1.4.4. Bun's GHSA-663w-cv8g-jj2p rates the issue High but does not provide a Bun-specific CVSS value. Fixed Bun 1.4.4 is released with patched Brotli 1.2.1. Untrusted compressed data can reach the decoder via automatic fetch decompression, node:zlib or DecompressionStream. Executables built with bun build --compile also need rebuilding using the fixed Bun version. The vendor has not demonstrated an exploit against Bun; exploitation in the wild and named victims remain unconfirmed. Setting fetch decompress: false is a limited mitigation for that code path, not a replacement for upgrading.
    • October 23, 2026 Python package advisory follow-up (reviewed October 25, 2026): GitHub Reviewed GHSA-9v8h-qqgm-4m35 covers the same CVE-2026-111497 in PyPI brotli >=1.0.3 and <1.2.1 (fixed 1.2.1), and brotlicffi >=1.0.3 and <1.2.1.0 (fixed 1.2.1.0). Decompression of untrusted Brotli data risks crashes, memory exposure and potential arbitrary code execution. GitHub rates it CVSS v4.0 9.2 (Critical), distinct from CSA's CVSS v3.1 9.8 assessment for Node.js. Upgrade the affected Python packages. These are product-scope follow-ups to the existing advisory, not distinct vulnerabilities or confirmed victim incidents. Previous review: October 24, 2026 at 22:41:53 JST.

  • Critical lwIP SMTP client buffer overflow (CVE-2026-15340, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Official disclosure: CISA published ICSA-26-279-02 on October 6, 2026 at 06:00 UTC. IPA includes it in its October 19 industrial-security listing. The review time is not an incident date.

    Details and recommended actions
    • Affected versions and prerequisites: Savannah lwIP SMTP client 2.2.1. Inadequate input-size validation permits a classic buffer overflow (CWE-120). Other affected versions and downstream products are not confirmed in the reviewed advisory.
    • CVE, CVSS and impact: CVE-2026-15340, CISA CVSS v3.1 9.8 (Critical; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation may crash affected devices or cause remote code execution.
    • Exploitation: IPA indicates exploit code is available. Successful attacks, named victims or data-exfiltration counts are not established by the primary sources.
    • Fix and response: CISA reports the xchglabs patch patch_125_smtp_txbuf.diff available as Git commit 614420f82c8729d070e01464c0dddb3c9525c772. Integration into commercial devices and installation status are not verified. Minimize control-system internet exposure, isolate networks, and consult maintainers about safe patch availability.

  • Viidure Dashcam exposed cloud data and embedded credentials (two CVEs, maximum CVSS 10.0)

    Advisory · Reviewed:

    Official disclosure: CISA issued ICSA-26-272-07 on September 29, 2026 at 06:00 UTC and IPA also lists it. The review time does not establish any actual breach date.

    Details and recommended actions
    • Affected versions and conditions: Viidure Dashcam Android Application through version 3.3.1.260403. CVE-2026-94204 concerns public-read permissions on shared cloud storage, potentially exposing customer records, dashcam footage and firmware. CVE-2026-96587 concerns plaintext credentials embedded in the application that may permit reading, modification and deletion of shared cloud data.
    • CVE, CVSS and impact: CISA CVSS v3.1 is 7.5 (High) for CVE-2026-94204 and 10.0 (Critical) for CVE-2026-96587. Potential exposure does not establish confirmed data theft, leaked-video counts, or victim counts.
    • Exploitation: CISA reports no known public exploitation specifically targeting these vulnerabilities as of publication. Named victims and actual disclosure are not established.
    • Fix and response: CISA reports that the vendor did not respond to coordination and that no fixed release was verified. Users should contact the vendor and review cloud integration and access permissions. Do not assume a patch has been released or installed.

  • Echo WebSocket rejection can bypass proxy-route authorization (GHSA-cxf3-9h37-7rr8, CVSS v4.0 9.1)

    Advisory · Reviewed:

    Official disclosure: Echo maintainers published GHSA-cxf3-9h37-7rr8 on October 22, 2026; the GitHub Reviewed advisory was updated October 23. This review time is not a breach date.

    Details and recommended actions
    • Affected products and prerequisites: labstack/echo/v4 releases from 4.0.0 through those earlier than 4.16.1 and labstack/echo/v5 from 5.0.0 through those earlier than 5.4.1. Exploitation requires an accessible Proxy route, an upstream that rejects a WebSocket upgrade while retaining the connection, and an upstream resource without independent authorization.
    • CVE, CVSS and impact: No CVE is assigned in the published GHSA. GitHub Reviewed rates CVSS v4.0 9.1 (Critical). After a rejected WebSocket upgrade, a raw tunnel may forward subsequent HTTP requests directly to the upstream while bypassing Echo's router and route-specific authentication or authorization. The issue neither allows arbitrary-host proxying nor bypasses upstream authorization.
    • Exploitation: The maintainer confirms reproductions and patches, but the original disclosure does not establish active exploitation, a named victim or confirmed leakage.
    • Fixed releases and response: Update to released Echo v4.16.1 or v5.4.1 or later. Until patched, reject WebSocket upgrades before the affected proxy routes or enforce independent authorization for every upstream resource. A non-101 response alone does not mitigate the issue; a published fix does not prove deployment.

  • Postiz authenticated file disclosure and backend termination (CVE-2026-115931, CVSS v3.1 9.9)

    Advisory · Reviewed:

    Official disclosure: The coordinated PSA-2026-JNXM56 and Postiz maintainer release v2.25.2 were published on October 23, 2026; this review timestamp is not a breach date.

    Details and recommended actions
    • Affected product and prerequisites: Self-hosted gitroomhq/postiz-app versions 2.23.0 through versions earlier than 2.25.2. An ordinary account and connected channel are required. Default-enabled self-registration allows an external actor to create such an account without administrator access or another user's interaction.
    • CVE, score and impact: CVE-2026-115931, rated Critical at CVSS v3.1 9.9 by coordinating source GAdvisory (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Missing restrictions on backend provider methods expose files readable by the service, environment secrets including JWT signing keys and integration credentials, potential session forgery, and backend termination.
    • Exploitation: The coordinating advisory records researcher proof-of-concept exploitation and maintainer reproduction and validation of the fix. It does not establish exploitation in the wild or a confirmed breach of an identified customer.
    • Fix and mitigation: Upgrade to the maintainer-released Postiz v2.25.2 or later. Review abnormal provider calls, file-access and restart logs, and consider credential and signing-key rotation if exposure is suspected. DISABLE_REGISTRATION=true limits new sign-ups but does not mitigate exploitation by existing registered users, and is not a patch. Release availability does not establish deployment in any given installation.

  • WordPress Prime Mover PHP object injection (CVE-2026-115806, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Official disclosure: Wordfence Intelligence published its vulnerability record on October 22, 2026, and updated it on October 24. These are publication dates, not known attack or patch-release dates.

    Details and recommended actions
    • Affected product and prerequisites: WordPress plugin Prime Mover - Backup and Migration, version 2.2.1 and earlier. An unauthenticated actor can submit a crafted base64-encoded serialized value via the ordinary WordPress comments endpoint. Exploitation of the deserialization path then requires an administrator to perform a migration export or restoration that processes the stored comment.
    • CVE, score and impact: CVE-2026-115806, rated Critical at CVSS v3.1 9.8 by Wordfence Intelligence (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Unrestricted unserialize() in migration search-and-replace processing and a POP gadget chain shipped in bundled Freemius code could permit malicious WordPress option operations and compromise. Comment submission alone does not demonstrate immediate code execution.
    • Exploitation: The first-party vulnerability record does not confirm in-the-wild abuse, a particular compromised website, or any disclosed personal-data breach.
    • Fix and mitigation: As of the Wordfence record's October 24 update, it explicitly states that no patched version is known. Prioritize deactivating and uninstalling affected plugin installations or switching to an alternative, and avoid exports/restores that process untrusted comments. Blocking new comments alone does not remove previously stored payloads. Update this existing advisory if a fixed release is subsequently confirmed.

  • Laravel TokenGuard API token authentication bypass (CVE-2026-114509, CVSS v4.0 9.2)

    Advisory · Reviewed:

    Official disclosure: The Laravel maintainers published GHSA-f9x3-7vq9-cph6 on October 19, 2026; this October 24 review does not represent a new breach or patch release.

    Details and recommended actions
    • Affected product and prerequisites: laravel/framework versions below 12.68.0 and versions 13.0.0 through 13.28.x. The issue depends on using the standard token-based API guard backed by TokenGuard under certain MySQL or MariaDB configurations.
    • CVE, score and impact: CVE-2026-114509; the Laravel maintainer advisory rates it CVSS v4.0 9.2 (Critical). A crafted non-string credential can bypass the API-token lookup and allow an unauthenticated attacker to impersonate an existing user without that user's valid token.
    • Exploitation: The first-party advisory documents the issue but does not establish exploitation in the wild, a specific victim, or confirmed data disclosure.
    • Fixed releases and response: Update to Laravel 12.68.0 or 13.29.0 or newer within the supported branch. Review TokenGuard, API authorization, and database configuration, and migrate unsupported release lines to a supported fixed branch. Patch publication does not prove deployment.

  • Okta Access Gateway admin-console command execution (CVE-2026-115547, CVSS 9.1)

    Advisory · Reviewed:

    Official disclosure: Okta published its security advisory on October 22, 2026. The October 24 review does not indicate a newly confirmed breach.

    Details and recommended actions
    • Affected product and prerequisites: Okta Access Gateway appliance versions earlier than 2026.10.2. Exploitation requires an authenticated administrator with access to the OAG Admin Console; this is not an unauthenticated remote command-execution flaw.
    • CVE, score and impact: CVE-2026-115547. Okta assigns CVSS v3.1 9.1 (Critical). Specially formatted configuration values can bypass input validation and allow a privileged administrator to execute system commands in the OAG service account context.
    • Exploitation: Okta's published advisory does not establish exploitation in the wild or a confirmed breach of a specific customer.
    • Fixed release and response: Upgrade Okta Access Gateway to 2026.10.2 or later and review admin-console access controls and management activity logs. Release availability is distinct from installation status.

  • Pillow FlashPix image decoding heap overflow and possible RCE (CVE-2026-112398; fixed in 13.0.0)

    Advisory · Reviewed:

    Official disclosure: Pillow maintainers published GHSA-5x8w-8jj5-q52h on October 17, 2026. This October 24 review is not a new attack or release date.

    Details and recommended actions
    • Affected product and prerequisites: Pillow 12.3.0 and earlier when the optional olefile dependency enables FlashPix (FPX) decoding and an application parses attacker-controlled image uploads with Image.open() or related code. Detection is based on file contents rather than the filename extension.
    • CVE, severity and impact: CVE-2026-112398. The original maintainer GHSA labels this Critical but does not specify a numeric CVSS score or version in the cited maintainer text. FPX JPEG-tile decoding can write beyond a heap buffer and may execute code with the privileges of the image-processing service.
    • Exploitation: The published researcher reproducer demonstrates the flaw, but the cited primary advisory does not confirm in-the-wild exploitation or a victim-specific data breach.
    • Fix and mitigation: Upgrade to Pillow 13.0.0 or later. Inventory upload, thumbnail, and conversion paths handling untrusted files, check whether olefile is installed, and avoid processing untrusted FPX files until patched.

  • Wasmtime Cranelift compiler sandbox escape (CVE-2026-115889, CVSS 9.9)

    Advisory · Reviewed:

    Official disclosure: Wasmtime maintainers published GHSA-897f-g5gm-fmxm on October 19, 2026. The October 24 review is not a new exploitation or incident date.

    Details and recommended actions
    • Affected product and prerequisites: Wasmtime versions below 36.0.19 and versions 37.0.0 through 42.x, using the Cranelift compiler backend, including default configurations, to compile or run specially crafted large WebAssembly functions. The advisory does not limit the risk to one host architecture or OS.
    • CVE, score and impact: CVE-2026-115889. The Wasmtime maintainer advisory rates it CVSS v3.1 9.9 (Critical). Packed SSA value indices may overflow and cause incorrect code generation, potentially enabling type confusion and a WebAssembly sandbox escape.
    • Exploitation: The vendor describes a possible sandbox escape, but the reviewed official report does not confirm exploitation in the wild or a victim-specific data breach.
    • Fixed releases and response: Upgrade to Wasmtime 36.0.19 on its maintenance line or 43.0.0 or later; review trust boundaries and host privileges for untrusted Wasm execution. A released fix does not mean a deployment is already patched.

  • OpenCode MCP OAuth remote command execution on Windows and WSL (no CVE; fixed in 1.18.33)

    Advisory · Reviewed:

    Disclosure and timeline: Security researcher Pillar Security published its findings on October 19, 2026. OpenCode developer Anomaly released version 1.18.33 on September 28, 2026. This review on October 24 does not represent a new attack, disclosure, or patch release.

    Details and recommended actions
    • Product and prerequisites: OpenCode AI coding agent (opencode-ai npm package) versions 1.0.137 through 1.18.32 running on Windows or Windows Subsystem for Linux (WSL), during OAuth authentication with a remote MCP server controlled or compromised by an attacker. According to the researchers, macOS and native Linux are not affected by this Windows PowerShell execution path.
    • Vulnerability, score and impact: A remote MCP server's OAuth authorization_endpoint value can reach PowerShell without safe escaping during browser launch, potentially allowing commands to execute with the developer's privileges without further user interaction or AI-model consent. No CVE has been assigned. Pillar Security proposed a CVSS v3.1 base score of 9.8 (Critical); it is not an official CNA or vendor rating.
    • Exploitation status: The researchers reproduced the issue and documented vendor disclosure, but the reviewed first-party sources do not establish exploitation in the wild or a confirmed organizational data breach.
    • Fix and mitigation: Upgrade OpenCode to 1.18.33 or later. Inventory Windows and WSL installations and connected remote MCP servers, avoid untrusted endpoints, and review developer-machine activity and credentials where suspicious connections occurred. A published vendor fix does not establish that any individual installation has applied it.

  • AgenticSeek exposed Flask debugger may enable remote code execution (CVE-2026-115727)

    Advisory · Reviewed:

    Disclosure and fix timeline: VulnCheck, acting as CNA, published the CVE on October 23, 2026 at 20:36 JST. The developer merged PR #558 on October 15, including commit 409840c disabling the affected Flask debug mode. The review date does not represent the date of the vulnerability's introduction.

    Details and recommended actions
    • Product and affected versions: AgenticSeek code before developer commit 409840c. The llm_server/app.py service runs Flask in debug mode while binding to all network interfaces. Exploitation requires the affected service port to be reachable; formal affected package and fixed release version numbers remain unverified.
    • CVE and CVSS: CVE-2026-115727. VulnCheck CNA CVSS v4.0 base score 9.2 (Critical), and CVSS v3.1 base score 8.1 (High). The CVSS v4.0 vector identifies additional attack requirements; unconditional unauthenticated code execution is not asserted.
    • Impact and exploitation status: An attacker who reaches the Werkzeug debugger and derives or obtains its PIN could run Python or operating system commands with llm_server privileges. The reviewed CNA and developer records do not confirm exploitation or a particular organization's data breach.
    • Fix and mitigation: Adopt code including the developer's October 15 commit 409840c or later, avoid any network exposure of a debugging server, and check running deployments, access logs, and service privileges. Do not infer a specific patched package version.

  • Unauthenticated Fortinet FortiSIEM command execution (CVE-2026-106173, CVSS v3.1 9.4)

    Advisory · Reviewed:

    Disclosure and follow-up: Fortinet, as CNA, published its CVE record on October 13, 2026 at 17:37 UTC (October 14 at 02:37 JST). The Canadian Centre for Cyber Security updated advisory AV26-1037 on October 23. October 24 is the current review date, not a new disclosure or breach date.

    Details and recommended actions
    • Product and affected versions: FortiSIEM 7.5.0, 7.4.0 through 7.4.2, 7.3.0 through 7.3.5, 7.2.0 through 7.2.7, 7.1.0 through 7.1.9, and 7.0.0 through 7.0.4, as listed by the Fortinet-issued CVE. Check the vendor PSIRT for the fixed release applicable to each maintained branch.
    • CVE, severity and conditions: CVE-2026-106173, Fortinet CNA CVSS v3.1 base score 9.4 (Critical). Crafted network packets may exploit path traversal to execute unauthorized code or commands without authentication.
    • Exploitation status: The Canadian government's October 23 update cites open-source reporting of exploitation in the wild. The reviewed records do not independently establish Fortinet confirmation of a specific organizational breach or leaked records. A CISA-ADP proof-of-concept assessment is not a CISA Known Exploited Vulnerabilities catalog listing.
    • Fix and action: Canada's advisory lists FortiSIEM versions prior to 7.5.1 as affected and urges updates. Apply the vendor security fix for the installed version branch, restrict network exposure, and examine logs for compromise indicators. Do not treat 7.5.1 as the fixed release for every historical branch.

  • Unauthenticated arbitrary file access in eight Atlassian Data Center products (CVE-2026-21589, CVSS v4.0 9.3)

    Advisory · Reviewed:

    Official disclosure: Atlassian published the advisory and fixed versions on October 5, 2026; October 24 is this database review date, not the original disclosure or an incident date.

    Details and recommended actions
    • Affected products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye on unpatched self-managed release lines. Atlassian states it has already patched the affected Cloud services.
    • CVE and severity: CVE-2026-21589, Atlassian-rated CVSS v4.0 base score 9.3 (Critical). The vulnerability permits unauthenticated access to particular files under the application web root; the original notice does not establish arbitrary remote code execution.
    • Prerequisites and exploitation: The attacker must already know the exact target filename and path. Directory listing or enumeration is not provided. Sensitive files may be present in some deployments. Atlassian's October 5 no-exploitation-evidence statement concerned Cloud products. The subsequent official CISA-ADP CVE record confirms addition to the Known Exploited Vulnerabilities catalog on October 15, 2026. Specific affected organizations or exposed-record totals are not established here.
    • Fixed versions: Bitbucket 9.4.26, 10.2.8 or 10.5.1; Confluence 9.2.26 or 10.2.19; Jira Service Management 5.12.40, 10.3.26 or 11.3.12; Jira Software 9.12.40, 10.3.26 or 11.3.12; Bamboo 10.2.24 or 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4; Crucible 4.9.15; Fisheye 4.9.15. Upgrade on the applicable release line.
    • Mitigation and verification: Restrict external exposure until patched, consider Atlassian's specified WAF or URL-rewrite mitigations, and review access logs for suspicious file-path requests. Actual patch deployment must be verified separately.

  • Actively exploited unauthenticated RCE in F5 BIG-IP APM OAuth configurations (CVE-2026-94127, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Disclosure and verification: F5 published K000162605 on September 22, 2026 and JPCERT/CC issued an alert on September 24; October 24 is only this review date. The F5 original could not be read directly here; the JPCERT/CC and Canadian government original notices were checked.

    Details and recommended actions
    • Affected builds and prerequisites: Unpatched BIG-IP APM 21.1.0, 17.5.0–17.5.1 and 17.1.0–17.1.3 deployments with an APM access policy and OAuth profile on a virtual server where APM acts as an OAuth Authorization Server. OAuth Client or Resource Server-only configurations do not meet the stated requirement.
    • CVE and scoring: CVE-2026-94127, heap-based buffer overflow. Public security authorities report CVSS v3.1 base score 9.8 and CVSS v4.0 base score 9.3; the two scoring versions are not interchanged.
    • Impact and exploitation: Crafted network traffic may lead to unauthenticated remote code execution. JPCERT/CC states F5 has observed real-world exploitation. Specific victim organizations and exposed-record numbers are not established by these notices.
    • Fixed builds: Apply the compatible F5 hotfix. Canada's official advisory names Hotfix-BIGIP-21.1.0.2.0.30.22-ENG for 21.1, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG for 17.5, and Hotfix-BIGIP-17.1.3.5.0.41.14-ENG for 17.1. Recheck compatibility and up-to-date vendor instructions.
    • Interim response: Consider F5's temporary mitigation iRule if an immediate patch is impossible. Preserve evidence and inspect repeated OAuth UserInfo failures, OAuth failure counters, audit logs, and TMM core files for signs of compromise.

  • Reportedly exploited unauthenticated Windows Netlogon RCE on domain controllers (CVE-2026-41089, CVSS v3.1 9.8)

    Advisory · Reviewed:

    Disclosure and follow-up: Microsoft released its fixes on May 12, 2026. CERT-EU issued a June 10 warning citing exploitation reported by Belgium's cybersecurity authority. October 24 is this database review date, not the original occurrence.

    Details and recommended actions
    • Affected platforms and requirements: Unpatched Windows Server 2012 and 2012 R2, 2016, 2019, 2022, 2022 23H2 and 2025 systems operating as domain controllers. This does not establish equivalent exposure for every Windows workstation or member server. Extended security update eligibility depends on product lifecycle conditions.
    • CVE and CVSS: CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon. NHS England and other official sources report a CVSS v3.1 base score of 9.8.
    • Impact and exploitation: An unauthenticated network attacker may achieve SYSTEM-level code execution on a vulnerable domain controller. CERT-EU and NHS England relay Belgium's exploitation report; that should not be confused with an independent Microsoft confirmation. No specific victim organization or leaked-record count is established.
    • Fix and response: Deploy the appropriate May 2026 or later Windows Server cumulative security update and verify patch and restart completion. Match the release, KB and fixed build to each deployment using Microsoft's Security Update Guide.
    • Interim mitigation: Restrict unnecessary access to domain controllers and monitor Netlogon events as well as anomalous authentication and administrative actions. Network controls do not replace patching.

  • Actively exploited PAN-OS GlobalProtect authentication bypass (CVE-2026-0257, CVSS v4.0 7.8)

    Advisory · Reviewed:

    Disclosure and updates: Palo Alto Networks published CVE-2026-0257 on May 13, 2026, and updated its security advisory on June 3. Unit 42 reported exploitation by Qilin and Inc ransomware operators in its October 19 update, with further guidance on October 20. This is not misrepresented as a newly disclosed October 24 vulnerability.

    Details and recommended actions
    • Product and prerequisites: The issue involves authentication override cookies on GlobalProtect portals or gateways with the specific certificate configuration described in the vendor advisory. Attackers may bypass authentication and establish unauthorized VPN sessions. Panorama and Cloud NGFW are not affected.
    • CVE and scoring: CVE-2026-0257; Palo Alto Networks vendor CVSS v4.0 base score 7.8 (High), suggested urgency HIGHEST and exploit maturity ATTACKED. No unverified CVSS v3.1 score is supplied.
    • Affected and fixed versions: Relevant unpatched PAN-OS 12.1, 11.2, 11.1, and 10.2 builds and affected Prisma Access 11.2 and 10.2 releases. Examples of fixed releases are PAN-OS 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6 and Prisma Access 11.2.7-h13 or 10.2.10-h36. Consult the vendor Product Status table for the exact branch-specific hotfix levels.
    • Exploitation and potential impact: Unit 42 has observed exploitation since June 2026 and linked recent activity to Qilin and Inc ransomware operators. Compromised VPN access can lead to internal reconnaissance, credential theft, lateral movement and virtualization-layer compromise. Not all probes established VPN sessions; no verified victim or exposed-record totals are asserted.
    • Fixes and mitigations: Update every affected GlobalProtect portal and gateway to a compatible fixed build. Pending updates, disable authentication override or assign a new certificate dedicated to authentication override cookies. Review VPN and MFA records and investigate unexpected management-interface exposure or compromise indicators.

  • Actively exploited Cisco ISE/ISE-PIC authentication bypass (CVE-2026-76460, CVSS 10.0)

    Advisory · Reviewed:

    Official disclosure: Cisco published this advisory at 16:00 GMT on September 16, 2026 (01:00 JST on September 17). It is not an October 24 vulnerability occurrence.

    Details and recommended actions
    • Affected products and versions: Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), regardless of configuration. Unpatched builds in ISE 3.1 to 3.5 release lines are affected. ISE 3.0 is out of maintenance; ISE-PIC 3.4 is the last supported release line.
    • CVE and CVSS: CVE-2026-76460, Cisco PSIRT CVSS v3.1 base score 10.0. The API endpoint has insufficient authentication checks.
    • Potential impact and exploitation: An unauthenticated remote attacker can craft an API request to bypass administrative authentication, gain device access and potentially execute code as root. Cisco PSIRT confirms real-world exploitation, but this advisory does not establish specific victim organizations or exposed-record totals.
    • Fixed releases and response: Upgrade to ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4 or later. There is no complete workaround. Restrict management/control-plane traffic with infrastructure ACLs as mitigation, inspect access.log on every node and external firewall/network logs, and consider re-imaging suspected compromised nodes.

  • Six Cisco ISE/ISE-PIC REST API vulnerabilities (maximum CVSS 10.0)

    Advisory · Reviewed:

    Official disclosure: Cisco published these vulnerabilities on September 16, 2026 at 16:00 GMT (September 17 at 01:00 JST), not as an October 24 incident.

    Details and recommended actions
    • Products and affected versions: CVE-2026-76423, CVE-2026-76426 and CVE-2026-76428 affect ISE and ISE-PIC. CVE-2026-76424, CVE-2026-76425 and CVE-2026-76427 affect ISE only. All can apply regardless of configuration, but vulnerable builds differ by CVE.
    • CVEs and Cisco CVSS v3.1 base scores: CVE-2026-76423 (10.0, unauthenticated REST API administrator access); CVE-2026-76424 (7.2, authenticated arbitrary file access and root execution); CVE-2026-76425 (7.6, authenticated SQL injection and SSRF); CVE-2026-76426 (4.9, monitoring database disclosure); CVE-2026-76427 (4.9, XXE file access); and CVE-2026-76428 (4.9, session database disclosure).
    • Impact and exploitation: Authentication bypass, database or file exposure, SQL injection and possible root execution. These six independent CVEs are separate from exploited CVE-2026-76460. Cisco PSIRT reports no known public exploitation or malicious use of these six CVEs.
    • Fixed releases and response: CVE-2026-76423 is fixed by ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. For the remaining five, 3.1/3.2 users must migrate to a fixed branch; use 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4 or later as appropriate. There are no complete workarounds.

  • body-parser compressed request handling permits unauthenticated DoS (CVE-2026-111181)

    Advisory · Reviewed:

    Publication: Maintainer advisory published October 22 and added to GitHub Advisory Database October 23, 2026.

    Details and recommended actions
    • Affected versions and prerequisites: body-parser 1.x before 1.20.9 and 2.0.0 through versions below 2.4.0; exposure requires middleware that inflates compressed HTTP request bodies.
    • CVE, score and impact: CVE-2026-111181, GitHub Advisory Database CVSS v3.1 7.5. Trailing data after a valid compressed frame can cause an unhandled stream error and crash a Node.js process. An unauthenticated request may trigger this before route matching.
    • Exploitation: The vendor describes the issue and patch but provides no verified real-world exploitation or victim incident.
    • Fix and workaround: Upgrade to body-parser 1.20.9 or 2.4.0 or newer in the corresponding major release. If compressed request bodies are unnecessary, set inflate: false.

  • Happy DOM ESM import-alias injection may execute host code (CVE-2026-115895; CVSS 8.8)

    Advisory · Reviewed:

    Publication: Maintainer advisory first published October 20 and updated October 23, 2026; review time is not a newly observed compromise.

    Details and recommended actions
    • Affected releases and prerequisites: happy-dom 17.0.0 through 21.0.3. The risk applies when JavaScript evaluation is enabled and untrusted HTML or ESM module source reaches a server-side DOM renderer, preview, scraper, or similar service.
    • CVE, score and impact: CVE-2026-115895, CVSS v3.1 8.8 in GitHub Advisory Database. An unvalidated ESM import alias can become executable host JavaScript, potentially reaching Node.js files, environment data, or host commands. This is a distinct remaining injection path from CVE-2026-33943.
    • Exploitation: The maintainer describes a reproducible test; no real-world victims or confirmed exploitation are established by the source. Do not count it as a data-breach incident.
    • Fix and response: GitHub's patched-version metadata lists 21.0.4; upgrade to 21.0.4 or newer and avoid executing untrusted HTML. The detailed description still contains an older no-patch statement, so verify the release and deployed version.

  • Microsoft MSAL Node auth-code flow may disclose data over network (CVE-2026-109461)

    Advisory · Reviewed:

    Publication: Microsoft library maintainer published the advisory October 16; GitHub Advisory Database added and reviewed it October 23, 2026.

    Details and recommended actions
    • Affected versions and prerequisites: @azure/msal-node 5.0.0-beta.0 to below 7.1.0, when using the OAuth authorization-code flow through acquireTokenByCode.
    • CVE, score and impact: CVE-2026-109461, GitHub Advisory Database CVSS v3.1 7.5. An origin-validation error may disclose authorization-code flow parameters to an attacker-controlled network endpoint.
    • Exploitation: The reviewed source does not identify confirmed exploitation or victim-specific data leakage.
    • Fix and workaround: Upgrade @azure/msal-node to 7.1.0 or later. Until then, pass only the auth_code value to acquireTokenByCode, as recommended by the maintainer.

  • Strands Agents SDK A2A session isolation flaw may expose other users' conversations (CVE-2026-115419)

    Advisory · Reviewed:

    Publication: AWS Security Bulletin 2026-146-AWS was published October 22, 2026 in US time; the GitHub advisory was reviewed October 23. These are disclosure dates, not victim dates.

    Details and recommended actions
    • Products and affected versions: strands-agents Python versions containing multiagent.a2a below 1.43.0, and @strands-agents/sdk for TypeScript below 1.5.0, when the A2A server is reachable by multiple users or tenants.
    • CVE, score and impact: CVE-2026-115419, GitHub Advisory Database CVSS v4.0 8.6. An authenticated remote caller may read another caller's conversation history or influence another session because of insufficient A2A context isolation (CWE-488). The advisory does not claim unauthenticated exploitation.
    • Exploitation: The vendor bulletin does not identify confirmed exploitation or victim-specific leakage. This is a preventive advisory, not an additional confirmed incident.
    • Fix and mitigation: Upgrade Python strands-agents to 1.43.0 or TypeScript @strands-agents/sdk to 1.5.0 or later. Before patching, do not expose an A2A instance to multiple users or tenants; isolate instances per caller or tenant.

  • undici fetch crashes on excessive content-encoding responses (CVE-2026-109869)

    Advisory · Reviewed:

    Publication: undici maintainer published its advisory October 15; GitHub Advisory Database reviewed the report October 23, 2026.

    Details and recommended actions
    • Affected releases and prerequisites: undici 6.23.0 to below 6.29.1, 7.18.0 to below 7.30.1, and 8.0.0 to below 8.12.2. The application must fetch a response from an attacker-controlled or compromised server.
    • CVE, score and impact: CVE-2026-109869, CVSS v3.1 7.5 in GitHub Advisory Database. More than five content encodings followed by an early close can trigger an unhandled internal stream error and terminate the Node.js process.
    • Exploitation: The maintainer identifies the flaw and patch but does not provide confirmed victim incidents or real-world exploitation in the reviewed text.
    • Fix and response: Upgrade undici to 6.29.1, 7.30.1, or 8.12.2 or later. No complete workaround is listed. Verify the version bundled with the deployed Node.js release separately.

  • vLLM multimodal request options can exhaust service memory (CVE-2026-114055)

    Advisory · Reviewed:

    Publication: Maintainer disclosure October 6, 2026, updated and reviewed in GitHub Advisory Database October 23. It is not a newly confirmed attack.

    Details and recommended actions
    • Affected versions and prerequisites: Python vllm 0.7.3 to below 0.31.0. The API permits per-request mm_processor_kwargs that can influence image and video processor allocations; remote exposure depends on the deployment's API authentication and access controls.
    • CVE, score and impact: CVE-2026-114055, CVSS v3.1 7.5 in GitHub Advisory Database. A crafted request may exhaust CPU or GPU memory and terminate a shared API worker or service (denial of service).
    • Exploitation: The vendor identifies the vulnerability but does not establish confirmed exploitation or leaked information in an affected organization.
    • Fix and response: Update vLLM to 0.31.0 or later. Before updating, restrict API access and reject or tightly control caller-provided mm_processor_kwargs.

  • Critical Citrix NetScaler ADC/Gateway vulnerabilities: eight CVEs, two exploited

    Advisory · Reviewed:

    Original disclosure: Citrix/Cloud Software Group published CTX697096 on September 27, 2026. October 24 is a review date, not a new attack date.

    Details and recommended actions
    • Affected builds: Customer-managed NetScaler ADC/Gateway before 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37 or 13.1-FIPS/NDcPP 13.1-37.279; related Secure Private Access Hybrid deployments are also in scope. Preconditions vary across CVEs.
    • CVEs and vendor CVSS v4.0 base scores: CVE-2026-88771 (9.5; unauthenticated command execution with default configuration), CVE-2026-88772 (9.5; RCE/DoS with DTLS), CVE-2026-88773 (9.3; HTTP request smuggling), CVE-2026-88774 (7.0; HTTP URL policy bypass), CVE-2026-88775 (8.8; Gateway/AAA memory overflow), CVE-2026-88776 (8.8; Oracle-type load balancer memory overflow), CVE-2026-88777 (8.8; non-HTTP L7/NAT memory overflow), CVE-2026-88778 (8.8; TCP sequence number prediction).
    • Exploitation: Citrix confirms exploitation of CVE-2026-88771 and 88772 on unmitigated devices. The vendor bulletin does not verify individual breach victims, exposed-person counts or exploitation of the other six issues.
    • Fix and response: Updates for the eight issues start at 14.1-73.37, 13.1-64.23 and corresponding FIPS variants. For subsequent CVEs, deploy at least 14.1-73.46 or 13.1-64.29 and relevant FIPS builds. Inspect DTLS, HTTP, VPN/AAA, LB/CS and TCP settings, including Enhanced ISN Generation for CVE-2026-88778. Patch availability does not mean installation is complete.

  • NetScaler SAML denial-of-service CVE-2026-88779 (CVSS 8.7)

    Advisory · Reviewed:

    Original publication: Citrix published CTX697174 on October 3, 2026 (PST), not October 24.

    Details and recommended actions
    • Affected builds and prerequisites: Customer-managed NetScaler ADC/Gateway configured as a SAML SP or IdP; versions before 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41 or 13.1-FIPS/NDcPP 13.1-37.282.
    • CVE and rating: CVE-2026-88779 can cause a remotely triggered memory-overflow denial of service. Citrix CVSS v4.0 base score 8.7 (AV:N, PR:N, UI:N). The vendor bulletin does not confirm in-the-wild exploitation or victim-specific breaches.
    • Fixed releases and action: 14.1-73.41, 13.1-64.28 and matching FIPS/NDcPP builds are available. Inspect SAML configuration and deployed versions; later updates in CTX697191 address subsequent defects. Availability is not evidence of deployment.

  • Critical NetScaler SAML RCE/DoS CVE-2026-107406 (CVSS 9.5)

    Advisory · Reviewed:

    Initial disclosure: Citrix published CTX697191 on October 8, 2026; it did not originate on October 24.

    Details and recommended actions
    • CVE, score and impact: CVE-2026-107406 involves memory corruption that could cause RCE or denial of service in NetScaler ADC/Gateway. Citrix CVSS v4.0 base score 9.5 (AV:N, AC:H, PR:N, UI:N). The bulletin does not establish real-world exploitation or breach victims.
    • Preconditions: SAML is required. Intermediate builds 14.1-73.37 through 73.41, 13.1-64.23 through 64.28 and corresponding FIPS builds are affected when configured as a SAML IdP; earlier affected versions require SAML SP or IdP. Consult vendor version-specific requirements.
    • Fixed releases: 14.1-73.46, 13.1-64.29, 14.1-FIPS 14.1-73.46 and 13.1-FIPS/NDcPP 13.1-37.283 or later. Check configurations and deploy updates; actual patch deployment has not been confirmed.

  • Siemens Industrial Edge App Publisher chained TLS validation and desktop RCE issues

    Advisory · Reviewed:

    Official disclosure and follow-up: Siemens ProductCERT SSA-968435 was published October 13, 2026. CISA republished ICSA-26-295-02 on October 22 and JVN included it in the October 23 ICS bulletin. The October 24 review date is not the original disclosure or an attack date.

    Details and recommended actions
    • Affected versions and prerequisites: Industrial Edge App Publisher prior to V1.27.9. CVE-2026-78556 permits server spoofing through improper TLS certificate validation. CVE-2026-78557 permits unescaped backend content to execute JavaScript with Node.js desktop integration, potentially escalating to code execution on a local developer machine. Exploitation depends on an attacker influencing the network/backend response and its display; it is not universal unconditional unauthenticated RCE.
    • CVSS: Siemens scores CVE-2026-78556 at v3.1 7.4 and v4.0 7.6, and CVE-2026-78557 at v3.1 8.3 and v4.0 7.7. Two CVEs are grouped in one advisory, separate from incident counts.
    • Fix and action: V1.27.9 or newer is released. Update the App Publisher, restrict management connectivity to trusted networks and review suspicious activity on developer endpoints. The reviewed vendor bulletin did not establish exploitation in the wild or a breach at a named organization.

  • Siemens Industrial Edge device authorization and path traversal flaws; some devices lack fixes

    Advisory · Reviewed:

    Official publication: Siemens ProductCERT SSA-832641 was issued October 13, 2026; CISA republished ICSA-26-295-17 on October 22 and JVN referenced it October 23. October 24 is the review date, not a new exploitation date.

    Details and recommended actions
    • CVEs and conditions: CVE-2026-44414 scores CVSS v3.1 6.8 and v4.0 6.9, while CVE-2026-44415 scores v3.1 9.1 and v4.0 8.9 (Siemens). Authenticated users with elevated privileges can exploit inadequate internal API/path restrictions to access sensitive information and, in the latter case, potentially delete data. Neither unauthenticated RCE nor a real-world breach was confirmed.
    • Affected devices and fixes: Industrial Edge Cloud, Own and Virtual Device releases before V1.28.1 are affected by CVE-2026-44414 and can be updated to V1.28.1 or newer. Selected SIMATIC IPC and IoT2050 variants have different fixed releases such as V3.2.0-17 or V1.28.1-2. Various SIMATIC HMI Unified Comfort and SIPLUS HMI panels affected by CVE-2026-44415 had no patch at the time of vendor publication.
    • Action: check the official model-by-model advisory, deploy available firmware updates, and restrict network access to trusted administrators for unpatched devices. Review account permissions and access logs. These two CVEs form one advisory and do not represent a known organization-specific incident.

  • Eleven Siemens RUGGEDCOM CROSSBOW issues including SQL injection and admin credential exposure

    Advisory · Reviewed:

    Published by Siemens ProductCERT as SSA-508506 on October 13, 2026; CISA republished ICSA-26-295-12 on October 22 and JVN referenced it October 23. The October 24 review date is not a breach or first disclosure date.

    Details and recommended actions
    • Scope and CVEs: RUGGEDCOM CROSSBOW releases before V6.0 are affected by eleven issues: CVE-2026-89196, 89197, 89198, 89199, 89200, 89201, 89202, 89203, 89204, 89205 and 89206. Depending on the flaw, consequences include SQL injection, exposure of administrative credentials or device configurations, privilege escalation, unauthorized operations and denial of service.
    • Prerequisites and scoring: high-impact CVE-2026-89196 through CVE-2026-89199 require an authenticated user with specific or lower privileges and access to affected features. Siemens assigns maximum advisory scores of CVSS v3.1 8.8 and v4.0 8.7; this is not a blanket unauthenticated SQL execution vulnerability.
    • Remediation: upgrade to released version V6.0 or newer, restrict management network access, audit activity and rotate credentials where warranted. The cited bulletin does not establish active exploitation or a named victim. Eleven CVEs are recorded as one preventive advisory, not eleven incidents.

  • SolarWinds Observability Self-Hosted broken authorization (CVE-2026-28328, CVSS 8.8)

    Advisory · Reviewed:

    Official publication: SolarWinds first published CVE-2026-28328 on October 20, 2026; the Canadian Centre for Cyber Security issued its alert on October 21.

    Details and recommended actions
    • Product and affected versions: SolarWinds Observability Self-Hosted 2026.2.3 and earlier per the vendor. The Canadian advisory recommends updating versions prior to 2026.4; this is not an assertion of additional vendor-confirmed affected builds.
    • CVE, vendor score and prerequisites: CVE-2026-28328, SolarWinds 8.8 High, with a CVSS v3.1-style published vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation requires a low-privileged authenticated account; this is not unauthenticated access.
    • Potential impact and exploitation: Users with limited privileges may access or modify information beyond assigned rights. The reviewed notices do not establish confirmed exploitation or an organization-specific data breach.
    • Fixed version and response: Update to the published SolarWinds Observability Self-Hosted 2026.4 release, then verify role permissions and audit access by low-privileged accounts. The notice specifies no dedicated workaround.

  • Four critical and high-severity Splunk Enterprise hardening CVEs (maximum CVSS 9.9)

    Advisory · Reviewed:

    Official publication: Splunk published SVD-2026-1008 on October 21, 2026; the disclosure is not misdated as an October 24 occurrence.

    Details and recommended actions
    • Product and affected versions: Splunk Enterprise 10.4.0–10.4.3, 10.2.0–10.2.7, 10.0.0–10.0.10, and 9.4.0–9.4.15. The advisory does not specify uniform exploitation prerequisites and does not establish unauthenticated RCE for every deployment.
    • CVEs and vendor CVSS v3.1: CVE-2026-76299 (9.9, access control); CVE-2026-76300 (8.8, resource lifetime control); CVE-2026-76301 (7.6, protection mechanisms); CVE-2026-76302 (9.9, improper neutralization). Each score is Splunk's highest score for the grouped CWE findings; four CVEs in total.
    • Potential impact and exploitation: Weaknesses in authorization, input handling and security controls may expose Splunk deployments. These are vendor-identified grouped findings; the reviewed official advisory does not establish confirmed exploitation, specific attack prerequisites, or any victim-specific data leak.
    • Fixed versions and response: Upgrade the respective release line to 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or later; verify deployed builds and access controls. The cited advisory does not specify a dedicated workaround.

  • Eight Splunk SOAR access-control and file-exposure vulnerabilities (maximum CVSS 9.9)

    Advisory · Reviewed:

    Official publication: Splunk published SVD-2026-1011 on October 21, 2026; the review timestamp does not represent a new October 24 incident.

    Details and recommended actions
    • Product and affected versions: Splunk SOAR versions below 8.7.0. Specific exploit prerequisites may differ; the advisory does not establish that every issue is remotely exploitable without authentication.
    • CVEs and Splunk CVSS v3.1 scores: CVE-2026-76407 (9.3), CVE-2026-76408 (8.8), CVE-2026-76526 (8.8), CVE-2026-76527 (5.5), CVE-2026-76528 (6.2), CVE-2026-76529 (7.5), CVE-2026-76530 (8.8), and CVE-2026-76531 (9.9). Eight CVE groups cover vendor-identified findings organized by CWE category.
    • Potential impact and exploitation: Access-control failures, exposure of externally accessible files, unsafe path authorization, and input handling could compromise SOAR systems. The reviewed vendor advisory does not confirm exploitation or any organization-specific breach.
    • Fixed versions and response: Upgrade to Splunk SOAR 8.7.0 or later. Verify external reachability, application privileges, file access controls, and audit records. No dedicated workaround is specified in the official notice.

  • Actively exploited unauthenticated SQL injection in Metabase (CVE-2026-72898, CVSS 10.0)

    Advisory · Reviewed:

    Official disclosure and follow-up: Metabase published this vulnerability on August 6, 2026. JPCERT/CC published a dedicated alert on August 14 and still referenced this CVE in its domestic-intrusion warning updated October 23. The original August disclosure is not represented as a new October 24 incident.

    Details and recommended actions
    • Product and affected configurations: Unpatched self-hosted Metabase installations on release families 58 through 63. The vendor says versions below 58 are not affected and Metabase Cloud has been patched. Individual deployments must still be checked.
    • CVE and severity: CVE-2026-72898. Metabase's GitHub Security Advisory rates the issue CVSS v3.1 10.0 (Critical). This advisory concerns one CVE, distinct from other Metabase issues.
    • Conditions and impact: Malicious requests through an unauthenticated password-reset API endpoint can lead to SQL injection in the Metabase application database, granting administrator access and enabling theft or export of data and credentials for connected databases.
    • Exploitation: Metabase confirmed real-world zero-day exploitation. This does not establish that every organization using Metabase suffered a breach or that unverified data-loss totals are known.
    • Fixes and workaround: Upgrade to at least 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 or 0.63.5 in the corresponding release family. Until updating is possible, block public access to /api/session/reset_password. Patches are available, but deployment is not presumed.
    • Recommended response: Inventory exposed Metabase instances and review suspicious POST /api/session/reset_password (HTTP 400) followed by GET /api/user/current (HTTP 200), administrator changes, API keys, warehouse access, and query history. If exposure is suspected, invalidate user sessions and rotate connected-database credentials.
    • Counting: One preventive advisory about one CVE, with no fabricated company-specific breach or LEAK record.

  • Separate PHP session-upload-progress RCE risk CVE-2026-115560, patch not yet released

    Advisory · Reviewed:

    Official disclosure: On October 23, 2026, the PHP development team disclosed CVE-2026-115560 as another potential remote code execution vector. It is distinct from the PHP2Shell issues CVE-2026-109618 and CVE-2026-109619 fixed on October 21; those releases are not known to contain a fix for this additional issue.

    Details and recommended actions
    • Conditions and impact: An application must configure session.serialize_handler as php_binary or php_serialize, dynamically change it to php with ini_set() before session_start(), and keep session.upload_progress.enabled active. This is an uncommon application configuration and does not represent unconditional RCE on all PHP sites, but may enable RCE where all conditions are met.
    • Affected versions, severity and exploitation: The reviewed PHP notice does not identify affected version boundaries, a released fixed version, a numeric CVSS version or score, or successful exploitation. Exploit attempts related to the two previously patched PHP2Shell CVEs must not be misattributed to this new one.
    • Fix and action: As of the October 23 notice, a patch had not yet been released. PHP plans a full advisory in the next regular bugfix release. Until then set session.upload_progress.enabled=0 in the applicable PHP or server configuration, restart workers as appropriate and verify the effective configuration. This setting alone is not a complete fix for the separate October 21 PHP2Shell vulnerabilities, which require upgrading to their already released fixed versions.
    • Counting: One preventive advisory for the distinct CVE-2026-115560. No confirmed organization-specific incident or data leakage is inferred.

  • Apache Pulsar Manager unauthenticated administration and credential disclosure (CVSS 10.0; no fix)

    Advisory · Reviewed:

    Official publication: The Apache CNA CVE record was published October 21, 2026 at 18:17 UTC (October 22 at 03:17 JST). This is not a confirmed intrusion date.

    Details and recommended actions
    • Affected versions: All Apache Pulsar Manager releases 0.1.0–0.4.0. This does not imply that Pulsar brokers or replacement administration UIs share the vulnerabilities.
    • CVE and score: CVE-2026-105944, Apache Software Foundation CVSS v4.0 base 10.0 (Critical). One advisory covering one CVE.
    • Preconditions and impact: An unauthenticated remote actor reaching the management console can abuse its initial administrator registration operation (0.3.0 onward). Inadequate authentication on proxied Pulsar admin API requests can expose configured cluster administration credentials to attacker-controlled hosts and authorize administrative operations. Exposure depends on deployment and credentials.
    • Exploitation: The reviewed Apache advisory does not establish a confirmed breach at an identified organization or affected persons; this does not demonstrate that exploitation is absent.
    • Fixed version and plan: Apache Pulsar Manager is end-of-life and completely unsupported. No fixed release or future security update is planned.
    • Recommended action: Discontinue and remove Pulsar Manager, migrate to a supported UI, restrict interim access to trusted administrators, and consider rotating exposed administrator tokens or signing keys and reviewing access logs.

  • Apache Traffic Server tsmemcache unauthenticated shared-cache access (CVSS 9.4)

    Advisory · Reviewed:

    Official publication: Apache CNA published the CVE at 19:17 UTC on October 21, 2026 (04:17 JST on October 22); this is not a compromise date.

    Details and recommended actions
    • Affected versions: Apache Traffic Server deployments enabling the experimental tsmemcache plugin, versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0. Other configurations are not presumed affected.
    • CVE and scores: CVE-2026-111811, Apache CNA CVSS v4.0 base 9.4 (Critical) and v3.1 base 9.0 (Critical). One advisory covering one CVE.
    • Preconditions and impact: Network access to the experimental tsmemcache plugin permits unauthenticated read, write and deletion of shared proxy cache entries, potentially exposing data, corrupting cached responses or disrupting service. Remote code execution is not established by this advisory.
    • Exploitation: The reviewed Apache CNA record does not report confirmed exploitation at identified victims or affected records. This is not evidence that no attacks exist.
    • Fixed releases and mitigation: Upgrade to 9.2.16, 10.1.5 or 10.2.1. The CNA record does not identify a fixed 8.x release. Disable the plugin or restrict it to trusted networks pending remediation.
    • Recommended action: Inventory enabled tsmemcache deployments and version lines, update to a fixed version and inspect cache access logs and external reachability.

  • onPhase Forms authentication bypass, OS command execution and SSRF (two CVEs; max CVSS 9.3)

    Advisory · Reviewed:

    Official publication: MON-CSIRT CNA released CVE-2026-19677 at 01:21 UTC (10:21 JST) and CVE-2026-19678 at 01:23 UTC (10:23 JST) on October 23, 2026. These are not incident timestamps.

    Details and recommended actions
    • Affected version: onPhase (formerly frevvo) Forms 11.0.14. Review public registration and form-service exposure; do not invent other affected ranges.
    • CVE and scores: CVE-2026-19677, MON-CSIRT CNA CVSS v4.0 9.3 (Critical); CVE-2026-19678, CVSS v4.0 8.7 (High). One grouped advisory with two CVEs.
    • Preconditions and impact: CVE-2026-19677 permits an unauthenticated remote attacker with valid tenant and existing user identifiers to manipulate public registration parameters, gain TenantAdmin and Designer roles and execute OS commands. CVE-2026-19678 permits unauthenticated SSRF from a public form to obtain internal Apache Solr data.
    • Exploitation: The primary CNA records do not substantiate confirmed exploitation at a specific organization or leaked-user totals; absence of confirmation is not proof attacks do not exist.
    • Fix and workaround: Both CNA records advise updating to 11.0.17. If immediate upgrade is impossible, block /frevvo/web/webapp/register and /frevvo/web/**/service at a reverse proxy or WAF. Version 11.0.17 removes unauthenticated registration, sandboxes rules and disables Document Service by default.
    • Recommended action: Inventory exposed instances and versions, verify remediation, review administrative credentials and investigate unusual registration, internal URL requests and command execution logs.

  • Seven CISA Malcolm vulnerabilities involving authentication bypass, SSRF and monitoring disruption

    Advisory · Reviewed:

    Publication: CISA first published ICSA-26-280-01 on October 7, 2026, and revised it October 15. Neither date establishes a successful intrusion.

    Details and recommended actions
    • Product and affected versions: The CISA Malcolm network-monitoring platform. Affected ranges vary by CVE. Fixes were introduced in v26.08.0 and v26.09.0; v26.09.0 or later addresses all seven.
    • CVEs: CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334.
    • Severity: CISA's maximum CVSS v3.1 base score is 8.1 (High; CVE-2026-107333). CVE-2026-107362 and CVE-2026-107337 each score 7.1; other issues have separate values.
    • Preconditions and impacts: Specific defects permit bypassing nginx authentication to impersonate an Arkime user, administrative RBAC bypass by authenticated low-privilege users, SSRF, operator-mediated CSRF that stops monitoring or deletes collected records, and disk exhaustion via compressed uploads. Requirements vary between CVEs.
    • Exploitation: The reviewed CISA primary notice does not confirm successful exploitation against an identified organization or establish victim counts.
    • Fix and mitigation: Upgrade to Malcolm v26.09.0 or newer. Restrict Arkime and management-port access, segment monitoring infrastructure, and check for disabled collection or missing forensic logs. One preventive advisory, not seven confirmed incidents.

  • DOM-based XSS in LINE LIFF SDK (CVE-2026-112148), patched in 2.31.1

    Advisory · Reviewed:

    Publication: LY Corporation updated its official security advisory October 20, 2026. A fix is available; no actual breach is asserted by this notice.

    Details and recommended actions
    • Affected releases: LINE LIFF SDK 2.20.0 through 2.31.0, before 2.31.1. Verify the SDK version loaded by the LIFF application itself.
    • CVE and severity: CVE-2026-112148, vendor CVSS v4.0 base score 5.1. This is not rated High or Critical but may expose authentication-related context.
    • Preconditions and impact: A user opening a crafted URL in an external browser may trigger DOM-based XSS in the affected LIFF app's origin. This could expose JavaScript-accessible authentication tokens or app data, or enable actions under the user's session.
    • Exploitation: The reviewed official developer advisory does not establish confirmed exploitation or a victim count.
    • Remediation: Upgrade LIFF SDK to 2.31.1 or later, update npm dependencies and lockfiles and redeploy, replace pinned CDN URLs or bundled SDK copies, and verify edge CDN content and caches. One preventive advisory; incident totals remain unchanged.

  • InterSystems IRIS for Health TLS configuration flaw may expose sensitive network traffic (CVE-2026-111594)

    Advisory · Reviewed:

    Primary disclosure: CISA published medical ICS advisory ICSMA-26-295-01 on October 22, 2026; this is a publication date, not a confirmed date of attack.

    Details and recommended actions
    • Affected versions listed by CISA: InterSystems IRIS for Health 2025.3.0.226, 2026.1.0.235 and 2026.2.0.221. Confirm whether the affected default configuration applies to each deployment.
    • CVE and severity: CVE-2026-111594, CWE-319, cleartext transmission of sensitive information. CISA assigns CVSS v3.1 base score 8.1 (High).
    • Prerequisites and impact: With SuperServer TLS/SSL disabled by default, an attacker positioned to observe network traffic could obtain sensitive transmissions and potentially reuse exposed credentials to authenticate. This is not an unauthenticated remote code-execution claim.
    • Exploitation and fixes: The advisory does not establish a named customer breach. No specific patched version or release time has been verified from these sources; do not infer one.
    • Mitigation: Follow InterSystems guidance and configure SuperServer TLS as Required rather than merely Enabled; verify certificates and client compatibility, restrict network exposure and inspect access records.

  • Nine Kiloview E3 NDI Encoder vulnerabilities: root command execution and authentication bypass

    Advisory · Reviewed:

    Primary disclosure: CISA published ICS advisory ICSA-26-295-01 on October 22, 2026; this is not necessarily the date the vendor made its firmware update available.

    Details and recommended actions
    • Products and affected versions: Kiloview E3 NDI Encoder firmware releases prior to version 1.30, per CISA. The vendor provides firmware V1.30; check model and configuration compatibility before deployment.
    • CVEs (nine): CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450 and CVE-2026-110825.
    • CVSS: CISA scores CVE-2026-110243 at 9.9, Critical, using CVSS v3.1. The nine flaws do not all share this score.
    • Prerequisites and impacts: An authenticated operator permitted to modify network configuration may execute operating system commands as root. A firmware-wide static JWT signing secret also allows forged privileged sessions and authentication bypass. Individual flaws have different prerequisites and impacts.
    • Exploitation: The primary notice does not establish successful exploitation in the wild. Lack of confirmation does not prove that no exploitation exists, nor does this advisory establish a confirmed breach.
    • Fix and mitigation: Review and deploy vendor firmware V1.30 when compatible, isolate the management interface from the public Internet, and inspect device credentials and logs.

  • Eight Siemens SIMATIC S7 PLC web-server vulnerabilities, with fixes under development

    Advisory · Reviewed:

    Primary disclosure: Siemens ProductCERT published SSA-591731 on October 13, 2026. Subsequent listings by national authorities do not change the original publication date or establish an incident date.

    Details and recommended actions
    • Affected systems: SIMATIC S7-1500 CPUs, SIMATIC Drive Controllers, ET 200SP Open Controllers, related SIPLUS models and S7-PLCSIM Advanced. Affected CVEs and version applicability vary by product; use the vendor matrix.
    • CVEs (eight): CVE-2026-63350, CVE-2026-63351, CVE-2026-63352, CVE-2026-63353, CVE-2026-63354, CVE-2026-63355, CVE-2026-63356 and CVE-2026-63357.
    • CVSS: Siemens ProductCERT reports maximum base scores of 9.6 under CVSS v3.1 and 9.4 under CVSS v4.0; these are not the individual scores of all eight issues.
    • Prerequisites and impacts: Malicious code may execute in the browser session of an authorized web-server user and permit PLC actions within that user's authorization. This is not a claim of unconditional unauthenticated root code execution on a PLC.
    • Exploitation and fixes: The vendor notice does not establish a successful breach or data leak at a named organization. As of the October 13 disclosure, fixes were under development and many listed affected products had no patch. Recheck the product matrix for changes.
    • Mitigations: Disable unnecessary web servers; limit TCP ports 80 and 443 to trusted IP addresses; accept only trusted trace files; restrict management access to qualified authorized personnel.

  • JPCERT/CC warns of API abuse and misuse of AI penetration-testing tools in intrusion attempts

    Advisory · Reviewed:

    Primary notice and update: JPCERT-AT-2026-0030 was first published October 8 and updated October 23, 2026. The latest revision added case E on attempts involving misused AI-enabled penetration-testing platforms and network indicators for case B on API abuse. Neither the publication date nor the review date proves an attack occurred that day.

    Details and recommended actions
    • Systems exposed: Internet-facing web applications, service and administration APIs, business intelligence and employee-management platforms, and publicly exposed WSUS servers. Cairn, CyberStrikeAI and ARTEX were named as tools misused in attack attempts, not as products known to contain vulnerabilities.
    • Attack patterns and impacts: Adversaries probe various known vulnerabilities and configuration flaws, attempt to retrieve exposed configuration or backup files, reverse-engineer public mobile applications for API endpoints and keys, and attempt permission changes, rogue-account creation or NoSQL injection. The cross-case warning does not establish one common CVE, one intrusion, or a successful breach at every target.
    • CVEs, scores and fixes: This cross-product warning has no single CVE, CVSS score, affected release range or fixed version. Case C separately references Metabase CVE-2026-72898. Verify product-specific fixes directly with the relevant developers.
    • Observations and mitigations: JPCERT/CC added suspicious access-origin and protocol indicators on October 23. A matching IP address or TLS fingerprint alone does not prove compromise. Apply endpoint-level API authorization and rate limits, constrain and revoke tokens, patch known flaws, limit public exposure of administration interfaces, inspect logs and review incident response plans.
    • Counting: One preventive advisory, without a new confirmed AI or LEAK incident or change to incident counts.

  • Four Mitsubishi Electric GENESIS and ICONICS authentication, code-execution and privilege vulnerabilities

    Advisory · Reviewed:

    Publication chronology: Mitsubishi Electric PSIRT first issued notice 2026-006 on October 15, 2026, and JVN published JVNVU#93251594 on October 23. Neither publication date confirms an attack.

    Details and recommended actions
    • Products: GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. Affected releases are different for each CVE.
    • CVEs and vendor CVSS v4.0 base scores: CVE-2023-4863, libwebp-based code execution on malicious file import (9.3); CVE-2026-16436, authentication bypass involving a fixed challenge response (9.2); CVE-2026-16437, administrator manipulation of a stored response (7.1); CVE-2026-16438, excessive DCOM privileges (9.4). Ratings are from Mitsubishi Electric.
    • Affected versions: 2023-4863 affects GENESIS64 and ICONICS 10.97 through 10.97.2. 16436/16437 affect GENESIS 11.03 and earlier; GENESIS64, ICONICS, Hyper Historian, AnalytiX, MobileHMI and IoTWorX 10.97.3 and earlier; and all MC Works64, GENESIS32 and BizViz releases. 16438 affects GENESIS64, ICONICS, Hyper Historian, AnalytiX and MobileHMI 10.97.3 and earlier and all MC Works64 releases.
    • Exploitation prerequisites and impact: 2023-4863 requires malicious file import with administrative privileges; 16436 requires prior acquisition of the common challenge response for remote unlocking; 16437 requires local PC administrator privileges; 16438 requires access with a product administrator account. Data theft, destruction, tampering or denial of service could result, but these are not universally unauthenticated RCE vulnerabilities.
    • Available fixed releases: ICONICS Suite 10.97.3 or later fixes 2023-4863. ICONICS Suite 10.98 or later, IoTWorX 10.98 or later, and GENESIS 11.04 or later fix 16436/16437 where applicable. ICONICS Suite 10.98 or later fixes 16438. Apply the appropriate product-specific release.
    • Unsupported legacy products: The vendor does not plan fixed releases for MC Works64, GENESIS32 or BizViz. Apply the vendor's product-specific mitigations or consider migration to GENESIS64 or GENESIS.
    • Exploitation and counting: The official notices do not establish successfully compromised named organizations or confirmed data loss. This is one preventive advisory covering four CVEs and does not create an AI or LEAK incident.

  • Pleasanter LDAP authentication bypass (CVE-2026-113438, fixed release available)

    Advisory · Reviewed:

    Official disclosure: Implym and JVN published this notice on October 23, 2026. A crafted request may skip password verification for LDAP authentication in certain configurations. Disclosure does not establish an attack on that date.

    Details and recommended actions
    • CVE and ratings: CVE-2026-113438 (CWE-304), rated CVSS v4.0 6.9 and v3.0 6.5 by JVN. This authentication weakness merits prompt action, but it is not rated Critical.
    • Affected releases and prerequisites: Pleasanter 1.1.0.0 through 1.5.9.0, Community or Enterprise Edition. LDAP or LDAP+Local authentication must be enabled on Linux including Docker, or Windows configured with DsProvider=Novell, with an Active Directory backend or an anonymous-bind-enabled LDAP backend such as OpenLDAP or 389 Directory Server. For LDAP+Local, the LDAP login path is affected.
    • Not affected: Windows using the default DsProvider=null; deployments using only local, SAML, passkey, two-factor or integrated Windows authentication; and Pleasanter.net and the vendor's private cloud, which do not use LDAP in these deployments.
    • Impact and exploitation: Someone knowing a valid login ID could authenticate without its password and view, alter or delete information within that account's permissions. Neither the developer nor JVN establishes a successful breach at a specific organization or a count of exposed records.
    • Released fix: Version 1.5.9.1, released October 23, 2026, fixes this issue. Upgrade affected systems to 1.5.9.1 or later; inspect LDAP settings and authentication logs. Version 1.5.9.0 is still vulnerable. Contact the developer for deployment-specific mitigations when upgrade is infeasible.
    • Counting: One preventive advisory; do not add a confirmed AI or LEAK incident.

  • Actively exploited Arista VeloCloud Orchestrator privilege escalation (CVE-2026-114625)

    Advisory · Reviewed:

    Vendor publication: Arista Networks published Security Advisory 0199 on October 22, 2026, affecting on-premises VeloCloud Orchestrator (VCO).

    Details and recommended actions
    • CVE and severity: CVE-2026-114625 is a SQL injection issue (CWE-89). Arista assigned CVSS v3.1 base score 9.9 and v4.0 base score 9.4, both Critical.
    • Affected versions and prerequisites: VCO 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Exploitation requires access to the VCO web interface and a valid authenticated session, as low as Enterprise Read Only. It is not an unauthenticated exploit.
    • Impact and exploitation: An authenticated lower-privileged user may gain operator privileges and access functions intended only for internal use. Arista confirms active exploitation, which does not by itself establish a breach at any specific customer.
    • Fix and action: Upgrade to VCO 5.2.3.18, 6.1.3.10 or 6.4.2.12. The vendor has already patched Hosted and Dedicated deployments. Restrict administrative access, review web and administrator logs, and preserve evidence where compromise is suspected.

  • CISA/FBI joint SafePay ransomware warning covering at least 600 organizations

    Advisory · Reviewed:

    Official disclosure: On October 20, 2026 (US Eastern time), CISA announced a joint SafePay ransomware advisory with the FBI, US Secret Service and international partners.

    Details and recommended actions
    • Observed scope: The agencies reported impacts on at least 600 organizations in multiple regions and critical-infrastructure sectors since August 2024. This is neither a victim count for a single breach nor a count of Japanese incidents.
    • Techniques and impact: Actors use compromised credentials, brute-force attacks, VPN access and known flaws in exposed edge devices. Data theft and encryption may be followed by deletion of shadow copies and resetting of NAS devices to obstruct recovery.
    • CVE, CVSS and fix status: This is a multi-technique government campaign advisory rather than one product vulnerability; no single CVE, CVSS rating or universal fixed version applies.
    • Actions: Prioritize patches to VPNs and edge devices, strengthen MFA and identity controls, limit privileged access, protect and test isolated backups, and investigate relevant indicators.

  • HTTP/3 QPACK header amplification denial of service across multiple stacks

    Advisory · Reviewed:

    Original research: FoxIO reported on October 20 that missing or late enforcement of cumulative decoded QPACK-header limits allows an unauthenticated HTTP/3 client to trigger excessive memory allocation or CPU use with modest input, causing denial of service. Seven of ten tested implementations had vulnerable or crashing behavior.

    Details and recommended actions
    • Fixes confirmed in the research snapshot: quic-go 0.57.0 (CVE-2025-64702), Cloudflare quiche 0.29.3 (CVE-2026-12523), lsquic 4.9.0 (no CVE) and Wireshark 4.6.2 / 4.4.12 (CVE-2025-13945). A fix for a specified variant does not prove immunity to every later variant.
    • Unpatched in the October 20 snapshot: Bun 1.4.3, hyperium h3, and aioquic / mitmproxy. Updates released after that snapshot require separate verification. The researchers did not find the described issue in IIS, Envoy or ngtcp2/nghttp3. No single universal CVSS score, scoring version or authority was established across all implementations.
    • Impact and mitigation: The reported outcome is availability loss, not verified code execution or data leakage. Install the appropriate security fixes. Until fixed, avoid publicly exposing Bun HTTP/3 servers, disable HTTP/3 in mitmproxy and enforce a suitable max_field_section_size in h3. This is one grouped preventive advisory and is not added to confirmed incident counts.

  • Six Linux kernel Infinity Core privilege-escalation and denial-of-service vulnerabilities

    Advisory · Reviewed:

    Original disclosure: Researcher Hyunwoo Kim published the six issues to oss-security at 01:00 JST on October 17, covering the Timer, Signal, memory-management, Futex, Scheduler and SLAB subsystems.

    Details and recommended actions
    • CVE identifiers: CVE-2026-98260 (Timer UAF), CVE-2026-98256 (Signal UAF), CVE-2026-89754 (mincore() out-of-bounds write), CVE-2026-80775 (Futex UAF), CVE-2026-98385 (Scheduler UAF) and CVE-2026-97941 (SLAB list corruption and kernel panic).
    • Preconditions and impact: Local privilege escalation, conditional container escape, Android privilege escalation and denial of service are possible. Local execution or vulnerable configurations are generally necessary; these are not blanket unauthenticated network RCE. The Scheduler issue depends on CONFIG_SCHED_CACHE, runtime configuration and CPU topology.
    • Patches and scoring: The researcher lists upstream patch commits for each issue. Kernel distribution and Android backports need product-specific verification, not a guessed universal fixed version. Numeric CVSS values, versions and scoring authorities were not established in the examined primary disclosure.
    • Response and exploitation: Review vendor fixes for Linux and Android systems and inspect local privilege and isolation boundaries. The public research does not confirm real-world exploitation, affected organizations or stolen personal data. This is one preventive advisory for six CVEs and is excluded from incident counts.
    • Added at 13:46 JST on October 25, 2026 (all six Linux CNA CVE records and the researcher repository reviewed directly): The Linux CNA rates CVE-2026-98260, 98256, 89754, 98385 and 97941 at CVSS v3.1 7.8 (High, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); CVE-2026-80775 carries no CVSS value. CNA fix boundaries are 6.6.158, 6.12.112, 6.18.54 and 7.2.8 for 98260 (affected since 5.7); 6.18.54 and 7.2.8 for 98256 (since 6.15); 6.18.50 and 7.2.4 for 89754; 6.18.47, 7.1.11 and 7.2.1 for 80775 (since 6.17); 7.2.9 for 98385 (7.2 series only); and 7.2.7 for 97941 (7.2 series only). These are upstream stable boundaries; distribution backports must be verified separately. The researcher repository publishes proof-of-concept code for all six issues: five obtain a root shell from an unprivileged account on Ubuntu 26.04 (7.0.0-30-generic) or Arch Linux (7.2.4-arch1-2), while 97941 only triggers a kernel panic. The Android exploit for the Galaxy S26 Ultra is withheld and only its hash is published. Real-world exploitation, affected organizations and leaked record counts remain unconfirmed in primary sources. Advisory and incident counts are unchanged.

  • Two reported high-severity Linux KSMBD RCE candidates, ZDI-CAN-33774 and ZDI-CAN-33549

    Advisory · Reviewed:

    Disclosure and identifiers: Two reports appeared on October 21 on public Linux kernel mailing lists and TrendAI Zero Day Initiative's upcoming advisory list. ZDI assigns each candidate a score of 9.0, but the CVSS scoring version could not be verified in the listing and no CVE identifier has been confirmed.

    Details and recommended actions
    • Affected component and impact: These reports target Linux's in-kernel SMB server KSMBD, not every installation of the separate Samba service. ZDI-CAN-33774 describes an SMB1/SMB2 request-handling race potentially enabling unauthenticated remote code execution. ZDI-CAN-33549 describes an SMB Direct RDMA integer-underflow path potentially enabling kernel memory corruption and remote code execution.
    • Prerequisites: The first case requires an active reachable KSMBD server. The second has narrower conditions involving SMB Direct, RDMA-capable transport and writable-share access. Neither report means that all Linux kernels or network filesharing configurations are automatically vulnerable.
    • Fixes and exploitation: Reporting as of October 22 said the bugs were not yet patched in mainline and that some proposed fixes were in development branches. Do not treat proposals as released or applied updates. No affected-organization breach or active in-the-wild exploitation was confirmed. Direct access to the original public mailing-list posts returned HTTP 403 in this review; descriptions were cross-checked through reporting rather than misrepresented as directly retrieved original messages.
    • Action: Check whether KSMBD is running and TCP 445 is exposed; disable it when unnecessary, otherwise restrict access, segment networks, reduce privileges and track actual vendor kernel fixes.

  • Cisco Expressway clustered root RCE (CVE-2026-76466, CVSS 9.8)

    Advisory · Reviewed:

    Publication and score: Cisco disclosed CVE-2026-76466 on October 21, 2026 at 16:00 GMT (01:00 JST on October 22), with Cisco CVSS v3.1 9.8 (Critical). The review date is not an attack date.

    Details and recommended actions
    • Affected configuration: Vulnerable clustered Expressway-C and Expressway-E appliances or virtual machines. Network access to the database and possession of persistent cookies are prerequisites. Insufficient certificate validation can then allow RPC-based execution of root-level OS commands; this is not unconditional unauthenticated access.
    • Fixes and response: X15.5.3 and earlier are first fixed in X15.5.20; X14 and earlier must migrate to a fixed series. Patch promptly after matching the vendor's release and clustering conditions. Cisco lists no full workaround. Restrict database exposure and audit cookies as interim measures, not patch substitutes.
    • Exploitation: Cisco PSIRT knew of no public malicious exploitation as of October 21, which does not prove there are no undiscovered attacks or named breaches.
    • Counting: One preventive advisory covering one CVE, not a confirmed LEAK incident.

  • Critical Snort 3 and Cisco security product vulnerabilities (maximum CVSS 9.0)

    Advisory · Reviewed:

    Publication and follow-up: Cisco first published on October 21, 2026 at 16:00 GMT, updating the IOS XE UTD fixed-release table at 19:03 GMT on October 22 (04:03 JST October 23). These are not attack dates.

    Details and recommended actions
    • CVE and scores: CVE-2026-20236 and CVE-2026-20043 each rate Cisco CVSS v3.1 9.0; CVE-2026-20291 rates 7.8, and CVE-2026-20356 rates 7.5. The scores are maxima by CWE grouping and do not establish that every CVE is an unconditional unauthenticated RCE.
    • Affected products: Open Source Snort 3, Cisco Secure Firewall Threat Defense, Cyber Vision, Meraki MX, Cloud-delivered Firewall, Secure Access and Unified Threat Defense on IOS XE. Snort 2 is not affected by these particular issues.
    • Fixes and action: Snort 3.x is first fixed in 3.12.4.0. FTD fixed releases by branch are 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0. Cisco reports cloud-side fixes and online Meraki deployment as of October 21, but not completion on disconnected systems. Check other product tables and apply released patches. Cisco says no complete workaround is available.
    • Exploitation: Cisco has no known malicious use in its published assessment, not evidence that attacks are impossible. No LEAK incident is inferred.
    • Counting: Four CVEs in one preventive advisory.

  • Critical Cisco Unified Communications security hardening across six products

    Advisory · Reviewed:

    Publication and scoring: Cisco published this update on October 21, 2026 at 16:00 GMT, with highest Cisco CVSS v3.1 9.8. Multiple issues discovered internally are grouped into CVEs by CWE class, so eight CVE IDs do not represent eight independent breaches.

    Details and recommended actions
    • Affected products: Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, Unified CM IM and Presence, Unified CM Session Management Edition and Unity Connection. Vulnerable product releases are affected regardless of configuration. The issues include authentication, input processing, SQL and access control, not proven unconditional RCE for each group.
    • CVE details: CVE-2026-76473 and CVE-2026-76474 (9.8 each), CVE-2026-76475 (9.3), CVE-2026-76476, CVE-2026-76477 and CVE-2026-76478 (8.8 each), CVE-2026-76479 (7.8), and CVE-2026-76481 (7.5). Cisco CVSS v3.1 maximum scores by weakness grouping.
    • Fixes and action: Update the 15 series to 15SU5; migrate version 14 to a fixed series. Cisco lists no complete workaround. Restrict administrative exposure and deploy vendor fixes; availability is distinct from installation.
    • Exploitation: Cisco PSIRT reported no known public malicious use on October 21, not proof that exploitation cannot occur.
    • Counting: Eight CVE IDs grouped into one preventive advisory, separate from earlier Cisco product advisories.

  • Unauthenticated critical Oracle APEX vulnerability (CVE-2026-101521)

    Advisory · Reviewed:

    Disclosure and severity: Oracle issued its October 20, 2026 Critical Patch Update with two APEX fixes. CVE-2026-101521 has Oracle Risk Matrix CVSS v3.1 9.8, potentially exploitable unauthenticated over HTTPS with high confidentiality, integrity and availability impact. This does not establish a successful real-world RCE or intrusion.

    Details and recommended actions
    • Affected releases: CVE-2026-101521 affects 24.1.0 through 24.1.21, 24.2.0 through 24.2.20, and 26.1.0 through 26.1.4. Related CVE-2026-66010 (DOMPurify, CVSS v3.1 6.1, requires user interaction) affects 24.1.0 through 24.1.19, 24.2.0 through 24.2.18 and 26.1.0 through 26.1.2. Keep the distinct requirements separate.
    • Fixes and recommendations: Relevant Oracle October CPU patches are published. Check Oracle Support and product-specific patch instructions for precise fixed builds, without inventing them. Prioritize internet-facing APEX; restrict access and inspect logs until patches are applied.
    • Exploitation: The reviewed Oracle matrix does not establish active exploitation or named breached organizations; this does not rule attacks out.
    • Counting: Two APEX CVEs, one Critical, within one preventive advisory. Separate from existing Oracle Java SE alerts; 1,295 total October CPU patches is not a count of unique CVEs or incidents.

  • Nine critical Juniper Junos OS and Junos OS Evolved vulnerabilities including J-Web authentication bypass and root RCE

    Advisory · Reviewed:

    Official disclosure and score: Singapore's Cyber Security Agency (CSA) urged emergency updates on October 19, 2026 and reported CVSS v3.1 9.8 (Critical, CSA assessment) for the nine vulnerabilities. October 23 is the review date, not the original disclosure or an attack date.

    Details and recommended actions
    • CVEs: CVE-2026-102178, CVE-2026-102175, CVE-2026-101990, CVE-2026-101986, CVE-2026-101983, CVE-2026-101982, CVE-2026-101954, CVE-2026-33796, CVE-2026-33789.
    • Conditions and impact: Reachable J-Web can permit unauthenticated authentication bypass and privileged CGI execution with CVE-2026-101986 or root-level configuration takeover with CVE-2026-101954. CVE-2026-101983 can result in unauthenticated HTTP daemon RCE and denial of service. Other flaws require specific BGP/EVPN peers, BMP settings, or control or interception of SDX/SRC connections. These are not nine unconditional unauthenticated RCEs.
    • Affected versions and fixed releases: Junos OS branch-specific boundaries are 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, and 26.2R1-S2. Junos OS Evolved boundaries are 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 26.2R1-S2-EVO, 25.2X100-D35-EVO, and 25.4X300-D40-EVO. Check vendor applicability for earlier affected releases and the 23.4X100-EVO branch.
    • Exploitation and mitigation: The reviewed official CSA alert does not establish active exploitation or named breached organizations; this is not evidence that attacks do not exist. Restrict exposed J-Web, urgently patch affected devices and inspect configurations, logs and installed versions. Distinguish patch release from deployment.
    • Counting: One preventive advisory aggregating nine CVEs, excluded from AI/LEAK incident counts.

  • Reportedly exploited unauthenticated OS command execution in Nextcloud built-in Collabora CODE Server (CVE-2026-110447)

    Advisory · Reviewed:

    Official disclosure and score: Collabora Online published developer advisory GHSA-g3vx-3m76-fghh on October 14, 2026. CVE-2026-110447 has CVSS v4.0 9.2 (Critical, GitHub Advisory Database). October 23 is the review date rather than the original disclosure or incident date.

    Details and recommended actions
    • Affected deployment and preconditions: Nextcloud Collabora Online - Built-in CODE Server app richdocumentscode before 26.4.303. When the embedded CODE server is not running, such as after container restart, update or crash, an unauthenticated crafted proxy.php request can execute operating-system commands as the web-server user. Standalone Collabora Online servers are unaffected.
    • Exploitation: The GitHub Advisory Database CVE description reports exploitation in the wild in September and October 2026. The vendor independently substantiates conditions and remediation but neither source establishes affected downstream organizations or leaked-record counts.
    • Released fix and mitigations: Update richdocumentscode to at least 26.4.303 or remove the app. Simply disabling it does NOT mitigate the flaw. Upgrade end-of-life Nextcloud 29 or earlier or remove the vulnerable app. A separate fix for CVE-2025-66208 does not address this issue.
    • Recommended investigation: Verify app versions and periods when the embedded CODE server was offline; examine proxy.php access, web-server command execution logs and suspicious credential use. Distinguish patch availability from installation.
    • Counting: One preventive advisory for one Critical CVE. Do not count unverified downstream incidents as LEAK rows.

  • Fortinet critical and high-severity hardening updates across five product families before individual CVE disclosure

    Advisory · Reviewed:

    Vendor notice and urgency: Fortinet announced critical and high-severity security fixes on October 21, 2026 for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Its notice scheduled FortiOS, FortiManager and FortiAnalyzer updates for October 22 and urged priority patching of internet-facing devices. A scheduled availability date alone does not establish that packages reached every customer or were installed.

    Details and recommended actions
    • FortiOS affected and fixed versions: 8.0.0–8.0.1 to 8.0.2 or later; 7.6.0–7.6.7 to 7.6.8 or later; 7.4.0–7.4.12 to 7.4.13 or later; 7.2.0–7.2.13 to 7.2.14 or later. The vendor notice lists October 22 as the intended availability date.
    • FortiManager and FortiAnalyzer affected and fixed versions: Both products list 8.0.0–8.0.1 to 8.0.2 or later; 7.6.0–7.6.7 to 7.6.8 or later; 7.4.0–7.4.11 to 7.4.12 or later; 7.2.0–7.2.12 to 7.2.13 or later, with October 22 scheduled availability. FortiManager Cloud may require a manual update.
    • FortiMail and FortiAuthenticator: FortiMail 8.0.0–8.0.1 to 8.0.2 or later; 7.6.0–7.6.6 to 7.6.7 or later; 7.4.0–7.4.8 to 7.4.9 or later; 7.2.0–7.2.9 should migrate to the 7.4 branch or later. FortiAuthenticator 8.0.0–8.0.3 to 8.0.4 or later; 6.6.0–6.6.10 to 6.6.11 or later. The October 21 vendor article described these releases as available on its publication day. This review did not independently verify downloaded packages or deployment.
    • Identifiers, preconditions and exploitation: The vendor article does not publish individual CVEs, CVSS scores or versions, exploit preconditions, or evidence of exploitation for this coordinated update. Fortinet scheduled public PSIRT advisory details for November 10, 2026. The Critical/High ratings justify preventive action, not unsupported claims of specific RCE or authentication bypass, compromised organizations or leaked records.
    • Response and verification: Restrict public administrative HTTPS/SSH to trusted addresses, keep FortiManager administration off the public internet, enforce administrator MFA, back up configurations and review access logs. Confirm actual release availability per product and maintenance branch with Fortinet support and release notes before upgrading. Do not equate planned FortiSASE or cloud rollouts with deployment verified on a device.
    • Counting: One preventive advisory across multiple product families, excluded from incident counts. Subsequent CVE and patch confirmations belong in updates to this stable advisory ID rather than duplicate incident entries.

  • Three critical NGINX memory-corruption flaws and security updates (conditional RCE and DoS)

    Advisory · Reviewed:

    Disclosure and released fixes: On October 14, 2026, the nginx project released Open Source stable 1.30.6 and mainline 1.31.7 with five security fixes. Singapore's Cyber Security Agency advised urgent patching for three critical issues on October 21. Mainline 1.31.8 was released October 21, but the relevant fixes were already in 1.31.7.

    Details and recommended actions
    • CVEs and assessments: CVE-2026-15176 (buffer overflow involving alias and rewrite), CVE-2026-93479 (buffer overflow in script/map expression evaluation), and CVE-2026-97205 (use-after-free when AIO and SSI are combined). The CSA cites CVSS v4.0 9.2 (Critical) for each, while nginx.org rates them medium using its own scheme. The same releases also fix CVE-2026-95101 and CVE-2026-97629.
    • Affected builds and preconditions: According to nginx.org, relevant Open Source versions are 0.1.29–1.31.6 for CVE-2026-15176; 1.30.0–1.30.5 and 1.31.2–1.31.6 for CVE-2026-93479; and 0.8.11–1.31.6 for CVE-2026-97205, when relevant configurations are enabled. F5 NGINX Plus and other derivatives have product-specific applicability and updates. Exploitability is configuration-dependent.
    • Impact and exploitation: Unauthenticated network input can cause worker crashes, memory corruption and denial of service. Arbitrary code execution could be possible if ASLR is disabled or bypassed and vulnerable settings are present. The reviewed official notices do not establish in-the-wild exploitation; this is not proof that no attacks exist.
    • Action: Upgrade NGINX Open Source to at least stable 1.30.6 or mainline 1.31.7; consider newer mainline 1.31.8 released October 21. Apply derivative-specific F5 fixes. Interim mitigations include reviewing affected alias/variable expressions, AIO and SSI settings and map captures.
    • Counting: One preventive advisory emphasizing three critical CVEs and mentioning two associated security fixes. Not a confirmed intrusion or leaked-data incident.

  • Actively exploited Palo Alto PAN-OS management interface root RCE CVE-2026-0322

    Advisory · Reviewed:

    Official notice and score: Palo Alto Networks published CVE-2026-0322 on October 14, 2026 and updated the notice October 15. The vendor assigns CVSS v4.0 8.6 (High) and HIGHEST urgency. Management-interface code injection could allow arbitrary code execution with root privileges.

    Details and recommended actions
    • Products and preconditions: Applicable PAN-OS versions on PA-Series and VM-Series firewalls and Panorama virtual/M-Series appliances. The attacker needs network access to the management interface and authenticated privileges. This is not unauthenticated RCE. Cloud NGFW and Prisma Access are unaffected.
    • Affected and fixed releases: Affected branches include 12.2 before 12.2.4, relevant 12.1 builds before fixes such as 12.1.10-h2, relevant 11.2 builds before fixes such as 11.2.16, 11.1 builds before fixes such as 11.1.16-h3, and 10.2 builds before fixes such as 10.2.18-h12. Follow the vendor's branch-specific Product Status table for exact hotfixes; fixes are available.
    • Exploitation status: The vendor reports very limited exploitation attempts against the management interface. This does not establish a named company's compromise or count of stolen data.
    • Action and mitigations: Install the appropriate fixed PAN-OS release immediately; restrict management interfaces to trusted internal addresses or jump hosts. Examine vendor indicators of compromise, management-operation logs and anomalous authentication. Threat Prevention signatures provide only limited protection and are not a complete workaround.
    • Counting: One advisory for one CVE with observed exploitation. Do not count unspecified victim incidents.

  • Critical SAP Cloud SDK for Python OAuth2 SSRF credential disclosure CVE-2026-89111

    Advisory · Reviewed:

    Official notice and rating: SAP published GHSA-4mv3-jxxm-9cx2 on October 13, 2026. The vendor assigns CVSS v3.1 10.0 (Critical) to CVE-2026-89111, an OAuth2 server-side request forgery issue in the Python sap-cloud-sdk package.

    Details and recommended actions
    • Affected releases and conditions: sap-cloud-sdk versions earlier than 0.45.2 in multitenant SAP BTP applications where an attacker can control tenant_subdomain. A crafted value could redirect an OAuth2 token request to an attacker-operated server, exposing client credentials. This does not imply all SAP products are affected.
    • Patch and mitigation: Version 0.45.2 is released and validates tenant_subdomain under RFC 1123 DNS-label rules. Applications should also allowlist registered tenant subdomains and update their SDK to at least 0.45.2.
    • Exploitation: The cited first-party advisory does not confirm attacks in the wild, compromise of a named organization or actual credential-exfiltration counts. Unconfirmed does not mean no attacks occurred.
    • Counting: One preventive advisory for one CVE, not a confirmed breach or an additional LEAK entry.

  • Critical GitLab CE/EE unauthenticated RCE CVE-2026-110264 and emergency patches

    Advisory · Reviewed:

    Official disclosure: GitLab released emergency security updates on October 21, 2026 for CVE-2026-110264, an integer overflow in its regular-expression compiler. GitLab assigned CVSS v3.1 10.0 (Critical) to the vulnerability.

    Details and recommended actions
    • Preconditions and impact: Under specific conditions, a remote unauthenticated user could execute arbitrary code on the GitLab server by supplying a crafted regular expression. The vendor does not say every installation is unconditionally exploitable.
    • Affected and fixed releases: Vulnerable GitLab CE/EE releases include 7.0 onward in the affected branches: 18.11 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. Corresponding fixed patch versions were released October 21.
    • Action and exploitation: Upgrade self-managed instances immediately and inspect suspicious requests, application logs and indicators of code execution. GitLab.com was already patched according to the vendor. The cited announcement does not verify exploitation in the wild or an intrusion at a named organization.
    • Counting: One preventive vulnerability advisory, not a confirmed victim incident. The same security release also contains other fixes; these must not inflate incident counts.

  • LiteLLM 1.107.0 release pipeline compromise and credential-stealing malware

    Advisory · Reviewed:

    Disclosure and status: On October 21, 2026, the LiteLLM maintainers confirmed their release pipeline was compromised and attacker-built Python wheels and container images containing credential-stealing malware were distributed via legitimate registries. By their October 21 20:30 UTC update, affected artifacts had been removed or replaced and the investigation remained open. This does not prove every downstream user was breached.

    Details and recommended actions
    • Affected versions and windows: All seven PyPI wheels for litellm==1.107.0 were live October 21, 11:39–13:23 UTC (20:39–22:23 JST). Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable pointed to poisoned images after 11:46 UTC; Docker Hub exposure ended by 14:20 UTC and GHCR exposure by 13:51 UTC. Determine impact from artifact digest and actual pull/install time, not only a tag name.
    • Impact and conditions: Installing or running affected artifacts could execute malware capable of accessing environment secrets, cloud credentials and LLM provider keys, exfiltrating data and loading remote-code tools. The maintainer instructs operators to treat an executed affected package as compromised. No confirmed count of downstream victims is provided. Earlier versions and private enterprise registry releases were not affected.
    • Action: Isolate exposed environments before launching Python or pip, which can retrigger the malicious startup files. Preserve evidence, rebuild affected environments and containers from clean images, pin a known-good prior release such as 1.106.2, rotate exposed IAM and API credentials, LiteLLM master and provider keys and database passwords, and investigate subsequent unauthorized use.
    • Identifiers and counting: The vendor notice did not publish an incident-wide CVE or CVSS score. Record this confirmed supply-chain compromise as one advisory rather than inventing separate breach entries for unspecified downstream organizations.

  • Signal RingRTC call teardown interference may leave audio or video active

    Advisory · Reviewed:

    Disclosure and scoring: CVE-2026-113380 was published October 20, 2026. The GitHub Advisory Database displays CVSS v4.0 9.3 (Critical) but marks the entry unreviewed. This is not represented as a separate vendor-provided severity score.

    Details and recommended actions
    • Affected versions and prerequisites: RingRTC versions before 2.72.0 are affected. During a call, a malicious peer able to flood the finite-state-machine event queue may prevent the local hangup operation from completely tearing down the session. This requires an established call context; it is not unrestricted remote microphone activation.
    • Impact: Audio, and potentially video, may persist after the local participant attempts to end the call. The advisory describes potential continued transmission but does not establish confirmed eavesdropping or a number of affected users.
    • Remediation: The Signal-maintained library includes a termination fix in RingRTC 2.72.0. Developers should update affected dependencies and users should install relevant updated Signal application releases. Exact vulnerable Signal application versions are not established by these references.
    • Counting: One preventive advisory covering one CVE, not a confirmed breach or an additional incident row.

  • Atsumi Electric DVRs: privileged command execution and unauthorized firmware installation

    Advisory · Reviewed:

    Published: JVN#88864366 on October 20, 2026. JVN rates CVE-2026-97627 CVSS v4.0 8.6 / v3.0 7.2 and CVE-2026-100737 CVSS v4.0 6.9 / v3.0 4.9. Exploitation requires a user who can log in with administrator privileges; neither issue is unconditional unauthenticated RCE.

    Details and recommended actions
    • Affected: ADX5004, ADX5008, ADX404, ADX3004, ADX3008, ADX3016 and ADX204 before firmware 10.8.237, as well as all firmware versions of ADX1004, ADX1008 and ADX2016. CVE-2026-97627 can allow arbitrary OS commands; CVE-2026-100737 can permit installation of unauthorized firmware.
    • Remediation: update the seven supported models to firmware 10.8.237 or later using the vendor's instructions. No patched firmware will be released for the discontinued ADX1004, ADX1008 and ADX2016; the vendor recommends operating offline or replacing equipment when remote access is needed.
    • Exploitation status: JVN and the vendor describe potential impact but do not confirm successful intrusions or disclosed recordings at a named deployment.

  • Bisheng authentication bypass and cross-tenant exposure: three vulnerabilities, one unpatched

    Advisory · Reviewed:

    Disclosure: CERT/CC VU#166125 was published October 14, 2026, and JVN JVNVU#94697946 followed on October 15. Bisheng is an LLM application development and operations platform. This advisory groups CVE-2026-96679, CVE-2026-96681 and CVE-2026-100156. CERT/CC supplied no numeric CVSS score or scoring version in the cited note.

    Details and recommended actions
    • CVE-2026-96679: a legacy POST /user/sso endpoint can issue JWTs for an arbitrary username without validating caller authentication, potentially taking over an administrator or granting the first registered account super-admin access. CERT/CC reported no vendor fix at publication; exposure depends on the legacy SSO configuration.
    • CVE-2026-96681: an IDOR can let an authenticated user read another account's workflow DSL; fixed by Bisheng 3.0.0. CVE-2026-100156: versions before 2.5.0 allowed authenticated users to abuse other users' LLM credentials and assistant workloads, potentially exposing configuration and incurring inference charges; fixed in 2.5.0.
    • Action: audit deployed versions and install relevant fixed builds. For the unresolved legacy SSO flaw, avoid BISHENG_PRO=true, disable the old SSO endpoint or enforce JWT checks and network restrictions. Review suspicious credentials, tool access and usage charges.
    • Exploitation status: the official coordinated disclosure describes exploitable weaknesses, not independently confirmed intrusion or data leakage at a named organization.

  • BoringSSL X.509 Name Constraints inconsistencies with mixed remediation states

    Advisory · Reviewed:

    Disclosure: CERT/CC VU#410595 was first published October 14, 2026 and updated October 19; JVN JVNVU#95613365 followed October 15. The five findings concern enforcement of X.509 Subject Alternative Name constraints. They are not five uniformly confirmed, unpatched vulnerabilities.

    Details and recommended actions
    • Preconditions: a constrained subordinate CA, an affected SAN name form and the relevant validation path must all be involved. The legacy crypto/x509 and new pki paths are distinct. Linking BoringSSL does not automatically make Chrome, Android or every consuming product exploitable.
    • Remediation states: VU#410595.8 and .12 were fixed March 4, 2026 in upstream commit 5774eca; .9 is accepted and still under coordination; .10 is disputed; and .11 was declined as below the vendor's security threshold. The cited CERT/CC report does not assign one overall CVE, numeric CVSS score or universal patched-version number.
    • Action: identify relevant certificate policy, SAN forms and validation paths, update products using affected paths, control certificate issuance and verify that any second validator fails closed on the same inputs. The official note does not establish active exploitation.

  • Actively exploited EC-CUBE 4 AmazonPay plugin redirect manipulation during checkout

    Advisory · Reviewed:

    Published by JVN as critical notice JVN#43511918 on October 14, 2026. CVE-2026-103671 is rated CVSS v4.0 5.3 / v3.0 4.7 by JVN. Although the numeric scores are moderate, the vendor has observed attacks exploiting this vulnerability, making it a priority advisory.

    Details and recommended actions
    • Affected versions: EC-CUBE 4 AmazonPay V2 plugin for EC-CUBE 4.0/4.1 from v1.0.0 through v1.1.12, the 4.2/4.3 plugin from v4.2.0 through v4.3.1 (including bundled v4.3.1), and the older CV1 AmazonPay plugin v1.3.0 and earlier for EC-CUBE 4.0. Applicability depends on the plugin generation.
    • Preconditions and impact: unauthenticated manipulation of web parameters may redirect shoppers to an attacker-chosen website during checkout, where account information can be stolen. JVN's CVSS requires user interaction (v4 UI:P / v3 UI:R). Neither a confirmed payment-card breach nor a victim count is established.
    • Action: apply the relevant vendor-supplied patch and monitor abnormal checkout redirects and malicious destination URLs. The source does not provide one universal fixed-version number. Observed exploitation attempts are not the same as a confirmed data breach at a named merchant.

  • Actively exploited Ivanti Connect Secure authentication bypass CVE-2026-104935

    Advisory · Reviewed:

    Disclosure and exploitation: Ivanti disclosed the Connect Secure issue on October 13, 2026 and confirmed limited exploitation in the wild. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day. The Canadian government updated its advisory October 16. The October 22 review date is not the original disclosure or attack date.

    Details and recommended actions
    • Identifier and impact: CVE-2026-104935, CVSS v3.1 base score 8.6 (High, published CVE score). On vulnerable Connect Secure deployments, a remote unauthenticated attacker may bypass authentication and execute arbitrary commands. This does not establish personal-information exfiltration at any specific organization.
    • Affected versions and preconditions: CERT-FR identifies Connect Secure 22.8Rx earlier than 22.8R2.5, 25.1.1.x earlier than 25.1.1.2, and 25.1.3.x earlier than 25.1.3.1. Releases and fixes differ by appliance and branch; do not infer all older versions are vulnerable. The vendor excludes Connect Secure 22.7R2.14 and earlier from this CVE.
    • Fixed releases and action: 22.8R2.5, 25.1.1.2 and 25.1.3.1 are already published for their respective affected branches. Follow the vendor's appliance-specific upgrade guidance immediately, run the Integrity Checker Tool and inspect logs and indicators of compromise. Installing an update alone does not prove a system was not previously compromised. No comprehensive workaround was verified from the cited official notices.
    • Counting: real-world exploitation is confirmed, but this record is one preventive advisory covering one CVE, not an invented company-specific data breach.

  • Komodo Periphery privilege escalation to host-level command execution CVE-2026-110005

    Advisory · Reviewed:

    CERT/CC VU#456950 was published October 13, 2026. CVE-2026-110005 has a vendor-reported CVSS v3.1 score of 9.9 (Critical). Komodo Periphery versions before 2.3.0 can permit OS command injection in container-management handlers.

    Details and recommended actions
    • Preconditions and impact: a restricted but authenticated user with a Logs grant or certain Execute privileges can cause crafted container names or search terms to reach a shell, enabling commands as the Periphery service account, often root on the managed host. The official vendor clarification does not classify this as generally unauthenticated exploitation.
    • Fix and action: the developer patched the problem in version 2.3.0. Upgrade to 2.3.0 or later and review Logs/Execute grants. No complete non-upgrade workaround is offered by the vendor.
    • Exploitation status: CERT/CC's coordinated disclosure does not confirm actual intrusion at a named organization or exfiltration.

  • Lenovo tablets shipped with public Android Verified Boot test keys

    Advisory · Reviewed:

    Published by JVN as JVN#33436631 on October 20, 2026. CVE-2026-92777 has JVN scores of CVSS v4.0 7.0 and v3.0 6.6. Some Lenovo tablets use publicly known AOSP test private keys for Android Verified Boot.

    Details and recommended actions
    • Prerequisite and impact: an attacker with physical access to an affected device may install a crafted system image. This does not establish remote boot compromise of every Lenovo tablet. Consult Lenovo's vendor notice for exact product and firmware coverage.
    • Remediation: deploy Lenovo firmware updates where supported. Consider replacing devices whose support has ended, since no security fix is offered for those products, and enforce physical device controls. The cited JVN notice does not specify one universal fixed version for all models.
    • Exploitation status: the official disclosure does not confirm real-world attacks, named victim organizations or personal-data leakage.

  • Lowcoder cross-tenant Query Library authorization bypass CVE-2026-16753

    Advisory · Reviewed:

    CERT/CC VU#382143 was published October 13, 2026 and revised October 14. CVE-2026-16753 was confirmed in Lowcoder 2.4.10. The official CERT/CC note provides no numeric CVSS score or scoring version.

    Details and recommended actions
    • Preconditions: in a multi-tenant Lowcoder deployment, an authenticated admin or dev of one organization can query another organization's private Query Library through endpoints lacking resource ownership checks. Some email-signup and workspace-creation settings can let new registrants obtain those roles. This is not universally an unauthenticated vulnerability.
    • Impact: the attacker may read other tenants' query DSL and data source identifiers and execute queries against other tenants' backend data sources, creating risks of disclosure, modification, destruction and charged usage. Actual exfiltration at a named customer is not established.
    • Remediation: CERT/CC had received no coordinated vendor fix or response as of its advisory. Do not infer a fixed version; restrict access to affected APIs, audit admin/dev assignments, and use isolated tenants or add proper organization-level authorization checks until a vendor correction is available.

  • Multiple TLS libraries inconsistently enforce X.509 certificate Name Constraints

    Advisory · Reviewed:

    Published: CERT/CC VU#948176 on October 14, 2026; JVN JVNVU#95474776 followed October 15. The notice describes thirteen library-specific X.509 Name Constraints findings (VU#948176.6 and .8 through .19). These are neither thirteen CVEs nor thirteen observed breaches.

    Details and recommended actions
    • Products and identifiers: GnuTLS had case-sensitive DNS constraint comparisons (CVE-2026-3833, fixed in 3.8.13). Other records include pyca/cryptography wildcard constraints (CVE-2026-34073) and wolfSSL URI constraints (CVE-2026-3547). Apple Security.framework, Mozilla NSS, LibreSSL, AWS-LC, s2n-tls and Mbed TLS have issue-specific states that include fixed, in triage and non-security findings.
    • Prerequisites and impact: where a trusted constrained CA and an affected DNS, URI or IP name form reach a specific validation path, different libraries can accept the same certificate differently. This does not establish bypass of authentication for all TLS connections or unconditional man-in-the-middle attacks. No single CVSS score covers the thirteen reports.
    • Action: identify the TLS libraries and certificate-validation paths in use, apply available vendor-fixed releases or backports, enforce strict certificate issuance and explicit SANs, and ensure multiple validators use the same input and fail closed. Active exploitation or organization-specific leakage was not confirmed in the official note.

  • Claude Agent SDK Python argument injection CVE-2026-96620 enabling arbitrary command execution

    Advisory · Reviewed:

    Disclosure history: Anthropic published GHSA-h4mw-j7qp-8mwm on September 12, 2026, and the advisory was updated October 16. The source was reviewed again October 22. Neither the original disclosure date nor the incident date is October 22.

    Details and recommended actions
    • CVE-2026-96620 affects Python claude-agent-sdk applications that pass untrusted session identifiers into the resume option. Argument injection can cause the underlying CLI to load attacker-specified MCP configuration and execute arbitrary commands outside SDK permission controls. Exploitation depends on an application accepting an attacker-controlled resume value.
    • Affected and fixed versions: Python claude-agent-sdk earlier than 0.2.121 is affected; version 0.2.121 contains the fix. GitHub rates the advisory Critical. A numeric CVSS score and version were not established from the official notice. This finding must not automatically be extended to all TypeScript SDK or Claude Code deployments.
    • Action and exploitation status: upgrade to 0.2.121 or later and do not forward untrusted session IDs without appropriate validation. The reviewed vendor advisory does not establish real-world exploitation or an organization-specific data leak.

  • Four high-severity ISC BIND 9 vulnerabilities: DNS denial of service and conditional RCE

    Advisory · Reviewed:

    Published by ISC on October 21, 2026; JVN issued JVNVU#91196958 on October 22. Operators of DNS infrastructure should assess their exposed BIND resolver and authoritative server configurations.

    Details and recommended actions
    • CVEs and severity: CVE-2026-19630 allows disproportionate CPU and memory consumption from inbound DNS messages (ISC High; CVSS v3.1 7.5). CVE-2026-94300 permits memory corruption and crashes, and potentially remote code execution, where an attacker can replay a previously signed GSS-TSIG UDP message while its key is valid (High; CVSS v3.1 8.1). CVE-2026-96888 can terminate named when redirect zones and strict QNAME minimization are used together (High; 7.5). CVE-2026-97313 can terminate a recursive resolver under specific RPZ configurations and query sequences (High; 7.5). Not every configuration is vulnerable to every CVE.
    • Affected releases include BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26, with issue-specific lower bounds and prerequisites. The GSS-TSIG issue requires access to a valid previously signed message; it must not be described as unconditional unauthenticated RCE.
    • Fixed versions and action: deploy ISC BIND 9.20.30 on the stable branch, 9.21.27 on the development branch, or Supported Preview Edition 9.20.30-S1 as appropriate. Confirm vendor backports and relevant DNS configuration. ISC did not provide a complete workaround.
    • Exploitation status: ISC was unaware of active exploits when publishing the advisories on October 21. That is not proof that no attacks exist. This is one advisory covering four CVEs, not four known breaches or a claim of leaked personal data.

  • Xerj Console API authentication bypass CVE-2026-97406 (no vendor patch reported)

    Advisory · Reviewed:

    CERT/CC VU#645818 was published October 20, 2026, followed by JVN JVNVU#92078426 on October 21. The vulnerability is CVE-2026-97406. The CERT/CC notice did not provide a numeric CVSS score or version.

    Details and recommended actions
    • Preconditions: Xerj is a search and indexing system for AI agents. An attacker must already possess a valid API token to use Console API token issuance without the required passkey-backed session authorization. The flaw can mint successor credentials with the same privileges. It is not an unconditional exploit by someone with no authentication material.
    • Impact: successor credentials remain valid when the original token is revoked. This can sustain unauthorized access and, where an owner token was compromised, potentially allow administrative operations and attacker-controlled passkey enrollment. The official disclosure did not establish an actual breach or data exfiltration at a named organization.
    • Patch status and action: CERT/CC reported that no vendor patch or vendor statement was available as of the October 20 disclosure. No fixed version is inferred. Restrict Console API exposure, audit active and successor credentials and monitor official releases. Revoking only the original token cannot be assumed to end unauthorized access.
    • Counting: one serious preventive advisory covering one CVE; it is not counted as a confirmed company-specific incident.

  • Chrome 156 security release with six critical vulnerabilities

    Advisory · Reviewed:

    Official disclosure: October 20, 2026 (US date). Google's Chrome 156 release contains 353 security fixes and explicitly lists six Critical issues. Fix counts are not CVE counts or confirmed breach counts.

    Details and recommended actions
    • Critical CVEs: CVE-2026-113341 (Skia memory corruption), CVE-2026-113279 (Accessibility), CVE-2026-113072 (CSS), CVE-2026-113280 (Paint), CVE-2026-113271 (Accessibility use-after-free), and CVE-2026-113303 (WebRTC). The reviewed official release did not establish numeric CVSS scores or versions for these issues.
    • Fixed builds: Windows and macOS 156.0.8078.47/.48, Linux 156.0.8078.47, and Android 156.0.8078.47 with corresponding desktop security fixes unless noted. Rollout is gradual; confirm the installed version.
    • Exploitation and action: the reviewed official release does not confirm successful exploitation of these six issues. Update Chrome promptly and verify after restarting. This advisory does not establish an organization-specific data breach.
    • Counting: one security advisory, excluded from incident counts.

  • Thunderbird 158.0.1 fixes credential exposure and seven other vulnerabilities

    Advisory · Reviewed:

    Published and fixed on October 20, 2026. Mozilla's Thunderbird 158.0.1 advisory lists eight CVEs: five High, two Moderate and one Low. Numeric CVSS scores and versions were not established by the reviewed official disclosure.

    Details and recommended actions
    • Key risks: CVE-2026-113866 could send a supplied password in cleartext HTTP during Exchange AutoDiscover account setup, exposing it to an on-path attacker. CVE-2026-113867 concerns XMPP stanza injection, while CVE-2026-113868 concerns uninitialized memory exposure and crashes during POP3/SMTP NTLM authentication.
    • Scope and response: each flaw depends on relevant Exchange setup, XMPP, NTLM or GSSAPI settings. Update to Thunderbird 158.0.1 or later fixed releases and assess connection logs and credentials for potentially affected configurations.
    • Exploitation status: Mozilla's reviewed notice does not establish a successful attack on a particular user or a confirmed personal-data breach. No real credentials or secret values are collected or stored.
    • Counting: one security advisory, excluded from incident counts.

  • BeyondTrust Remote Support Critical advisory

    Advisory · Reviewed:

    Published October 15, 2026. Remote Support origin validation flaw CVE-2026-102764 (CWE-290) can permit remote unauthenticated file operations. Vendor CVSS v4.0 score 9.3, Critical; affected versions through 26.2.3.

    Details and recommended actions
    • The BT26-05-RS patch supports versions 24.3.1 through 26.2.3, while older releases require upgrading. Vendor SaaS instances were patched by October 9. Self-hosted installations should verify patches. Active exploitation and named victims remain unconfirmed.

  • Next.js two critical RCE issues and a DoS fix

    Advisory · Reviewed:

    Published October 14, 2026: unauthenticated RCE involving App Router Cache Components returning multiple typed arrays (GHSA-673q-mjm6-r5xr) and SVG Image Optimization on glibc Linux (CVE-2026-96889); both are vendor-rated Critical.

    Details and recommended actions
    • Server Actions with App Router may suffer CPU-exhaustion DoS (GHSA-p3m5-59mp-jv5r, High). Upgrade to Next.js 16.4.1 or 15.5.28. Sharp 0.35.5 or later is a workaround for the SVG issue. Numerical CVSS scores and exploitation were not confirmed.

  • Plex Media Server four exploited vulnerabilities

    Advisory · Reviewed:

    Vendor security fixes appeared in September 2026, with active exploitation confirmed by the vendor on October 19. Four issues are CVE-2026-96652 (unauthenticated SSRF), CVE-2026-96654 (internal agent access), CVE-2026-96655 (administrator token exposure), and CVE-2026-96656 (arbitrary file write). Chaining permits unauthenticated RCE.

    Details and recommended actions
    • Plex Media Server 1.43.2 and earlier are affected. Upgrade to 1.43.3.10861 or later and investigate exposed or compromised servers. Updating may not remove an existing compromise. CVSS scores and affected-person counts were not verified.

  • Exploited Siemens Software Center DLL side-loading

    Advisory · Reviewed:

    Siemens disclosed CVE-2026-110936 on October 15 and confirmed active DLL side-loading attacks on October 19, 2026. Attackers placed malicious DLLs beside a genuine signed executable. Vendor CVSS v4.0 is 8.4 and v3.1 is 6.7; this does not prove breach of Siemens update infrastructure.

    Details and recommended actions
    • Versions before 4.0.9.8 are affected. Upgrade to 4.0.9.8 or later and inspect suspicious installers and DLLs. Victim counts and leaked record totals are unknown.

  • Exploited SiteGuard Server Edition command injection

    Advisory · Reviewed:

    Published October 14, 2026. SiteGuard Server Edition statistics feature has OS command injection CVE-2026-106931. JVN CVSS v4.0 8.5 and v3.0 7.8. Under low-privilege local conditions commands may run as root or SYSTEM. Exploitation is confirmed.

    Details and recommended actions
    • Affected from Ver2.20 onward except IIS Ver3.10 through Ver4.00 Update4. Upgrade to 8.00 Update5 for Apache, Nginx or IIS, or 7.00 Update6 on FreeBSD; alternatively apply the official patch. Victim counts are unknown.

  • Eight Apache Tomcat vulnerabilities including authentication bypass

    Advisory · Reviewed:

    ASF publicly disclosed eight vulnerabilities on October 20, 2026. Tomcat fixed releases 9.0.123, 10.1.61 and 11.0.27 were available October 12. JVN issued its notice October 21. The affected branches differ by CVE.

    Details and recommended actions
    • Key issues: JNDIRealm authentication bypass with non-GSSAPI SASL (CVE-2026-101296), HTTP/2 asynchronous request-response mixing (CVE-2026-101356), and AJP response mix-up in 11.x (CVE-2026-103119). Five others are CVE-2026-93446, CVE-2026-88041, CVE-2026-74049, CVE-2026-74048 and CVE-2026-80353. Reported CVSS v3.1/v4.0 scores reach 9.1; the ASF uses its separate Important rating. Upgrade relevant releases; exploitation was not confirmed.

  • Critical Cisco Secure Email Gateway CVE-2026-76519 (active exploitation confirmed)

    Advisory · Reviewed:

    CVE-2026-76519 affects the AMP File Reputation feature in Cisco Secure Email Gateway (Cisco CVSS v3.1 score 9.8). A remote unauthenticated attacker can send a crafted email attachment to write arbitrary files and potentially execute commands as root on the appliance.

    Details and recommended actions
    • Affected conditions: a vulnerable AsyncOS release on a physical or virtual Secure Email Gateway, File Reputation enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525. Cisco confirms that Secure Email and Web Manager and Secure Web Appliance are not affected.
    • Exploitation status: Cisco PSIRT reported awareness of active exploitation in October 2026; CISA also listed the CVE in its Known Exploited Vulnerabilities catalog. No organization-specific victim or exposed-record count is established by this notice.
    • Remediation: update AsyncOS 15.5 to 15.5.5-014, AsyncOS 16.5 to 16.5.0-780, or migrate AsyncOS 16.0 to a fixed branch. Supported systems can also obtain the fix in Content Scanner Tools 25.3.0.5525 or later. Cisco lists no workaround; review appliance and external network logs and engage Cisco TAC when compromise is suspected.

  • Microsoft Windows Shell CVE-2026-96951 security feature bypass (exploited)

    Advisory · Reviewed:

    CVE-2026-96951 is a Windows Shell security-feature bypass. IPA states that Microsoft confirmed active exploitation and calls for urgent deployment of Microsoft's October 2026 security updates because further attacks may occur.

    Details and recommended actions
    • Impact: Windows security protections may be bypassed. Consult Microsoft's Security Update Guide for the exact affected Windows releases, applicable updates and CVSS information for each environment. Confirmed exploitation of a vulnerability is not equivalent to a confirmed data breach at a named organization.
    • Action: promptly deploy the appropriate October updates using Windows Update or enterprise patch management, complete any required restart and verify installation. The public alert does not establish any organization-specific victim or leaked-record counts.

  • Oracle Java SE October 2026 security update (IPA advisory)

    Advisory · Reviewed:

    Oracle's October 2026 Critical Patch Update Java SE risk matrix lists 55 new security patches, including 49 vulnerabilities potentially exploitable remotely without authentication. Exploitation conditions vary; this does not mean that every Java deployment is unconditionally reachable or compromisable from the internet.

    Details and recommended actions
    • Examples in Oracle's Java SE matrix include CVE-2026-43660 (JavaFX WebKitGTK, CVSS v3.1 7.5, user interaction required) and CVE-2026-91484 (Java plugin, CVSS v3.1 7.5, local attack vector). These are individual scores, not a single aggregate score for the whole release.
    • Scope: IPA lists Oracle Java SE 27, 26.0.2, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1, and 8 Update 503 / 503-perf. Determine the applicable vulnerable and fixed versions from Oracle's product-specific guidance and the software distributor.
    • Action: inventory installed and bundled Java runtimes, JavaFX and related products, promptly deploy relevant security fixes, and verify commercial-license requirements. This advisory alone does not establish exploitation or a data breach at a specific organization.
Back to the Incident Database

Request a correction or removal

If an entry contains an error, or you would like to request a correction or removal, please contact us.

Contact us

Check the risks in your own service

Free diagnosis
Vulnerability Advisories | Incident Database | Code Rakuda