HOT NEWS 2026 OCTOBER  January(174) February(168) March(221) April(222) May(261) June(255) July(464) August(446) September(518) October(442) November(0) December(0) | STATISTICS (7049)

DATE

NAME

INFO

CATEGORY

SUBCATE

31.10.26

 CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. ECV ECV

31.10.26

 CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. ECV ECV

31.10.26

 CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. ECV ECV

31.10.26

 CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability: GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. ECV ECV

31.10.26

 Trojanized Claude Code Extension Distributed via Cursor Marketplace Cursor has published a security notice describing a trojanized build of the Anthropic.claude-code VS Code extension (version 2.1.313) that was served through its extension marketplace on October 29, 2026. Cursor states that Anthropic did not produce this build. The package was available for roughly eleven hours, and Cursor estimates that up to 5,000 users may have installed it. ALERTS AI

31.10.26

 SolanaCry malware delivery campaign Researchers at Air Security recently uncovered a campaign where threat actors leveraged a fraudulent GitHub project masquerading as a foundational toolkit for Solana development. When an autonomous coding assistant follows the setup instructions hosted within this repository, it unknowingly triggers a single-line PowerShell command. ALERTS CAMPAIGN

31.10.26

 YuanKong Android RAT In a recent write-up, STAR Labs details the inner workings of YuanKong RAT, a multi-tenant Android remote access trojan that targets mobile users through imitation applications. The attack sequence begins with a dropper application that stores its decryption keys and configuration details in cleartext, facilitating direct payload extraction. ALERTS VIRUS

31.10.26

 Credential Phishing Campaign Leverages Fake Bid Invitations Researchers at Cofense recently reported a credential phishing campaign that targets business professionals by exploiting the routine handling of sales bid invitations. The attack begins with an email lure containing a password-protected PDF, a tactic chosen specifically because encrypted attachments often bypass standard automated email scanners ALERTS CAMPAIGN

31.10.26

 YobaDropper and YobaLoader leveraged in campaign delivering coinminers Security analysts at Check Point Research uncovered a two-month-old cyberattack operation dubbed "Yoba." This malicious campaign exploits the widespread interest in prominent artificial intelligence platforms, specifically targeting users looking for OpenAI and Anthropic products. Threat actors construct deceptive repositories on GitHub that masquerade as authentic desktop software. ALERTS CAMPAIGN

31.10.26

 New AI-enabled framework - NIK C2 According to Cisco Talos, a previously undocumented command-and-control framework called NIK C2 is being operated in the wild, and its Windows implant embeds a client for the OpenAI Chat Completions API. The implant is a 64-bit Go binary that talks to its server over certificate-pinned TLS WebSockets on port 443, with an HTTP polling fallback and AES-256-GCM encryption on all traffic. ALERTS AI

31.10.26

 Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations AI coding agents such as OpenAI's Codex and Claude Code read files, write code, and run commands on the machines where they are installed. One of the safeguards they employ is a sandbox that is meant to limit what they can do. However, Symantec's Threat Hunter Team has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China. ALERTS AI

31.10.26

 Sirius Backdoor distributed under the FedEx disguise Trellix cybersecurity researchers uncovered an advanced, multi-tiered attack distributing a newly identified C++ malware strain dubbed Sirius Backdoor. The intrusion starts with a financially-themed spear-phishing message impersonating FedEx, which delivers a zipped PDF file. ALERTS VIRUS

31.10.26

 Armorsteal malware spread via SEO Poisoning campaigns Zscaler researchers uncovered an search-engine manipulation operation spreading a Pyarmor-obfuscated malware strain dubbed Armorsteal. Attackers lure victims seeking setup instructions for the Chocolatey utility or Microsoft Activation Scripts (MAS) onto fraudulent portals. These bogus sites trick visitors into running a rogue PowerShell script that installs a bundled Python environment alongside three distinct malicious modules. ALERTS CAMPAIGN

31.10.26

 PixyNetLoader distribution campaigns A recent report by ExaTrack researchers examines latest updates to the APT28 threat group’s ongoing phishing operations deploying the PixyNetLoader malware. Consistent since 2025, these attacks primarily utilize weaponized Word and Excel files to infiltrate Ukrainian military supply chains. ALERTS CAMPAIGN

31.10.26

 RoofDeck and FlatRoof malware distributed in the latest campaign attributed to TraderTraitor group Cybersecurity analysts at Zscaler ThreatLabz recently reported a sophisticated cyberattack attributed to TraderTraitor, a North Korean state-sponsored hacking group notorious for targeting the cryptocurrency sector. Bearing strong similarities to an earlier breach involving KelpDAO, this operation employs a multi-stage infection chain utilizing two primary malware strains: FlatRoof and RoofDeck. ALERTS VIRUS

31.10.26

 uCreator Android Spyware Security researcher Ovi recently reported on Creator - a commercial Android surveillance framework designed for mass device manipulation. Rather than functioning as standalone malware, this toolkit acts as a comprehensive ecosystem featuring a Windows management console, remote screen-control servers, a hooking engine, and application-specific modules. ALERTS VIRUS

31.10.26

 ClingSTUN - a novel backdoor targeting Linux platform Security analysts at FortiGuard Labs have identified ClingSTUN, a Linux-based malware campaign that compromises exposed, unpatched hardware to establish ongoing unauthorized access. By converting infected machines into remotely managed back-connect proxies, the malware enables threat actors to route traffic through victim networks. To bypass network address translation (NAT) and preserve operator connections, ClingSTUN leverages legitimate public STUN servers to map external ports and IP addresses. ALERTS VIRUS

31.10.26

 Retraction of mpc-lib hardened derivation fails to protect ancestor isolation Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from. ALERTS ALERTS

31.10.26

 COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received, allowing a remote, unauthenticated peer to exhaust host memory and deny service. ALERTS ALERTS

31.10.26

 CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability KEV KEV

31.10.26

 CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability KEV KEV

31.10.26

 CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound KEV KEV

31.10.26

 CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability KEV KEV

31.10.26

 RATHat RATHat's Android malware remained largely static from late 2025 to September 2026, while its Command-and-Control (C2) panel was replaced entirely and went through three generations in six months, rebranded from BlackCat to Panda Workshop. MALWARE RAT

31.10.26

 TonRAT Malware Since early 2026, Windows shortcut files (LNK) with names with the same pattern have been consistently identified by VirusTotal. The LNK files are disguised as image and video files, and when executed, they receive and execute a PowerShell script from the attacker's server, download NodeJS, and ultimately execute the TonRAT malware written in JavaScript. MALWARE RAT

31.10.26

 Searchjacked 319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing. HACKING AI

31.10.26

 Silent Ransom Group This report analyzes four leaked operational files from the established Russian-speaking extortion group “Silent Ransom Group” (aka SRG or Luna Moth). These files are internal documents from the SRG group which were leaked on a Tor site and proliferated widely via X (formerly Twitter) on 2026-10-03. GROUPS GROUPS

31.10.26

 GoodPerson campaign ThreatLocker Threat Intelligence has identified additional samples in-the-wild that contribute to a family of MSI-based trojans. As a follow up to GoodPersonRAT, these samples share common infrastructure, loader tactics, and final payloads that support attribution to the same operators and broader campaign. CAMPAIGN CAMPAIGN

31.10.26

 AI worm An AI worm is self-replicating malware that uses artificial intelligence to adapt as it spreads. Traditional worms have bedeviled the internet since the Morris Worm in 1988, but AI can give them brains. Instead of targeting a single exploit across a large number of endpoints, an AI worm can identify and target different vulnerabilities as it moves through a network. MALWARE AI

31.10.26

 TRUST#GRAFT The chain should be assessed as a browser-mediated deployment mechanism rather than a traditional server-side exploit. The decisive condition is an already authenticated WordPress administrator browser; that context lets the loader reuse legitimate site-management workflows and turn a successful interaction into persistent server-side access. MALWARE BACKDOOR

31.10.26

 n0n Ransomware In September 2026, the SOCRadar Threat Research Unit (STRU) discovered an exposed staging server holding the live workspace of an operator tied to the n0n ransomware group. RANSOM RANSOM

31.10.26

 Brotli2Shell Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. VULNEREBILITY VULNEREBILITY

31.10.26

 SkyW4lker Phishing Kit SkyW4lker (SkyW4lker x365 Sentinel) is an active device-code phishing kit targeting Microsoft 365 users in the United States, Europe, and other regions. By abusing Microsoft’s legitimate authentication process, the kit can give attackers access to corporate accounts without stealing passwords or bypassing MFA. This puts business emails, sensitive documents, and other Microsoft 365 resources at risk of unauthorized access. PHISHING PHISHING KIT

31.10.26

 Inj3ctor3s Campaign INJ3CTOR3’s FreePBX implant now steals your SIP trunk credentials. CRIL’s latest analysis shows why wiping the host no longer stops the toll fraud. CAMPAIGN CAMPAIGN

31.10.26

 Aokigahara Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications, among other targets. MALWARE INFOSTEALER

31.10.26

 Amatera The malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 is an example of how cybercrime has professionalized MALWARE INFOSTEALER

31.10.26

 Sirius Backdoor During a recent priority customer escalation, our “Trellix” Threat Response Team investigated a suspicious alert involving the unexpected execution of a PDF document. What initially appeared to be a routine phishing attempt quickly unfolded into a sophisticated, multistage campaign delivering a previously undocumented variant of the Sirius Backdoor. MALWARE BACKDOOR

30.10.26

 CVE-2026-111585 An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. VULNEREBILITY VULNEREBILITY

30.10.26

 CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13. VULNEREBILITY VULNEREBILITY

30.10.26

 CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation. VULNEREBILITY VULNEREBILITY

30.10.26

 CVE-2026-76418 (CVSS score: 8.6) - An unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. VULNEREBILITY VULNEREBILITY

30.10.26

 CVE-2026-98432 In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. VULNEREBILITY VULNEREBILITY

29.10.26

 Yoba Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Users MALWARE AI

29.10.26

 UAT-11473 Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN GROUPS GROUPS

29.10.26

 CVE-2026-97229 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. VULNEREBILITY VULNEREBILITY

29.10.26

 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass VULNEREBILITY VULNEREBILITY

29.10.26

 Vulnerabilities in Node.js Affecting Cisco Products: October 2026 Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate VULNEREBILITY VULNEREBILITY

29.10.26

 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of VULNEREBILITY VULNEREBILITY

29.10.26

 CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability KEV KEV

29.10.26

 CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability KEV KEV

29.10.26

 CVE-2026-109618 CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products VULNEREBILITY VULNEREBILITY

29.10.26

 CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability: Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. ECV ECV

29.10.26

 CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability: Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. ECV ECV

29.10.26

 CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability: Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. ECV ECV

29.10.26

 CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability: Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. ECV ECV

29.10.26

 CVE-2026-109619 PHP Stale Internal Request-State Vulnerability: PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. ECV ECV

29.10.26

 CVE-2026-109618 PHP Memory Corruption Vulnerability: PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. ECV ECV

28.10.26

 Oracle Critical Patch Update Advisory - October 2026 A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products VULNEREBILITY SOFTWARE PATCH REPORTS

28.10.26

 Adobe Security Bulletin OCTOBER Adobe has released a priority 2 security update for Adobe Campaign Classic. This update addresses vulnerabilities rated critical that could result in arbitrary code execution, security feature bypass, and privilege escalation. VULNEREBILITY SOFTWARE PATCH REPORTS

28.10.26

 CVE-2026-97631 Pre-boot RCE in EDK II PXE driver VULNEREBILITY VULNEREBILITY

28.10.26

 CVE-2026-101767 Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. VULNEREBILITY VULNEREBILITY

28.10.26

 Autonomous LLMjacking Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks HACKING AI

28.10.26

 CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability KEV KEV

28.10.26

 CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability KEV KEV

28.10.26

 Decoding emergence
2026 Microsoft Digital Defense Report 		The challenge confronting security leaders today is no longer a lack of information. It is the growing complexity of the environments they are responsible for protecting. REPORT REPORT

28.10.26

 CVE-2026-35273 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management) VULNEREBILITY VULNEREBILITY

27.10.26

 Cisco Unified Communications Products Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM VULNEREBILITY VULNEREBILITY

27.10.26

 Cisco Expressway Series Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered VULNEREBILITY VULNEREBILITY

27.10.26

 btfilter.sys A vulnerable kernel driver that can be used to disable Code Integrity VULNEREBILITY DRIVE

27.10.26

 RCFlCtrl.sys RCFlCtrl.sys, labeled as "RedCastle Control Driver", is a vulnerable kernel driver that can be used to terminate arbitrary processes via IOCTL 0x85000158 VULNEREBILITY DRIVE

27.10.26

 tmnciesc.sys A vulnerable kernel driver that can be used to disable Code Integrity VULNEREBILITY DRIVE

27.10.26

 tosrfec.sys A vulnerable kernel driver that can be used to disable Code Integrity VULNEREBILITY DRIVE

27.10.26

 vdk.sys A vulnerable kernel driver that can be used to disable Code Integrity VULNEREBILITY DRIVE

27.10.26

 virtio_rng.sys A vulnerable kernel driver that can be used to disable Code Integrity VULNEREBILITY DRIVE

27.10.26

 vsapint.sys A vulnerable kernel driver that can be used to disable Code Integrity VULNEREBILITY DRIVE

27.10.26

 CVE-2026-109618 PHP Memory Corruption Vulnerability KEV KEV

27.10.26

 CVE-2026-109619 PHP Stale Internal Request-State Vulnerability KEV KEV

27.10.26

 CVE-2026-115884 mTLS client-certificate bypass: GoAhead's verifyClientCertificate() depth guard is skipped when the verifier reports a prior error, accepting an over-depth client chain on LibreSSL legacy-verifier builds (src/openssl.c). OpenSSL builds are not vulnerable. VULNEREBILITY VULNEREBILITY

27.10.26

 CVE-2026-115881 OpenSSL CRL loaded but not enforced in GoAhead sslOpen() (src/openssl.c): revoked client certificates are silently accepted (CWE-299, CWE-295) VULNEREBILITY VULNEREBILITY

27.10.26

 CVE-2026-80097 Microsoft Authenticator Elevation of Privilege Vulnerability VULNEREBILITY VULNEREBILITY

26.10.26

 CVE-2026-115889 affects Wasmtime across all processor architectures. VULNEREBILITY VULNEREBILITY

26.10.26

 CVE-2026-115893 affects only ARM64, also called aarch64. VULNEREBILITY VULNEREBILITY

26.10.26

 uCreator uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps MALWARE ANDROID

26.10.26

 Baohuo A backdoor for Android-based devices. Threat actors embedded it into a copy of the original version of the Telegram X messenger. It executes the attackers’ commands and allows them to steal victims’ confidential data and gain full control over their Telegram accounts. MALWARE ANDROID

26.10.26

 Markdown Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web HACKING AI

26.10.26

 Gheist Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles CAMPAIGN CAMPAIGN

25.10.26

 CVE-2026-93479 K000162607: NGINX map directive and regex matching vulnerability CVE-2026-93479 VULNEREBILITY VULNEREBILITY

25.10.26

 CVE-2026-97205 K000162608: NGINX ngx_http_core_module vulnerability CVE-2026-97205 VULNEREBILITY VULNEREBILITY

25.10.26

 CVE-2026-15176 K000162416: NGINX ngx_http_core_module vulnerability CVE-2026-15176 VULNEREBILITY VULNEREBILITY

25.10.26

 CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability KEV KEV

24.10.26

 CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

ECV

ECV

24.10.26

 CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

ECV

ECV

24.10.26

 CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

ECV

ECV

24.10.26

 CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability: Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

ECV

ECV

24.10.26

 CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability: Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.

ECV

ECV

24.10.26

 CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability: Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

ECV

ECV

24.10.26

 CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

ECV

ECV

24.10.26

 CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability: EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

ECV

ECV

24.10.26

 Fake Japanese Apps Deliver Black Hawk Android RAT STAR Labs has published a report on a recent Android malware campaign utilizing a WebSocket Remote Access Trojan (RAT) managed via control panels branded as Black Hawk or Eagle. The financially motivated threat actors distribute lightweight dropper apps disguised as well-known Japanese entities—including tax services, retail platforms, and messaging applications—as well as fake investment opportunities. ALERTS VIRUS

24.10.26

 PHP2Shell Vulnerabilities Allow Remote Code Execution in PHP Runtimes A pair of critical security flaws in the core PHP runtime engine, collectively designated PHP2Shell, have been disclosed. Tracked as CVE-2026-109618 and CVE-2026-109619, both are use-after-free conditions during out-of-memory error handling and request cleanup inside default PHP components, including upload-progress functions and request parsers. ALERTS VULNEREBILITY

24.10.26

 BRONZE SANDCASTLE Uses DLL Sideloading to Deploy Custom Meterpreter-Style Backdoor Researchers at the Sophos Counter Threat Unit recently reported on BRONZE SANDCASTLE, a China-based threat cluster active against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Research details how the group pairs legitimate signed executables, such as Sandboxie binaries, with a malicious DLL to sideload and decrypt an encrypted configuration payload directly in memory. ALERTS APT

24.10.26

 Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks Attackers have built an autonomous offensive agent that hunts the internet for exposed large language models (LLMs) and hijacks them to power a self-directed cybercrime operation. Once connected to an unprotected model, the agent is instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval. ALERTS AI

24.10.26

 Memory corruption vulnerabilities in PHP Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve arbitrary code execution. ALERT ALERT

24.10.26

 CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability KEV KEV

24.10.26

 CVE-2026-111497 Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs. VULNEREBILITY VULNEREBILITY

24.10.26

 Operation IXIM Operation IXIM: Preventing a botnet of millions of Popcorn Time users OPERATION OPERATION

24.10.26

 INC andTheGentlemen Ransomware Affiliates Uncovering the AI-Driven Offensive Infrastructure of REPORT REPORT

24.10.26

 BlackX UEFI Bootkit How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia MALWARE BOOTKIT

24.10.26

 CVE-2026-89078 Double Free issue in Regular Expression Parser (GitLab 19.4.1) VULNEREBILITY VULNEREBILITY

24.10.26

 CVE-2026-93577 Integer Overflow issue in Regular Expression Compiler (GitLab 19.4.1) VULNEREBILITY VULNEREBILITY

24.10.26

 CVE-2026-97229 Integer Overflow issue in CI/CD Regular Expression Compiler (GitLab 19.4.2) VULNEREBILITY VULNEREBILITY

24.10.26

 CVE-2026-110264 Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1) VULNEREBILITY VULNEREBILITY

24.10.26

 k0t's Stray Cat, Open Doors: How k0t Wanders Through the Network Edge GROUPS GROUPS

24.10.26

 Krybit Ransomware Krybit is the name of a ransomware-as-a-service (RaaS) operation that first surfaced in early 2026. The group rents out the ransomware it has developed to affiliates who carry out attacks on its behalf, splitting ransoms extorted from victims 80:20 (80% to affiliates, 20% to the Krybit operators) in exchange for access to the malware, a dashboard, and round-the-clock technical support. RANSOM RANSOM

24.10.26

 Operation Serengeti III Participating authorities reportedly recovered an additional $105 million during Operation Serengeti III, targeting cybercrime networks across Africa. In earlier Serengeti operations, INTERPOL recognized Fortinet and the World Economic Forum’s Cybercrime Atlas as operational partners; Fortinet is a founding grantor of the initiative. OPERATION OPERATION

24.10.26

 BRONZE SANDCASTLE Counter Threat Unit™ (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. APT APT

23.10.26

 MythicRatatoskr MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration MALWARE GO

23.10.26

 InvisiMole InvisiMole: Surprisingly equipped spyware, undercover since 2013 MALWARE SPYWARE

23.10.26

 CVE-2026-112900 Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option VULNEREBILITY VULNEREBILITY

23.10.26

 Node2Shell Node2Shell: From Brotli Data to Remote Code Execution VULNEREBILITY VULNEREBILITY

23.10.26

 25 Vulnerabilities in the x402 Protocol V12 found 25 vulnerabilities in the x402 protocol. This post explores three critical findings, from payment bypass to session takeover and token theft. VULNEREBILITY VULNEREBILITY

22.10.26

 QPACK amplification attacks against HTTP/3 servers A remote, unauthenticated client can force an HTTP/3 server to allocate tens to thousands of times more memory than it sends. One connection is enough to OOM or pin a default-configured server. Seven of the ten implementations tested are vulnerable; several are already fixed. ATTACK ATTACK

22.10.26

 LiteLLM Hijacked Again LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code HACKING HACKING

22.10.26

 Node.js released security updates Wednesday, October 21, 2026 Security Releases VULNEREBILITY SOFTWARE PATCH REPORTS

22.10.26

 Vulnerabilities in PHP Affecting Cisco Products: October 2026 On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruptionCVE-2026-109619 - RCE via stale global stateFor information about VULNEREBILITY VULNEREBILITY

22.10.26

 Cisco Unified Communications Products Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM VULNEREBILITY VULNEREBILITY

22.10.26

 Cisco Expressway Series Remote Code Execution Vulnerability A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.This vulnerability is due to the use of VULNEREBILITY VULNEREBILITY

22.10.26

 Multiple Cisco Products Snort 3 Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered VULNEREBILITY VULNEREBILITY

22.10.26

 Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device.This vulnerability is due to insufficient validation of user-supplied VULNEREBILITY VULNEREBILITY

22.10.26

 Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user.This vulnerability is due to a lack of authentication when a local user VULNEREBILITY VULNEREBILITY

22.10.26

 Cisco Expressway Series Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered VULNEREBILITY VULNEREBILITY

22.10.26

 Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network VULNEREBILITY VULNEREBILITY

22.10.26

 Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition VULNEREBILITY VULNEREBILITY

22.10.26

 Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities Multiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition VULNEREBILITY VULNEREBILITY

22.10.26

 Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. VULNEREBILITY VULNEREBILITY

22.10.26

 Multiple Cisco Products Snort 3 Denial of Service Vulnerability Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. VULNEREBILITY VULNEREBILITY

22.10.26

 Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine VULNEREBILITY VULNEREBILITY

22.10.26

 Cisco Expressway Series Information Disclosure Vulnerability A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning VULNEREBILITY VULNEREBILITY

22.10.26

 Cisco Unified Communications Manager Improper Access Control Vulnerability A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device VULNEREBILITY VULNEREBILITY

22.10.26

 PHP2Shell PHP2Shell is a family of critical vulnerabilities recently fixed in core PHP, with severity reaching CVSS 9.2, that can allow unauthenticated attackers to execute code or expose sensitive process memory. PHP powers approximately 70% of websites, including platforms such as WordPress, Drupal and Wikipedia's MediaWiki. EXPLOIT EXPLOIT

22.10.26

 TAG-217 TAG-217 Targets South Korean Financial Services with ARTEX GROUPS GROUPS

22.10.26

 GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 On October 21, 2026, we released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE). VULNEREBILITY SOFTWARE PATCH REPORTS

22.10.26

 Payload 2 Payload 2: the backdoor in sitecustomize.py MALWARE PYTHON

21.10.26

 ROMULUS Delivers Payloads Through ClickFix Researchers at Forescout recently reported on a multi-payload delivery framework named ROMULUS that leverages social engineering lures based on the ClickFix technique. The threat platform acts as a flexible backend that orchestrates staging scripts and trojanized installer packages to compromise victim endpoints. ALERTS VIRUS

21.10.26

 QuartzLine Zenith Backdoor The researchers from Expel reported on a malicious program known as QuartzLine, that disguises itself as a fully functional PDF reader for Windows systems. Because the application operates as expected, victims rarely suspect foul play or remove the software. ALERTS VIRUS

21.10.26

 Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries Russian espionage group Swallowtail (aka APT28, Fancy Bear, Forest Blizzard) targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. All three targets were likely to hold information of direct interest to a foreign intelligence service. ALERTS APT

21.10.26

 GhostProfile MacOS malware Cybersecurity analysts at Moonlock Lab recently examined a novel macOS threat named GhostProfile. Classified as a hidden Virtual Network Computing (hVNC) strain, this malware covertly duplicates local Chrome and Firefox user profiles. ALERTS VIRUS

21.10.26

 Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API. ALERT ALERT

21.10.26

 #StopRansomware: SafePay Ransomware Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. RANSOM RANSOM

21.10.26

 Cisco Unified Intelligence Center SQL Injection Vulnerability A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device.This vulnerability is due to insufficient validation of user-supplied input. VULNEREBILITY VULNEREBILITY

21.10.26

 Operation SyncHole Operation SyncHole: Lazarus APT goes back to the well OPERATION OPERATION

21.10.26

 Operation FlashHole In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy. OPERATION OPERATION

21.10.26

 CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability KEV KEV

21.10.26

 CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability KEV KEV

21.10.26

 CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability KEV KEV

21.10.26

 CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability   KEV KEV

21.10.26

 CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability KEV KEV

20.10.26

 CVE-2026-110936 A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. VULNEREBILITY VULNEREBILITY

20.10.26

 KGB RAT - a commodity malware sold as Malware-as-a-Service Cybersecurity experts at Group-IB recently examined KGB RAT, a Windows malware strain advertised on dark web forums since late 2025. Disguised as a standard system administration utility, KGB RAT is distributed under the Malware-as-a-Service (MaaS) model and stands out by combining traditional espionage and extortion tools - such as password harvesting, keystroke logging, desktop control, and file encryption with a number of psychological harassment capabilities including forced BSODs and screamer functions. ALERTS VIRUS

20.10.26

 UAT-6275 Intrusion Activity Directed Against CIS Government Agencies In a recent write-up, Cisco Talos details espionage operations conducted by UAT-6275 targeting public sector, environmental, and energy organizations across the Commonwealth of Independent States. The threat group relies on multiple initial distribution methods, including malicious Word documents, PS2EXE downloaders, shortcut files, and archive payloads leveraging a WinRAR vulnerability (CVE-2025-8088). ALERTS APT

20.10.26

 Hirudo Android Malware Security researchers at ThreatFabric reported on "Hirudo," an advanced Android financial malware that merges real-time device hijacking with credential harvesting. Unlike typical mobile trojans that simply superimpose counterfeit login windows over legitimate software, Hirudo uninstalls legitimate financial applications and substitutes them with tampered versions engineered to internally bypass security defenses, such as Play Integrity checks and signature verifications. ALERTS VIRUS

20.10.26

 Aoki: Infostealer Targets AI Coding Assistant Credentials The Aoki (aka Aokigahara) infostealer has begun stealing credentials for AI coding assistants. Recent versions of Aoki analyzed by the Symantec Threat Hunter Team were designed to harvest credential and session files for Claude, OpenAI's Codex, Cursor, Codeium and Gemini, alongside the browser, cryptocurrency wallet and password manager data that infostealers typically collect. ALERTS VIRUS

20.10.26

 MATCHBOIL Downloader Evolving in Targeted Campaign Against Ukrainian Entities According to ESET Research, UAC-0099, a Russian aligned threat actor group, has been developing and deploying the MATCHBOIL downloader since about 2024. It targets Ukrainian government, financial and media organizations and may serve as an initial access broker for Sandworm. The infection chain starts with a spearphishing link that downloads an archive containing a VBScript. ALERTS VIRUS

20.10.26

 Another phishing campaign distributing AgentTesla observed in the wild Security researchers at ASEC recently uncovered a new phishing campaign distributing the AgentTesla malware. Attackers lure victims with emails masqueraded as commercial proposal inquiries, urging recipients to evaluate an attached compressed archive for product pricing and inventory details. Instead of a legitimate document, this archive conceals a malicious .NET executable. ALERTS CAMPAIGN

20.10.26

 XWorm Malware Evolves Into Advanced Surveillance Platform In a recent write-up, Netskope Threat Labs details how XWorm has transformed from a conventional information stealer into an intrusive surveillance toolkit. Due to publicly leaked builder binaries and source code, detection volume for the malware expanded fourfold, with significant focus on the financial sector. ALERTS VIRUS

20.10.26

 Warden Stealer Gen Threat Labs has published a report on Warden Stealer, a Rust-based malware-as-a-service infostealer targeting configuration files and local data belonging to AI assistants and agentic coding tools. Distributed through cracked software, game cheats, malvertising, and ClickFix campaigns, the malware heavily obfuscates its builds using code morphing to bypass security scans. ALERTS VIRUS

20.10.26

 Fake GitHub sign-in alerts used to steal developer OAuth tokens According to Apiiro, security researchers observed a massive automated campaign re-arming a fleet of more than 17,000 malicious GitHub repositories linked to the FakeGit ecosystem. Skipping the need for new infrastructure, the threat actor utilizes a tactic termed RePointing, executing rapid, automated commits to update existing project README files so their download links redirect to fresh ZIP archives. ALERTS HACKING

20.10.26

 PAPERMILL PAPERMILL: Tracking an Emerging China-Nexus Malware Factory MALWARE LOADER

20.10.26

 ROMULUS ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform MALWARE LOADER

20.10.26

 libwasys.sys OPSWAT's libwasys.sys (OESIS V4 Helper Driver) exposes process termination through IOCTL 0x22E00C on \\.\WasysControl. Jehad Abudagga's KillerLand research publishes a proof of concept that submits a four-byte target PID and reports termination of protected AV/EDR processes. Static analysis of versions 10.3.85.0 and 10.3.2951.0 VULNEREBILITY DRIVE

20.10.26

 MonProcessControl.sys HONOR's MonProcessControl.sys version 1.0.0.1 exposes process termination through IOCTL 0x22400C on \\.\MonProcessControl. Jehad Abudagga's KillerLand research publishes a proof of concept that submits a four-byte target PID and reports termination of protected AV/EDR processes. Static analysis confirms that the handler opens the supplied PID with ZwOpenProcess using a kernel handle and calls ZwTerminateProcess. VULNEREBILITY DRIVE

20.10.26

 RtsUpx.sys Realtek RtsUpx.sys 1.13.0.0 is within the affected range through 1.14.0.0. CVE-2021-36925 permits unauthorized physical-memory read/write through crafted device requests. Related vulnerabilities affect USB device access (CVE-2021-36922), privileged IN/OUT instructions (CVE-2021-36923), and pool memory handling (CVE-2021-36924). Static inspection of this sample confirms caller-controlled physical-memory mapping and copying in the device-control handler. VULNEREBILITY DRIVE

20.10.26

 heysafe_drv.sys heysafe_drv.sys is a HeySafe-X protection minifilter submitted as a malicious process killer in issue #468. Static analysis verifies a caller-validated communication port whose message opcode 0x67 queues process-tree termination and attempts to clear ProcessBreakOnTermination before ZwTerminateProcess.  VULNEREBILITY DRIVE

20.10.26

 CVE-2026-96652 (CVSS score: 5.3) - An unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint by taking advantage of the fact that the "protocol" parameter is inserted into a programmatically-constructed player URL with no validation, allowing an attacker to force the Plex server to POST to a destination of their choice. VULNEREBILITY VULNEREBILITY

20.10.26

 CVE-2026-96654 (CVSS score: 6.9) - An improper neutralization of URL values included in the "searchOne" endpoint that could allow an attacker to call other plugins' functions and supply their own parameters to obtain the owner's admin token. VULNEREBILITY VULNEREBILITY

20.10.26

 CVE-2026-96655 (CVSS score: 5.3) - An SSRF vulnerability that allows an authenticated user (i.e., the owner token) to request arbitrary internal or external addresses (e.g., an attacker-hosted carrier video carrying the malicious ELF payload) via the '/video/:/transcode/universal' path parameter. VULNEREBILITY VULNEREBILITY

20.10.26

 CVE-2026-96656 (CVSS score: 8.6) - An external control of file name or path vulnerability that allows the ELF shared object to an attacker-chosen path in the Codecs directory and execute it. VULNEREBILITY VULNEREBILITY

19.10.26

 CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

ECV

ECV

19.10.26

 CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability: BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

ECV

ECV

19.10.26

 CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

ECV

ECV

19.10.26

 CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

ECV

ECV

19.10.26

 CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability: Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.

ECV

ECV

19.10.26

 CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

ECV

ECV

19.10.26

 CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

ECV

ECV

19.10.26

 CVE-2026-96951 Microsoft Windows Command Injection Vulnerability: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

ECV

ECV

19.10.26

 CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

ECV

ECV

19.10.26

 Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are providing this Public Service Announcement (PSA) to raise awareness of the cyber threats facing election and campaign officials during the upcoming 2026 U.S. midterm elections. IC3 IC3 PRESS

19.10.26

 Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation This document sets out ten voluntary key practices to guide emerging approaches in the management of incidents that might occur during the training and evaluation of super intelligence (SI) agents. While these incidents highlight the importance of traditional
cybersecurity principles and practices, they also introduce novel considerations for incident prevention, response, and reporting. These novel considerations primarily stem from the agentic nature and advanced cyber capabilities of cutting-edge SI systems.		 REPORT REPORT

19.10.26

 CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability KEV KEV

19.10.26

 CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability KEV KEV

19.10.26

 CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability KEV KEV

19.10.26

 CVE-2026-110447 Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. VULNEREBILITY VULNEREBILITY

19.10.26

 Proxyjacking Proxyjacking Edge Devices Into Residential Proxies HACKING HACKING

19.10.26

 The Validation Gap: What Automated Pentesting Alone Cannot See A Practitioner's Guide to Evaluating Security Validation Across Your Full Attack Surface REPORT REPORT

19.10.26

 CVE-2026-33032 Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". VULNEREBILITY VULNEREBILITY

19.10.26

 The 2026 State of
Agentic AI in Pentesting		 Insights from 200 security leaders on the future of AI-driven offensive security REPORT REPORT

19.10.26

 CVE-2026-89108 SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. VULNEREBILITY VULNEREBILITY

19.10.26

 CVE-2026-58231 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. VULNEREBILITY VULNEREBILITY

19.10.26

 CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. VULNEREBILITY VULNEREBILITY

19.10.26

 ConnectWise incident From time to time, ConnectWise will provide communications on broader security related topics that may not be linked to a specific ConnectWise product or vulnerability, but are still of importance to our partner community. INCIDENT INCIDENT

17.10.26

 CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability KEV KEV

17.10.26

 CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability KEV KEV

17.10.26

 XWorm Reborn In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. MALWARE INFOSTEALER

17.10.26

 cikabika Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity. MALWARE BOT

17.10.26

 MALFEX The MALFEX campaign is a long-running npm supply-chain attack that delivers Remote Access Trojans (RAT), information stealers, or open Node.js processes as payloads. Learn about how the attack works, how to find out if you’re impacted, and what response actions to take. CAMPAIGN CAMPAIGN

17.10.26

 Qilin Ransomware Qilin ransomware combines file encryption with an affiliate operation that manages victims, ransom negotiations, and stolen-data publication. Different intrusion teams deploy its payloads, so identifying Qilin does not automatically identify the attacker or the method used to enter a network. RANSOM RANSOM

17.10.26

 YuanKong RAT Most Android RATs try hard to hide their server. This one barely hides anything and that turns out to be the interesting part. The dropper leaves the key under the mat: a vault-config.json sitting in assets/ right next to the ciphertext it unlocks, holding the key and IV in cleartext. MALWARE RAT

17.10.26

 Rokarolla The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. MALWARE ANDROID

17.10.26

 BlockStrap BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. VULNEREBILITY VULNEREBILITY

17.10.26

 QuartzLine QuartzLine is a working PDF viewer with a backdoor hidden inside. In public analysis so far, the attacker never sent a command in any traffic researchers could decrypt. MALWARE BACKDOOR

17.10.26

 Big Fish Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. EXPLOIT EXPLOIT

17.10.26

 PhantomPolia The campaign uses PhantomPolia, a JavaScript loader that retrieves an encrypted configuration from an Ethereum Sepolia smart contract through public Remote Procedure Call (RPC) endpoints. The loader then decrypts the configuration locally using PBKDF2 and AES-GCM, revealing the next-stage command-and-control (C2) domain without exposing it directly on the compromised site. CAMPAIGN CAMPAIGN

17.10.26

 PwnEscape On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: VULNEREBILITY VULNEREBILITY

17.10.26

 n0n Group A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping. On October 12, 2026, the group added 38 organizations to its Dark Web leak site in one batch: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. GROUPS GROUPS

17.10.26

 ARTokens 5.1.2 ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. PHISHING PHISHING KIT

17.10.26

 ARMORY CASTLE On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. EXPLOIT EXPLOIT

17.10.26

 GhostX Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. MALWARE RAT

17.10.26

 Warden Stealer Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. MALWARE STEALER

17.10.26

 Aoki Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini. MALWARE INFOSTEALER

17.10.26

 UAT-11985 Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. GROUPS GROUPS

17.10.26

 UAT-6275 Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. GROUPS GROUPS

16.10.26

 PEERSTITCH Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. MALWARE ARM64

16.10.26

 CVE-2025-61624 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions,

VULNEREBILITY

VULNEREBILITY

16.10.26

 TAG-193 TAG-193’s Regional Espionage Operations GROUPS GROUPS

16.10.26

 Hydra Saiga Hydra Saiga: Covert Espionage and Infiltration of Critical Utilities GROUPS GROUPS

16.10.26

 CVE-2025-25257 An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

VULNEREBILITY

VULNEREBILITY

16.10.26

 CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief.

VULNEREBILITY

VULNEREBILITY

16.10.26

 Candiru Candiru is a secretive Israel-based company that sells spyware exclusively to governments. Using Internet scanning, we identified more than 750 websites linked to Candiru’s spyware infrastructure. MALWARE SPYWARE

15.10.26

 AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware MALWARE Ad

15.10.26

 KGB RAT KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize MALWARE RAT

15.10.26

 Mitigating Insider Threats to U.S. Election Systems Elections in the United States are administered at the state and local levels of government, creating a diverse landscape of election systems and technologies across the country. Our national exercise in self-government also requires the support of vast groups of people, including election workers, vendors, contractors, temporary workers, and volunteers. IC3 IC3 INDUSTRY

15.10.26

 FBI Cautions About Threats to Election Workers Ahead of the November 2026 Midterm Election Threats to election workers not only endanger the safety of the individuals involved but also jeopardize the stability of the US electoral process. The FBI defines "election workers" broadly as individuals who have responsibility over one or more aspects of election administration, including elected officials, appointed officials, staff, volunteers, contractors, vendors, and liaisons. IC3 IC3 PRESS

15.10.26

 FBI Warns Voters on Election Crimes Ahead of the November 2026 Midterm Election Free and fair democratic elections are one of the foundational pillars of the United States. The FBI is committed to protecting every eligible citizen's right to vote. Consistent with past practice, the FBI is providing this information to educate voters about federal election crimes and how to avoid them, and to encourage voters to report suspected violations to the FBI. IC3 IC3 PRESS

15.10.26

 Scammers Exploit 2026 U.S. Midterm Election to Perpetrate Multiple Fraud Schemes The FBI warns the public that scammers could exploit the 2026 US Midterm Election to perpetrate financial fraud schemes. These schemes target victims across the United States and have previously exploited state and local elections. This PSA is an update to alert number I-102924-PSA, published on 29 October 2024, titled “Scammers Exploit 2024 US General Election to Perpetrate Multiple Fraud Schemes.” IC3 IC3 PRESS

15.10.26

 GHSA-673q-mjm6-r5xr App Router apps with Cache Components enabled, where a use cache function returns more than one typed array

VULNEREBILITY

VULNEREBILITY

15.10.26

 GHSA-2464-fhr4-w9xw Apps that pass attacker-supplied SVG files to sharp on glibc-based Linux

VULNEREBILITY

VULNEREBILITY

15.10.26

 GHSA-p3m5-59mp-jv5r App Router apps with at least one Server Action

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-108097 Drupal core - Critical - Remote code execution - SA-CORE-2026-014

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-15176 Heap overflow in a worker process: crash, possibly code execution

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-93479 Heap overflow in a worker process: crash, possibly code execution

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-97205 Use-after-free in a worker process: crash, memory corruption, possibly code execution

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-95101 Extra bytes injected into a proxied request, or a body past client_max_body_size

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-97629 A forged TLS session that could bypass client-certificate verification (non-deterministic and beyond the attacker's control, F5 says)

VULNEREBILITY

VULNEREBILITY

15.10.26

 GhostAction campaign GitGuardian reported a campaign titled "GhostAction": attackers with write access to GitHub repositories - gained by an unknown initial access vector - added a malicious GitHub Actions workflow that exfiltrates CI/CD secrets via HTTP POST to an attacker-controlled endpoint.

CAMPAIGN

CAMPAIGN

15.10.26

 CVE-2026-105740 Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-105133 A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely.

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-105134 A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection.

VULNEREBILITY

VULNEREBILITY

15.10.26

 CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability KEV KEV

15.10.26

 CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability KEV KEV

15.10.26

 CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability  KEV KEV

15.10.26

 CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability KEV KEV

15.10.26

 Iron Man Resecurity identified and mapped the infrastructure supporting a commercial phishing-kit-as-a-service (PhaaS) operation marketed under the name “Iron Man System.” The kit is sold to criminal buyers as a self-hosted package that deploys pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms and loyalty programmes, then captures the data victims submit. PHISHING PHAAS

15.10.26

 Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review.

VULNEREBILITY

VULNEREBILITY

15.10.26

 Cisco Secure Email Gateway Arbitrary File Write Vulnerability A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.This vulnerability is due to improper handling of email attachments when the file

VULNEREBILITY

VULNEREBILITY

14.10.26

 Google BoringSSL Name Constraints Bypass in SAN Validation Logic Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined. ALERT ALERT

14.10.26

 Multiple TLS Libraries can Bypass Delegation Enforcement This note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a constrained name may be accepted by one library and rejected by another. Some are fixed, some remain under review, and some were not accepted as security issues. ALERT ALERT

14.10.26

 Bisheng has authentication bypass vulnerabilities Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; ALERT ALERT

14.10.26

 Komodo Periphery Agent Contains an OS Command Injection Vulnerability Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure. ALERT ALERT

14.10.26

 Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. ALERT ALERT

14.10.26

 Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify. ALERT ALERT

14.10.26

 XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. ALERT ALERT

14.10.26

 Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1 Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side and client-side attack surfaces. ALERT ALERT

14.10.26

 Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-96951 (CVSS score: 8.8) - A command injection vulnerability in Windows Shell that allows an unauthorized attacker to bypass a security feature over a network.

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-108398 (CVSS score: 8.8) - An untrusted search path vulnerability in .NET Framework that allows an authorized attacker to bypass a security feature locally.

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-92707 (CVSS score: 5.3) - An improperly controlled sequential memory allocation vulnerability in MessagePack-CSharp that allows an unauthorized attacker to deny service over a network.

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-106042 An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-89111 OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-96951 Microsoft Windows Command Injection Vulnerability KEV KEV

14.10.26

 CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability KEV KEV

14.10.26

 CVE-2026-92392 During an upload, curl mishandles HTTP/2 RST_STREAM received from the server (with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after free of a struct Curl_easy object.

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-83498 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

VULNEREBILITY

VULNEREBILITY

14.10.26

 Vghost vq->meta_iotlb[] caches the IOTLB mapping behind each vring metadata region (desc / avail / used). VHOST_SET_VRING_ADDR and VHOST_SET_VRING_NUM do not reset that cache. With a device IOTLB attached, a live vq can translate a reconfigured vring through a mapping that no longer covers it. vhost_vq_meta_fetch() has no range check, and the result is passed to __copy_to_user() / __copy_from_user().

VULNEREBILITY

VULNEREBILITY

14.10.26

 Hirudo Hirudo: From Fake Updates to Patched Banking Apps MALWARE BANKING

14.10.26

 CVE-2026-85045 Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

VULNEREBILITY

VULNEREBILITY

14.10.26

 CVE-2026-78952 Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-97229 GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-92883 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users’ browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-16301 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-14814 GitLab has remediated an issue that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users’ CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-81839 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group’s privileges due to improper cleanup of scheduled pipeline execution policy records.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-96893 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-101168 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-7767 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-16275 GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-84284 GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-85529 GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-100755 GitLab has remediated an issue that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-78335 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token’s scope, due to incorrect authorization checks.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-100104 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a time-of-check to time-of-use race condition in URL validation during repository import operations.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-82632 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token’s intended scope, due to incorrect authorization of the import target namespace.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-103549 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package protection rules restrict to higher roles, due to improper authorization checks.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-9268 GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-85947 Create a persistent administrator account, potentially giving complete administrative control of the server

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-85948 Gain persistent administrative control, through an XQuery injection flaw in a deprecated Management API path

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-85955 Run server-side code with elevated permissions

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-85956 Back up or restore forests outside its own database, allowing access to or changes to what Progress calls "security-critical data"

VULNEREBILITY

VULNEREBILITY

13.10.26

 CVE-2026-9191 Perform unauthorized actions or compromise an authenticated session

VULNEREBILITY

VULNEREBILITY

13.10.26

 Keenadu Android devices ship with firmware-level malware MALWARE ANDROID

13.10.26

 Android.Phantom Android.Phantom trojans are bundled with modded games and popular apps to infiltrate smartphones. They use machine learning and video broadcasts to engage in click fraud MALWARE ANDROID

12.10.26

 CVE-2026-102258 Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

VULNEREBILITY

VULNEREBILITY

12.10.26

 CVE-2026-102257 A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.

VULNEREBILITY

VULNEREBILITY

12.10.26

 CVE-2026-102256 Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

VULNEREBILITY

VULNEREBILITY

10.10.26

 FakeGit Infrastructure Re-Armed in Large-Scale RePointing Campaign According to Apiiro, security researchers observed a massive automated campaign re-arming a fleet of more than 17,000 malicious GitHub repositories linked to the FakeGit ecosystem. Skipping the need for new infrastructure, the threat actor utilizes a tactic termed RePointing, executing rapid, automated commits to update existing project README files so their download links redirect to fresh ZIP archives. ALERTS CAMPAIGN

10.10.26

 Earth Sirrush Espionage Group Refines Toolset Against Ukrainian Targets Researchers at TrendAI recently reported on Earth Sirrush, a Russia-aligned intrusion set, also tracked as UAC-0099 and previously as SHADOW-EARTH-065, that has run espionage operations since at least 2022. Its targets are mainly Ukrainian government bodies, defense organizations, border units and logistics operators, reached through spear-phishing lures that pose as the national police, border guard, tax and justice authorities. ALERTS APT

10.10.26

 AI-Branded Ad Phishing campaign In a recent write-up, researchers at Island detail a human-operated phishing platform disguised as a range of AI advertising products, including a fake "Muse Ads" tool that went live eight days after Meta announced Muse. The campaign targets agency staff, media buyers and Google Ads manager-account administrators, whose accounts carry stored payment methods and access to multiple client accounts. Victims arrive through invitation emails at a branded product page. ALERTS PHISHING

10.10.26

 Targeted Intrusion Campaign Leverages Trojanized Coding Assessments Researchers at Unit 42 from Palo Alto Networks recently reported on an intrusion campaign designated as Blinder Tunnel, which targeted critical infrastructure entities in Iraq. The threat actor behind the activity impersonated the IT department of an aviation enterprise to deliver trojanized coding assessments to targeted individuals. ALERTS HACKING

10.10.26

 Cling botnet In a recent write-up, Nozomi Networks details a novel botnet dubbed Cling that targets internet-exposed IoT and networking devices. Per the report, initial access relied on exploiting a known vulnerability in Realtek Jungle SDK diagnostic components (CVE-2021-35394) alongside multiple command-injection flaws across router and CCTV products. ALERTS BOTNET

10.10.26

 BPFDoor and AVERAT activity continues Researchers at Rapid7 recently reported a cluster of Linux malware targeting telecom and network-edge environments with regionalized process spoofing. The activity involves a dropper that deploys customized builds of BPFDoor, BPF Rekoobe, and a new modular implant tracked as AVERAT. ALERTS VIRUS

10.10.26

 Vidar and Remus infostealers distributed with help of new 2CLoader Zscaler ThreatLabz uncovered a previously undocumented loader malware dubbed 2CLoader. This modular loader has been observed facilitating the delivery of credential-harvesting tools including Vidar and Remus, alongside the XWorm malware strain. ALERTS VIRUS

10.10.26

 CVE-2025-30241 Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.

VULNEREBILITY

VULNEREBILITY

10.10.26

 CVE-2025-30240 The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem.

VULNEREBILITY

VULNEREBILITY

10.10.26

 CVE-2025-30239 In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

VULNEREBILITY

VULNEREBILITY

10.10.26

 CVE-2025-30238 In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

VULNEREBILITY

VULNEREBILITY

10.10.26

 CVE-2025-30237 The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.

VULNEREBILITY

VULNEREBILITY

10.10.26

 CVE-2026-47483 NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests.

VULNEREBILITY

VULNEREBILITY

10.10.26

 GhostAction New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

CAMPAIGN

CAMPAIGN

10.10.26

 ARTEX Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance GROUPS GROUPS

10.10.26

 SCARLET LOOP A model discovers and qualifies 6,171 companies that move money. An autonomous agent tests credentials and exploits login weaknesses. At least 11,832 credentials validated as active across 107 countries.

REPORT

REPORT

10.10.26

CVE-2015-3306

ProFTPD Improper Access Control Vulnerability: ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

ECV

ECV

10.10.26

CVE-2021-3199

ONLYOFFICE Docs Server Path Traversal Vulnerability: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

ECV

ECV

10.10.26

CVE-2023-22894

Strapi Cleartext Storage of Sensitive Information Vulnerability: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

ECV

ECV

10.10.26

CVE-2016-3081

Apache Struts Command Injection Vulnerability: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

ECV

ECV

10.10.26

CVE-2015-5477

ISC BIND Data Processing Errors Vulnerability: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

ECV

ECV

10.10.26

CVE-2026-88779

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability: Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

ECV

ECV

10.10.26

 Dire Wolf Ransomware Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. RANSOM RANSOM

10.10.26

 Earth Sirrush Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns. CAMPAIGN CAMPAIGN

10.10.26

 Tensorlake tensorlake@0.5.144 on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory. MALWARE PYTHON

10.10.26

 NEBULA CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. MALWARE PYTHON

10.10.26

 AgentCorruption: One Role to Rule Them Al Exploring what the agent's default execution role and stolen credentials can actually do, and how they became an entry point to the entire region - discovering and invoking other agents, reading, deleting and hijacking private conversations through chat history tampering, and more. HACKING AI

10.10.26

 AgentCorruption: Credential Theft from AWS's Secrets Manager and More Up to now, we showed how far we could get once we had the over-privileged role in hand: we were able to pull container images, talk to other agents that we were never allowed to, read private conversations, plant short- and long-term memories to control agents’ behavior and delete user data. All of this stays within the AWS region boundary. HACKING AI

10.10.26

 AgentCorruption: Weaponizing Agent Memory for Persistent Hijacking How access to AgentCore Memory let us plant instructions that survived beyond the initial compromise, turning an agent's remembered context into a channel for persistent command and control. HACKING AI

10.10.26

 AgentCorruption: Initial IMDS Access How a single prompt to a public-facing AgentCore agent exposed the instance metadata endpoint, the agent's cloud identity, and its container image: the foothold for everything that follows in this series. HACKING AI

10.10.26

 DarkSword/Coruna Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. EXPLOIT EXPLOIT

10.10.26

 Warden Stealer Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. MALWARE STEALER

10.10.26

 UAT-11985 Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. GROUPS APT

10.10.26

 MATCHBOIL ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026 MALWARE DOWNLOADER

9.10.26

 CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java" component. VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2026-105134 (CVSS v4 score: 9.3) - An operating system command injection vulnerability in the Replication Receiver component. VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2021-3199 (CVSS score: 9.8) - A path traversal vulnerability in ONLYOFFICE Docs that can occur when JSON Web Token (JWT) is used, via a "/.." sequence in an image upload parameter and could allow for remote code execution. VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2023-22894 (CVSS score: 7.2) - A cleartext storage of sensitive information vulnerability in Strapi that could allow an attacker with access to the admin panel to discover sensitive user details via the query filter. VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2016-3081 (CVSS score: 8.1) - A command injection vulnerability in Apache Struts that could allow a remote attacker to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2015-5477 (CVSS score: 7.5) - A reachable assertion vulnerability in ISC BIND that could allow a remote attacker to cause a denial-of-service via TKEY queries. VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2026-107406 Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406 VULNEREBILITY VULNEREBILITY

9.10.26

 CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV KEV

9.10.26

 CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability KEV KEV

9.10.26

 CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability KEV KEV

9.10.26

 Chinese Government-linked Cyber Threat
Actors Combine Automated and Handson Hacking Tools to Steal Sensitive Data		 Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. REPORT REPORT

8.10.26

 RatPressto Phish Kit Fortra Intelligence and Research Experts (FIRE) has discovered an active phishing campaign leveraging a reusable Adobe-themed phishing kit deployed across multiple compromised WordPress websites. PHISHING Phish Kit

8.10.26

 MALFEX campaign MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work CAMPAIGN CAMPAIGN

8.10.26

 Cisco Meraki Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco License (Smart Software Manager) On-Prem Vulnerabilities Multiple vulnerabilities in the web-based management interface and API endpoints of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow a remote attacker to gain unauthorized access, access sensitive information, cause a denial of service (DoS) VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities Multiple vulnerabilities in the Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as Next Generation OAM (NGOAM), could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco NX-OS Software Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco Finesse Server-Side Request Forgery Vulnerability A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.This vulnerability is due to improper input validation for specific HTTP requests VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco NX-OS Software Control Plane Denial of Service Vulnerability A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco NX-OS Software Python Sandbox Escape Vulnerability A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device.This vulnerability is due to VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative VULNEREBILITY VULNEREBILITY

8.10.26

 Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts.This vulnerability is VULNEREBILITY VULNEREBILITY

8.10.26

 PoeLLM Canto incognito: tracking the PoeLLM malware MALWARE AI

8.10.26

 CVE-2026-102255 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations. VULNEREBILITY VULNEREBILITY

8.10.26

 CVE-2026-105192 LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. VULNEREBILITY VULNEREBILITY

8.10.26

 CVE-2026-105756 Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service VULNEREBILITY VULNEREBILITY

7.10.26

 FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts FortiBleed refers to a credential-harvesting and access-broker operation whose internal workflow became visible only after the threat actors unintentionally exposed their own backend server. The open directory revealed a mature, multi-stage campaign targeting FortiGate SSL VPN appliances, harvesting credentials at scale, and cracking them using a distributed graphics processing unit (GPU) cluster. IC3 IC3 INDUSTRY

7.10.26

 LUNEXSTEALER In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers. When visiting such a site, the user was shown a fake Cloudflare verification page, which, under the pretext of confirming that the visitor was a human, offered to execute a command. MALWARE LINUX

7.10.26

 CyberXero SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. HACKING AI

7.10.26

 CrocoRat ClickFix campaigns have become one of the most effective ways to turn a browser session into code execution. The technique is simple: show the victim a fake verification page, place a command on the clipboard, and convince them to paste it into the Windows Run dialog. MALWARE RAT

7.10.26

 IronChain During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why. It puts business-critical data at risk of permanent loss and can bring operations to a halt. RANSOM RANSOM

7.10.26

 Android Security Bulletin—October 2026 This Android Security Bulletin contains details of security vulnerabilities that affect Android devices. Security patch levels of 2026-10-01 or higher address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. VULNEREBILITY SOFTWARE PATCH REPORTS

7.10.26

 Pixel Update Bulletin—October 2026 The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices (Google devices). For Google devices, security patch levels of 2026-10-05 or later address all issues in this bulletin and all issues in the October 2026 Android Security Bulletin. VULNEREBILITY SOFTWARE PATCH REPORTS

7.10.26

 BPFDoor SMTP is the key: BPFDoor and AVERAT hitting the network edge MALWARE DROPPER

6.10.26

 CVE-2026-71168 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. VULNEREBILITY VULNEREBILITY

6.10.26

 CVE-2026-63697 Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. VULNEREBILITY VULNEREBILITY

6.10.26

 CVE-2026-86362 Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. VULNEREBILITY VULNEREBILITY

6.10.26

 CVE-2026-86361 Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. VULNEREBILITY VULNEREBILITY

6.10.26

 CVE-2026-86360 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. VULNEREBILITY VULNEREBILITY

6.10.26

 ClickFix & Beyond  Mapping the expanding family of user-assisted malware delivery techniques Report | September 2026 REPORT REPORT

6.10.26

 CVE-2021-26086 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1. VULNEREBILITY VULNEREBILITY

6.10.26

 CVE-2026-21589 CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products VULNEREBILITY VULNEREBILITY

6.10.26

 CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability VULNEREBILITY VULNEREBILITY

5.10.26

 ClingSTUN ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure MALWARE BACKDOOR

5.10.26

 Horizon3’s Tales from the Trenches: Anthropic’s Mythos and Rejetto HFS Anthropic started Project Glasswing with the mission of securing the world’s most critical software. Since joining the project in July of 2026, Horizon3 has used Anthropic’s Mythos model in its vulnerability research pipelines to discover many critical vulnerabilities. Horizon3’s participation in the project came with our own internal mission to find vulnerabilities likely to be found and exploited in the wild by threat actors at scale. VULNEREBILITY VULNEREBILITY

5.10.26

 CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV KEV

5.10.26

 CVE-2026-61500 Rejetto HFS 3.0.0 through 3.2.0 derives its session... VULNEREBILITY VULNEREBILITY

5.10.26

 CVE-2026-88779 Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88779 VULNEREBILITY VULNEREBILITY

5.10.26

 Atomic macOS (AMOS) Stealer infection from malicious ad impersonating Claude Code Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

5.10.26

 SmartApeSG ClickFix pushes CNCmachineRMS RAT Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

5.10.26

 Macfinger ClickFix activity Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website. MALWARE TRAFFIC MALWARE TRAFFIC

5.10.26

 TA419 Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles GROUPS GROUPS

4.10.26

 Decoding
emergence
2026 Microsoft Digital Defense Report 		The challenge confronting security leaders today is no longer a lack of information. It is the growing complexity of the environments they are responsible for protecting. REPORT REPORT

4.10.26

 CVE-2026-104286 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. VULNEREBILITY VULNEREBILITY

4.10.26

 FBI INTERNET CRIME REPORT 2025 In 2025, the FBI Internet Crime Complaint Center (IC3) celebrated its 25th anniversary as the central hub for reporting cyber-enabled crime. This milestone signifies the FBI's enduring commitment to fighting the ever-evolving cyber threat. Our success in protecting individuals and organizations is driven by public participation and robust data analysis. REPORT REPORT

4.10.26

 Warlock Warlock Ransomware Attackers Hit Water and Telecom Operators RANSOM RANSOM

4.10.26

 CVE-2026-92371 TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system. VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-92369 TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update. VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-19743 Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation. VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-92368 TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-92370 An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability: Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. ECV ECV

3.10.26

 CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability: Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. ECV ECV

4.10.26

 CVE-2026-104286 An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-92371 TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system. VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-92369 TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update. VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-19743 Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation. VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-92368 TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user VULNEREBILITY VULNEREBILITY

4.10.26

 CVE-2026-92370 An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. VULNEREBILITY VULNEREBILITY

3.10.26

 Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.This vulnerability is due to improper handling of URI encoding VULNEREBILITY VULNEREBILITY

3.10.26

 Cisco IOS XE Software Security Hardening Release: August 2026 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-90970 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway. VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-67273 (CVSS score: 9.6) - An improper neutralization of special elements used in a template engine vulnerability that a low-privilege attacker with remote access could exploit to escalate privileges, access sensitive information, and carry out unauthorized RBAC tampering. VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-61421 (CVSS score: 9.8) - A use of hard-coded cryptographic key vulnerability in the JWT authentication component of karavi-authorization that a remote unauthenticated attacker with knowledge of this publicly available signing secret could exploit to forge authentication tokens and gain administrative privileges. VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-54472 (CVSS score: 9.8) - A use of hard-coded credentials vulnerability in the CSM Authorization module that a remote unauthenticated attacker could exploit to forge cryptographically valid administrative tokens and gain unauthorized administrative access to the CSM Authorization proxy. VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-67269 (CVSS score: 9.9) - An improper privilege management vulnerability in the ContainerStorageModule Custom Resource reconciler that a low-privilege remote attacker could exploit to escalate privileges and gain root-level access on cluster nodes. VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-63692 (CVSS score: 10.0) - A missing authentication for critical function vulnerability in the authorization proxy and tenant service that an unauthenticated network attacker could exploit to bypass authentication controls and gain administrative-level privileges. VULNEREBILITY VULNEREBILITY

3.10.26

 CVE-2026-63688 (CVSS score: 10.0) - A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an unauthenticated remote attacker could exploit to obtain unauthorized access to storage backend administrator credentials for all registered storage arrays. VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86950 CVE-2026-86950: The Great Glyph Grift VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86134 Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86104 Fireware OS Resource Exhaustion in Login Process Allows Denial of Service Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-18145 Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-13046 Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86101 Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86133 Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-13224 Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86132 Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-90441 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86131 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86136 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A Default>= 2026.0, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-81433 Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution Fireware OS>= 2026.3, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86128 Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service Default>= 2026.3, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service Default>= 2026.3, < 2026.3.2, >= 2025.0, < 2026.2.3, >= 12.0, < 12.12.3>= 2026.3.2, >= 2026.2.3, >= 12.12.3T15/T35>= 12.0, < 12.5.21>= 12.5.21 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-101891 WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access WatchGuard AP>= 1.0, < 3.4.8>= 3.4.8 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-86102 WatchGuard AP Command Injection in Internal Management API Allows Command Execution WatchGuard AP>= 1.0, < 3.4.8>= 3.4.8 VULNEREBILITY VULNEREBILITY

1.10.26

 CVE-2026-87969 WatchGuard AP Authenticated Command Injection in Diagnostic CLI WatchGuard AP>= 1.0, < 3.4.8>= 3.4.8 VULNEREBILITY VULNEREBILITY