@RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 42

@RISK®: The Consensus Security Vulnerability Alert
October 29, 2026 - Vol. 26, Num. 42

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked

Featuring the latest input from the SANS® Internet Storm Center®

Archived issues may be found at https://www.sans.org/newsletters/at-risk

CONTENTS:

• INTERNET STORM CENTER SPOTLIGHT
• OTHER INTERNET STORM CENTER ENTRIES
• RECENT CVEs

Sponsored By Oligo Security

Read Frost & Sullivan's 2026 Best Practices report on application detection and response (ADR). Learn why SCA, SAST, and ASPM can't tell you whether vulnerable code loads or executes in production. See how execution-level proof cuts non-relevant risk without weakening coverage, and how runtime blocking stops malicious actions while apps keep running. Download the report: https://www.sans.org/info/237155

RESOURCES

Emergency Livestream Replay | PHP Vulnerabilities: What You Need to Know Today and Do Right Now
Watch the replay of the October 21 emergency livestream, featuring Moses Frost, Senior Instructor at SANS Institute, and Rich Greene, Certified Instructor and Senior Solutions Engineer at SANS Institute, who cut through the noise and explain what we know about these vulnerabilities, which systems may be affected, and exactly what security teams should do now.

SANS CyberThreat 2026 | London Cybersecurity Summit | November 16-17
Speakers include Ivan Kalabashkin (Security Service of Ukraine) on Ukraine’s cyber war playbook, Maciej Siciarek (NASK) on the attack on Poland’s energy sector, James Lyne (SANS Institute) on how AI and geopolitics are reshaping cyber defence, and David Mound (Shinobi Security) on testing an AI red teaming agent against a wind farm.

The EU AI Act: Is It GDPR for the 2020s, or the Limits of the Brussels Effect?
This discussion paper applies the lived lessons of the 2018 GDPR rollout to what the EU AI Act compliance requires in practice. It works through four real similarities and four real differences between the two regulations and argues that compliance here is an ongoing triage exercise, not a one-time build. Findings from an accompanying survey will inform a 2027 SANS white paper on EU technology regulation trends.

Sponsored Links:

Webinar | Fall Cyber Solutions Fest | November 17-19 | The 2026 Fall Cyber Solutions Fest brings cyber defense practitioners hands-on sessions across five tracks — from identity security to AI — with the SOC track delivering deep dives into detection engineering, automation, and AI-enhanced triage to help your team cut alert fatigue and accelerate response. https://www.sans.org/info/237160

Webinar | AI Summit Fall Solutions Track | Tuesday, November 3 | Explore real-world approaches to applying AI in cybersecurity programs, focusing on how to move from theory to measurable impact. https://www.sans.org/info/237165

SANS Research | The State of AI Security Maturity Benchmark Survey | Is your AI security keeping pace with adoption? Give SANS 10 minutes to find out and get early access to the benchmark results before anyone else. Take the survey: https://www.sans.org/info/237170

INTERNET STORM CENTER SPOTLIGHT

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html


Apple Patches for October 2026
Published: 2026-10-26
Last Updated: 2026-10-27 02:09:55 UTC
by Johannes Ullrich (Version: 1)

Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.

Noteworthy Issue:
CVE-2026-86950: This is an already exploited vulnerability in CoreGraphics, and was patched originally a month ago. This month's update delivers the corresponding patches for iOS 18.

No new vulnerability is marked as already exploited.

Other Interesting issues:
CVE-2026-86990: A malicious app may access the camera without user permissions.
CVE-2026-28864: A local attacker may gain access to user's Keychain items ...

Read the full entry: https://isc.sans.edu/diary/Apple+Patches+for+October+2026/33458/


(Reliable)? php2shell exploitability
Published: 2026-10-23
Last Updated: 2026-10-23 20:04:47 UTC
by Bojan Zdrnja (Version: 1)

Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.

However, after looking closely at some published PoC's - and there is an unbelievable amount of AI generated - erm, slop - it looks like building a universal, reliable, one click exploit is quite difficult (unless I'm missing something, so please do let me know).

The PoC's that have been released so far have several pre-requirements and are almost cheating.

First, in order to have a clean initial state, the one PoC that makes sense sends a POST HTTP request with a number of small fields (3000 bytes each, 1001 of them), for bulk allocation pressure, prepare PHPSESSID and PHP_SESSION_UPLOAD_PROGRESS and then append a big field of 12 MB.
This guarantees that emalloc fails, since the PoC require that memory limit is set to 8 MB.

This is the first issue; in real world setups memory_limit is usually 128 MB, making this a bit more demanding.

An even bigger issue is that real world setups will have multiple workers - the demo uses a single-worker prefork configuration which guarantees that the next phase lands with this worker. In real world this is not guaranteed and an attacker would have to consume all workers and release one (and catch that one). Not sure how difficult this is ...

Read the full entry: https://isc.sans.edu/diary/Reliable+php2shell+exploitability/33452/


PHP Vulnerability Wrap-Up
Published: 2026-10-23
Last Updated: 2026-10-23 13:43:20 UTC
by Johannes Ullrich (Version: 1)

This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".

Many vendors have released patches for the vulnerability in sync with PHP.net, showing that the coordinated vulnerability disclosure worked and achieved its goal of providing tested and working patches in a timely manner. Some vendor(s) not playing by the rules and leaking details early is unfortunate but should not overshadow the overall success of providing the patches.

At this point, no reliable exploit has been made available publicly as far as I know. Several firms stated that they possess working exploit code, and I consider it a matter of time before such code becomes publicly available, at which point we will likely see more widespread exploitation. Cloudflare and Amazon have stated that they are seeing a large number of exploit attempts, but it is not clear if these are actual working exploits.

Applying the patch remains your best and only reliable defense. Treat the time you have now as a gift and use it wisely to find and patch applications in your organization.

If you are not able to upgrade, do your best to isolate vulnerable applications. There are various workarounds, but none are considered 100% effective. They may buy you more time. The same is true for web application firewall rules ...

Read the full entry: https://isc.sans.edu/diary/PHP+Vulnerability+WrapUp/33450/

OTHER INTERNET STORM CENTER ENTRIES

YARA-X 1.22.0 Release (2026.10.25)
https://isc.sans.edu/diary/YARAX+1220+Release/33454/

Looking for a Language [Guest Diary] (2026.10.21)
https://isc.sans.edu/diary/Looking+for+a+Language+Guest+Diary/33442/

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow] (2026.20.21)
https://isc.sans.edu/diary/Critical+PHP+Vulnerability+CVE2026109618+CVE2026109619+infocon+yellow/33440/

RECENT CVEs
The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.


CVE-2026-111497 - Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
Product: Google Brotli
CVSS Score: 8.1
** KEV since 2026-10-27 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497
ISC Podcast: https://isc.sans.edu/podcastdetail/10150
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497


CVE-2026-109618 - PHP Memory Corruption Vulnerability
Product: Paloaltonetworks Pan-Os -
CVSS Score: 0
** KEV since 2026-10-26 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109618
ISC Podcast: https://isc.sans.edu/podcastdetail/10146


CVE-2026-109619 - PHP Stale Internal Request-State Vulnerability
Product: Paloaltonetworks Pan-Os -
CVSS Score: 0
** KEV since 2026-10-26 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109619
ISC Podcast: https://isc.sans.edu/podcastdetail/10146


CVE-2026-86950 - Apple Multiple Products Out-of-Bounds Write Vulnerability
Product: Apple Macos
CVSS Score: 0
** KEV since 2026-09-29 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86950
ISC Diary: https://isc.sans.edu/diary/33458
ISC Podcast: https://isc.sans.edu/podcastdetail/10152


CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability
Product: Microsoft Windows Shell
CVSS Score: 8.8
** KEV since 2026-10-13 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96951
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951


CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 - Multiple vulnerabilities in Plex Media Server
CVSS Score: 0
** KEV since 2026-10-20 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96652 (SSRF)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96654 (Improper Neutralization of Encoded URI Schemes)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96655 (SSRF)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96656 (External Control of File Name or Path)
ISC Podcast: https://isc.sans.edu/podcastdetail/10142


CVE-2026-21589 - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Product: Atlassian
CVSS Score: 0
** KEV since 2026-10-15 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21589


CVE-2026-105133, CVE-2026-105134 - Vulnerabilities in Ahsay AhsayCBS
Product: Ahsay Cloud Backup Suite
CVSS Score: 0
** KEV since 2026-10-14 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105133 (improper authentication)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105134 (command injection)


CVE-2026-15410 - SonicWall SMA1000 Appliances Code Injection Vulnerability
Product: SonicWall SMA1000 Appliances
CVSS Score: 0
** KEV since 2026-07-14 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15410


CVE-2026-114625 - Arista VeloCloud Orchestrator SQL Injection Vulnerability
Product: Arista VeloCloud Orchestrator
CVSS Score: 0
** KEV since 2026-10-23 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-114625


CVE-2026-16812 - Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Product: Arista VeloCloud Orchestrator On-Prem
CVSS Score: 0
** KEV since 2026-07-27 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16812


CVE-2026-110447 - Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Product: Collabora Online
CVSS Score: 0
** KEV since 2026-10-23 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110447


CVE-2026-106931 - EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
Product: EG Secure Solutions SiteGuard
CVSS Score: 0
** KEV since 2026-10-20 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106931


CVE-2026-65660 - Microsoft SharePoint Code Injection Vulnerability
Product: Microsoft SharePoint
CVSS Score: 0
** KEV since 2026-09-25 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65660


CVE-2026-49869 - Kestra OSS OS Command Injection Vulnerability
Product: Kestra OSS
CVSS Score: 0
** KEV since 2026-09-02 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49869


CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability
Product: Mlflow
CVSS Score: 0
** KEV since 2026-08-19 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64849


CVE-2026-20349 - Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
Product: Cisco Secure Firewall Adaptive Security Appliance (ASA)
CVSS Score: 0
** KEV since 2026-08-11 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20349


CVE-2026-20316 - Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
Product: Cisco Secure_Firewall_Management_Center
CVSS Score: 0
** KEV since 2026-07-29 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20316


CVE-2026-63077 - JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
Product: JetBrains Teamcity
CVSS Score: 0
** KEV since 2026-08-05 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63077


CVE-2026-18577 - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Product: N-Able N-Central
CVSS Score: 0
** KEV since 2026-08-03 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18577


CVE-2026-18556 - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
Product: N-Able N-Central
CVSS Score: 0
** KEV since 2026-08-04 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18556


CVE-2026-16232 - Check Point SmartConsole Improper Authentication Vulnerability
Product: Check Point SmartConsole
CVSS Score: 0
** KEV since 2026-07-22 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16232


CVE-2026-15409 - SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Product: SonicWall SMA1000 Appliances
CVSS Score: 0
** KEV since 2026-07-14 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15409


CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
Product: JoomShaper SP Page Builder
CVSS Score: 0
** KEV since 2026-07-07 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48908


CVE-2026-48282 - Adobe ColdFusion Path Traversal Vulnerability
Product: Adobe Coldfusion 2025
CVSS Score: 0
** KEV since 2026-07-07 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48282


CVE-2026-71362 - Adobe Commerce and Magento Incorrect Authorization Vulnerability
Product: Adobe Commerce and Magento
CVSS Score: 0
** KEV since 2026-09-24 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71362


CVE-2026-110936 - Siemens Software Center Uncontrolled Search Path Element Vulnerability
Product: Siemens Software Center
CVSS Score: 0
** KEV since 2026-10-20 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110936


CVE-2026-42016, CVE-2026-42018 - Vulnerabilities in JFrog Artifactory
Product: JFrog Artifactory
CVSS Score: 0
** KEV since 2026-09-11 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42016 (incorrect authorization)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42018 (improper authentication)


CVE-2026-66384 - JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
Product: JFrog Artifactory
CVSS Score: 0
** KEV since 2026-08-27 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66384


CVE-2026-19490 - Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Product: Citrix NetScaler
CVSS Score: 0
** KEV since 2026-09-09 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19490


CVE-2026-59822 - BerriAI LiteLLM Improper Authentication Vulnerability
Product: BerriAI LiteLLM
CVSS Score: 0
** KEV since 2026-09-02 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59822


CVE-2026-9586 - Sangoma Switchvox SQL Injection Vulnerability
Product: Sangoma Switchvox
CVSS Score: 0
** KEV since 2026-09-02 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9586


CVE-2026-65400 - Apple macOS Improper Authentication Vulnerability
Product: Apple macOS
CVSS Score: 0
** KEV since 2026-08-18 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65400


CVE-2026-68820 - Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Product: Microsoft Windows
CVSS Score: 0
** KEV since 2026-08-11 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68820


CVE-2026-9198 - IBM Langflow Code Injection Vulnerability
Product: IBM Langflow
CVSS Score: 0
** KEV since 2026-08-04 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9198


CVE-2026-56291 - Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
Product: Balbooa Forms
CVSS Score: 0
** KEV since 2026-07-10 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56291


CVE-2026-48939 - iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
Product: iCagenda
CVSS Score: 0
** KEV since 2026-07-10 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48939


CVE-2026-55255 - Langflow Authorization Bypass Through User-Controlled Key Vulnerability
Product: Langflow
CVSS Score: 0
** KEV since 2026-07-07 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55255


CVE-2026-56290 - Joomlack Page Builder Improper Access Control Vulnerability
Product: Joomlack Page Builder
CVSS Score: 0
** KEV since 2026-07-07 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56290


CVE-2026-101767 - The vulnerability in Oracle Application Object Library product of Oracle E-Business Suite (component: Core) allows for a takeover by unauthenticated attackers with network access via HTTP on supported versions 12.2.3-12.2.15.
Product: Oracle E-Business Suite
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101767
ISC Podcast: https://isc.sans.edu/podcastdetail/10144
NVD References: https://www.oracle.com/security-alerts/cpuoct2026.html


CVE-2026-113380 - RingRTC library is vulnerable to interference by a peer saturating a call's FSM queue, hindering local hangup from properly ending the call.
Product: RingRTC
CVSS Score: 0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113380
ISC Podcast: https://isc.sans.edu/podcastdetail/10148


CVE-2026-86990 - iOS and iPadOS had an access issue that could allow malicious apps to access the camera without user permission, now fixed in versions 18.7.11, 26.7.2, and 27.2.
Product: Apple iOS and iPadOS
CVSS Score: 0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86990
ISC Diary: https://isc.sans.edu/diary/33458
ISC Podcast: https://isc.sans.edu/podcastdetail/10152


CVE-2026-28864 - iOS and macOS had a vulnerability that allowed local attackers to access a user's Keychain items, now fixed in the latest software updates.
Product: Multiple Apple products
CVSS Score: 0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28864
ISC Diary: https://isc.sans.edu/diary/33458
ISC Podcast: https://isc.sans.edu/podcastdetail/10152


CVE-2026-106173 - Fortinet FortiSIEM 7.5.0 is vulnerable to path traversal, allowing attackers to execute unauthorized code through crafted packets.
Product: Fortinet FortiSIEM
CVSS Score: 0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106173
ISC Podcast: https://isc.sans.edu/podcastdetail/10144


CVE-2026-100202 - Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
Product: Windows Message Queuing
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100202
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100202


CVE-2026-100219, CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerabilities
Product: Microsoft QUIC
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100219
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105016
MSFT Details:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100219
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105016


CVE-2026-100222 - Network Policy Server (NPS) Remote Code Execution Vulnerability
Product: Network Policy Server
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100222
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100222


CVE-2026-102210 - Windows Text Shaping Remote Code Execution Vulnerability
Product: Microsoft Windows Text Shaping
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102210
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102210


CVE-2026-105010 - Microsoft Windows Search Component Elevation of Privilege Vulnerability
Product: Microsoft Windows Search Component
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105010
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105010


CVE-2026-69634 - Windows iSCSI Remote Code Execution Vulnerability
Product: Microsoft Windows
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69634
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69634


CVE-2026-69639 - Windows libarchive Remote Code Execution Vulnerability
Product: Microsoft Windows libarchive
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69639
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69639


CVE-2026-83519 - Windows Error Reporting Remote Code Execution Vulnerability
Product: Microsoft Windows Error Reporting
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83519
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83519


CVE-2026-83782 - Windows Shell Remote Code Execution Vulnerability
Product: Microsoft Windows Shell
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83782
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83782


CVE-2026-110264 - Integer Overflow or Wraparound in GitLab
Product: GitLab
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110264
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110264


CVE-2026-97229 - Integer Overflow or Wraparound in GitLab
Product: GitLab
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97229


CVE-2026-77524 - KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Product: KEDA
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77524
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77524


CVE-2026-78663 - Double flow control refund on HTTP/2 server streams in net/http
Product: Google gRPC
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78663
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78663


CVE-2026-111444 - Wheels through 4.1.2 is vulnerable to SQL injection on MySQL/MariaDB with backslash escaping enabled when an application supplies request data to inline-literal paths.
Product: Wheels
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111444
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111444


CVE-2026-115384 - Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
Product: Bytecode Alliance Wasmtime
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-115384
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-115384


CVE-2026-57941 - Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
Product: Apache HTTP Server
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57941
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57941


CVE-2026-91403 - Oracle Java SE and Oracle GraalVM products are vulnerable to an easily exploitable attack that allows unauthenticated network access, potentially leading to unauthorized creation, deletion, or modification of critical data.
Product: Oracle Java SE and Oracle GraalVM
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91403
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-91403


CVE-2026-105014 - Azure Pipelines Remote Code Execution Vulnerability
Product: Microsoft Azure Pipelines
CVSS Score: 9.1
NO CUSTOMER ACTION REQUIRED
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105014
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014


CVE-2026-110063 - VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
Product: Microsoft VM Inspector for Azure Virtual Machines
CVSS Score: 10.0
NO CUSTOMER ACTION REQUIRED
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110063
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110063


CVE-2026-83938 - Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
Product: Microsoft Azure Kubernetes Configuration Service
CVSS Score: 10.0
NO CUSTOMER ACTION REQUIRED
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83938
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83938


CVE-2026-97785 - AAD App Proxy Elevation of Privilege Vulnerability
Product: Microsoft AAD App Proxy
CVSS Score: 10.0
NO CUSTOMER ACTION REQUIRED
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97785
MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785


CVE-2026-113802 - Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 is vulnerable to an OS command injection due to unsanitized input in the sub_23B54 function, allowing remote unauthenticated attackers to execute arbitrary commands as root.
Product: Wavlink WL-WN530BE1-A firmware
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113802


CVE-2026-113389, CVE-2026-113390, CVE-2026-113391 - Command injection vulnerabilities in DrayTek Vigor2960 1.5.1.6
Product: Draytek Vigor2960
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113389
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113390
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113391


CVE-2026-113506 - aaPanel prior to version 8.25.0 is vulnerable to remote OS command injection via the ExecShell function in File Manager's common.py, exploiting manipulated arguments, with the vendor confirming that authentication is required to exploit the disclosed vulnerabilities.
Product: aaPanel
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113506


CVE-2026-109444 - OpenSRE through 0.1.2026.10.19 has an approval gate bypass vulnerability that allows attackers to execute shell commands without confirmation due to the execution_allowed() function always returning True, enabling them to inject malicious instructions into alerts or Slack messages to gain access to sensitive credentials.
Product: OpenSRE
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109444


CVE-2026-75128 - Langchain-Chatchat versions through 0.3.1.3 are vulnerable due to an unauthenticated POST /tools/call API endpoint that allows remote attackers to execute arbitrary OS commands via the always-registered shell tool.
Product: Langchain-Chatchat
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75128


CVE-2026-77930 - EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to execute host shell commands by exploiting async sub-agents without proper security constraints.
Product: EvoScientist
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77930


CVE-2026-77932 - DB-GPT through 0.8.2 has an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to exploit the /api/v1/chat/react-agent endpoint to execute arbitrary Python or bash commands as root due to improper user role handling.
Product: DB-GPT
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77932


CVE-2026-101356 - Apache Tomcat contains an incorrect object recycling and re-use vulnerability in HTTP/2 processing of asynchronous servlets that can lead to request and/or response mix-ups between users, affecting versions 11.0.22 to 11.0.26, 10.1.55 to 10.1.60, and 9.0.118 to 9.0.122; users are advised to upgrade to versions 11.0.27, 10.1.61, or 9.0.123 to mitigate this issue.
Product: Apache Tomcat
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101356
NVD References: https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27


CVE-2026-103119 - Apache Tomcat is affected by a buffer under-read vulnerability that can cause a large non-blocking write to split the response body between requests, leading to potential request failures and data leakage.
Product: Apache Tomcat
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103119
NVD References: https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80


CVE-2026-113672 - Argo CD versions 0.9.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contain a vulnerability that allows attackers to read sensitive files and exhaust memory by exploiting improper handling of .jsonnet file imports, requiring only minimal permissions to exploit.
Product: Argo CD
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113672
NVD References:
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww


CVE-2026-113708 - Argo CD versions 2.7.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 are vulnerable to command execution via Kustomize due to improper handling of ref or version query values, allowing attackers to run arbitrary commands within the argocd-repo-server when using local transport URLs like file://, potentially exposing sensitive data.
Product: Argo CD
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113708
NVD References:
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-9v9p-x54c-58gc
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch


CVE-2026-113709 - Argo CD, from versions 2.1.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, is vulnerable to arbitrary code execution through Helm plugins due to misconfigured `helmGlobals.configHome`, allowing attackers with limited permissions to exploit repository-controlled locations.
Product: Argo CD
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113709
NVD References:
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch


CVE-2026-92559 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 may allow remote attackers to access sensitive information by binding to an unrestricted IP address.
Product: IBM App Connect Enterprise
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92559
NVD References: https://www.ibm.com/support/pages/node/7291781


CVE-2026-77933 - DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that allows attackers to authenticate as root with full database access due to a static MYSQL_ROOT_PASSWORD and exposure of port 3306.
Product: DB-GPT
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77933


CVE-2026-77936 - Letta through 0.16.8 is vulnerable due to a misconfigured compose.yaml that leaves API routes unauthenticated and exposes a superuser PostgreSQL port with default credentials, allowing remote attackers to execute arbitrary Python code, manage admin users, or run OS commands.
Product: Letta
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77936


CVE-2026-105312 - Kubernetes allows tenants with create permission on Console custom resources to deploy arbitrary container images, potentially enabling cross-tenant control-plane access to Strimzi resources through compromised ServiceAccount tokens.
Product: Red Hat
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105312


CVE-2026-113620 - Eclipse ioFog Controller versions 3.8.0 through 3.9.1 are vulnerable to a privilege escalation attack via unverified bearer JWTs in WebSocket upgrades on exec and log routes, allowing attackers to initiate sessions for known microservices or fogs by exploiting self-minted tokens with admin roles.
Product: Eclipse ioFog Controller
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113620


CVE-2026-112380 - Kiro Crew is vulnerable to missing authorization in its WhatsApp group channel, allowing a remote actor to control other agent sessions and execute arbitrary commands on the host via group messages.
Product: Kiro Crew
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112380
NVD References: https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc


CVE-2026-81212 - IBM DataStage on Cloud Pak for Data 5.4.0.0 allows unauthenticated users to perform arbitrary writes to shared Redis, compromising tenant data security by enabling anonymous access to modify cached flow parameters.
Product: IBM DataStage on Cloud Pak for Data
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81212
NVD References: https://www.ibm.com/support/pages/node/7289603


Multiple vulnerabilities in Chromium
Product: Google Chrome
CVSS Score: 9.6
Google:
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html
- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102304 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102306 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102308 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102309 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102316 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102331 (buffer overflow)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112992 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113007 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113014 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113020 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113023 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113056 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113072 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113078 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113084 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113089 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113116 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113126 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113138 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113169 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113171 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113186 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113189 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113211 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113222 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113235 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113252 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113261 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113263 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113270 (use after free)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113283 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113300 (out of bounds write)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113328 (improper input validation)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113336 (memory corruption)
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113342 (memory corruption)


Oracle's October 2026 Critical Patch Update contains 1295 new security patches across multiple product families, including but not limited to Oracle Supply Chain Products, JD Edwards, MySQL, Fusion Middleware, Helidon, Oracle Analytics, Oracle Communications, Oracle E-Business Suite, Oracle Enterprise Manager, Database, Java SE, HealthCare Applications, Siebel, and PeopleSoft.
- https://www.oracle.com/security-alerts/cpuoct2026.html