The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

October 2026 Microsoft Patch Tuesday

Published: 2026-10-13

Last Updated: 2026-10-13 19:25:52 UTC

by Johannes Ullrich (Version: 1)

Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.

CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerability allows bypassing the "Mark of the Web" making it easier to execute code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

CVE-2026-108398: This vulnerability, a .NET framework security feature bypass, could be used to bypass application control and execute unauthorized applications. Details were available public head of today's release, but Microsoft did not detect exploitation in the wild.

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398

Windows DHCP Server: 10 remote code execution vulnerabilities, including five critical vulnerabilities, affect the Windows DHCP server.

CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability. Microsoft considers the attack complexity high. The vulnerability is triggered by an attacker sending a specific email to the exchange server that triggers the vulnerability during content conversion.

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571

Aside from these specific vulnerabilities, the larger number of Office vulnerabilities is noteworthy, and the Office updates should likely be addressed quickly ...

Read the full entry: https://isc.sans.edu/diary/October+2026+Microsoft+Patch+Tuesday/33422/

Reconstructing AI Agent Activity: Two New Scripts for Forensic Review

Published: 2026-10-08

Last Updated: 2026-10-08 16:52:53 UTC

by Jim Clausing (Version: 1)

We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we discuss 8 of the most popular AI coding assistants and agents including Claude Code, Codex, Gemini CLI, Cursor, Copilot, Warp, Windsurf, and Qwen Code. I've been using Claude Code and a little bit of Codex, but I also have recently been playing with OpenCode and am setting up Hermes. I decided to figure out where the chat history was in OpenCode and where any Hermes evidence might be located.

I’ve added two new Python scripts to my GitHub repository for examining the records left behind by these two tools: opencode-chat-replay[.]py and hermes_forensic_extract[.]py. I absolutely had OpenCode write the opencode script and Hermes wrote the hermes script (which explains some of the differences between them).

Both focus on reconstruction, but they approach it differently. The opencode script turns stored session data into readable chat transcripts or structured exports. The Hermes script extracts a broader collection of evidence, including conversation records, model usage, API request dumps, and application logs.

These are forensic review tools, not tools for running or replaying an agent’s actions (the title of the opencode script not withstanding, opencode named it). The goal is to make recorded activity accessible for investigation: what the user asked, what the assistant returned, what tool activity was captured, and what surrounding context remains available ...

Read the full entry: https://isc.sans.edu/diary/Reconstructing+AI+Agent+Activity+Two+New+Scripts+for+Forensic+Review/33410/

Scans for Atlassian vulnerability (CVE-2026-21589)

Published: 2026-10-07

Last Updated: 2026-10-07 14:59:33 UTC

by Johannes Ullrich (Version: 1)

On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.

- https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html

- https://nvd.nist.gov/vuln/detail/cve-2026-21589

This directory traversal vulnerability is a little bit different from the textbook case. Atlassian products replace slashes with the pattern "::". To avoid this issue, but may, in some cases, undo this escape to access files. Watchtowr has a great write-up with all the details and proof-of-concept URLs demonstrating the vulnerability.

Starting yesterday, we saw some exploit attempts hitting our honeypot, using the exploit URLs mentioned in the Watchtowr blog.

- https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

Read the full entry: https://isc.sans.edu/diary/Scans+for+Atlassian+vulnerablity+CVE202621589/33406/

Orphaned VBA Projects Inside DWG Files (2026.10.14)

https://isc.sans.edu/diary/Orphaned+VBA+Projects+Inside+DWG+Files/33420/

Why TLP should not replace your internal information classification (2026.10.10)

https://isc.sans.edu/diary/Why+TLP+should+not+replace+your+internal+information+classification/33414/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-104935 - Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

Product: Ivanti Connect Secure

CVSS Score: 8.6

** KEV since 2026-10-13 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935 ISC Podcast: https://isc.sans.edu/podcastdetail/10136

NVD References: https://www.ivanti.com/blog/october-2026-security-update

CVE-2015-3306 - ProFTPD Improper Access Control Vulnerability

Product: ProFTPD

CVSS Score: 0

** KEV since 2026-10-08 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306

CVE-2015-5477 - ISC BIND Data Processing Errors Vulnerability

Product: ISC BIND

CVSS Score: 0

** KEV since 2026-10-08 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477

CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability

Product: Microsoft Windows Shell

CVSS Score: 8.8

** KEV since 2026-10-13 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951

ISC Diary: https://isc.sans.edu/diary/33422

ISC Podcast: https://isc.sans.edu/podcastdetail/10136

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

CVE-2026-0257 - Palo Alto Networks PAN-OS® software vulnerability allows attackers to bypass security restrictions and establish unauthorized VPN connections.

Product: Palo Alto Networks PAN-OS® software

CVSS Score: 0

** KEV since 2026-05-29 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257

ISC Podcast: https://isc.sans.edu/podcastdetail/10132

CVE-2026-63030 - WordPress Core Interpretation Conflict Vulnerability

Product: WordPress Core

CVSS Score: 0

** KEV since 2026-07-21 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030

CVE-2026-60137 - WordPress Core SQL Injection Vulnerability

Product: WordPress Core

CVSS Score: 0

** KEV since 2026-07-21 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137

CVE-2016-3081 - Apache Struts Command Injection Vulnerability

Product: Oracle Siebel_E-Billing 7.1

CVSS Score: 0

** KEV since 2026-10-08 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081

CVE-2021-3199 - ONLYOFFICE Docs Server Path Traversal Vulnerability

Product: ONLYOFFICE Docs Server

CVSS Score: 0

** KEV since 2026-10-08 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199

CVE-2023-22894 - Strapi Cleartext Storage of Sensitive Information Vulnerability

Product: Strapi

CVSS Score: 0

** KEV since 2026-10-08 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894

CVE-2026-104286 - Fortinet FortiMail Path Traversal Vulnerability

Product: Fortinet Fortimail

CVSS Score: 0

** KEV since 2026-10-01 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286

CVE-2026-102489 - Zammad GmbH Zammad Session Fixation Vulnerability

Product: Zammad

CVSS Score: 0

** KEV since 2026-10-02 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489

CVE-2026-102490 - Zammad GmbH Zammad Improper Privilege Management Vulnerability

Product: Zammad

CVSS Score: 0

** KEV since 2026-10-02 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490

CVE-2026-76460 - Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

Product: Cisco Identity Services Engine

CVSS Score: 0

** KEV since 2026-09-16 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460

CVE-2026-48282 - Adobe ColdFusion Path Traversal Vulnerability

Product: Adobe ColdFusion

CVSS Score: 0

** KEV since 2026-07-07 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282

CVE-2026-58704 - Google Pixel Improper Authorization Vulnerability

Product: Google Pixel

CVSS Score: 0

** KEV since 2026-09-16 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704

CVE-2026-19490 - Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Product: Citrix NetScaler

CVSS Score: 0

** KEV since 2026-09-09 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19490

CVE-2026-55255 - Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Product: Langflow

CVSS Score: 0

** KEV since 2026-07-07 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255

CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

Product: JoomShaper SP Page Builder

CVSS Score: 0

** KEV since 2026-07-07 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908

CVE-2026-56290 - Joomlack Page Builder Improper Access Control Vulnerability

Product: Joomlack Page Builder

CVSS Score: 0

** KEV since 2026-07-07 **

KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290

CVE-2026-102255, CVE-2026-102256, CVE-2026-102257 - Multiple vulnerabilities in SonicWall SMA1000 Appliance.

Product: SonicWall SMA1000 Appliance

CVSS Scores: 7.2 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102255 (pre-authentication SSRF)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102256 (OS Command Injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102257 (Zip Slip)

ISC Podcast: https://isc.sans.edu/podcastdetail/10126

NVD References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

CVE-2026-97229 - GitLab had a vulnerability that could have allowed an unauthenticated user to execute arbitrary code via a specially crafted regular expression in a CI/CD configuration.

Product: GitLab

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229

ISC Podcast: https://isc.sans.edu/podcastdetail/10134

CVE-2026-88131 - Microsoft Dataverse Remote Code Execution Vulnerability

Product: Microsoft Dataverse

CVSS Score: 9.8

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88131

ISC Diary: https://isc.sans.edu/diary/33422

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88131

CVE-2026-69435 - Azure SRE Agent Elevation of Privilege Vulnerability

Product: Microsoft Azure SRE Agent

CVSS Score: 9.6

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69435

ISC Diary: https://isc.sans.edu/diary/33422

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69435

CVE-2026-77900 - Azure App Service Remote Code Execution Vulnerability

Product: Microsoft Azure App Service

CVSS Score: 9.8

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77900

ISC Diary: https://isc.sans.edu/diary/33422

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77900

CVE-2026-94510 - Microsoft Bookings Elevation of Privilege Vulnerability

Product: Microsoft Bookings

CVSS Score: 9.9

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94510

ISC Diary: https://isc.sans.edu/diary/33422

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94510

CVE-2026-96207 - Microsoft Partner Center Elevation of Privilege Vulnerability

Product: Microsoft Partner Center

CVSS Score: 10.0

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96207

ISC Diary: https://isc.sans.edu/diary/33422

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96207

CVE-2026-83943 - Azure API Center Information Disclosure Vulnerability

Product: Microsoft Azure API Center

CVSS Score: 8.7

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83943

ISC Diary: https://isc.sans.edu/diary/33422

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83943

CVE-2026-83947 - Azure Event Grid Spoofing Vulnerability

Product: Microsoft Azure Event Grid

CVSS Score: 7.7

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83947

ISC Diary: https://isc.sans.edu/diary/33422

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83947

CVE-2026-108398 - .NET Framework Security Feature Bypass Vulnerability

Product: Microsoft .NET Framework

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-108398

ISC Diary: https://isc.sans.edu/diary/33422

ISC Podcast: https://isc.sans.edu/podcastdetail/10136

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398

CVE-2026-70571 - Microsoft Exchange Server Remote Code Execution Vulnerability

Product: Microsoft Exchange Server

CVSS Score: 8.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70571

ISC Diary: https://isc.sans.edu/diary/33422

ISC Podcast: https://isc.sans.edu/podcastdetail/10136

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571

CVE-2026-96940 - Microsoft Exchange Server Elevation of Privilege Vulnerability

Product: Microsoft Exchange Outlook Web Access

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96940

ISC Diary: https://isc.sans.edu/diary/33422

ISC Podcast: https://isc.sans.edu/podcastdetail/10124

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940

CVE-2026-21589 - Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye are vulnerable to Arbitrary File Access, allowing an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Product: Multiple Atlassian products

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21589

ISC Podcast: https://isc.sans.edu/podcastdetail/10128

CVE-2026-78663 - Double flow control refund on HTTP/2 server streams in net/http

Product: Go standard library net/http

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78663

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78663

CVE-2026-21413 - Raw Image Extension Remote Code Execution Vulnerability

Product: Raw Image Extension

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21413

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21413

CVE-2026-56857 - Root.Mkdir(All) can follow junctions out of the root on Windows in os

Product: Root.Mkdir(All)

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56857

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56857

CVE-2026-56153 - Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

Product: Apache HTTP Server

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56153 (heap overflow)

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56153

CVE-2026-56154 - Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

Product: Apache HTTP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56154 (use-after-free)

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56154

CVE-2026-57941 - Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Product: Apache HTTP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57941 (use-after-free)

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57941

CVE-2026-59797 - Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

Product: Apache HTTP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59797 (improper privilege management)

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59797

CVE-2026-92414 - Apache Jackrabbit is vulnerable to session fixation where a cached authenticated session is attached to any matching token without a credential check.

Product: Apache Jackrabbit

CVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92414

NVD References: https://lists.apache.org/thread.html/gmbsmrs2lycl9nld7rd0h1r1fc4t75qr

CVE-2026-97720 - Apache Impala versions up to and including 4.5.2 have an incorrect implementation of JWT/OAuth authentication, allowing attackers access to resources served by the executor's webserver when configured to accept tokens.

Product: Apache Impala

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97720

NVD References: https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2

CVE-2026-91140 - Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 is vulnerable to OS command injection through crafted Swagger/OpenAPI documents, allowing attackers to execute arbitrary commands on a developer's machine.

Product: Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91140

NVD References: https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140

CVE-2026-106126 - Tenable Identity Exposure (SaaS) is vulnerable to command injection in Active Directory Events Listener, enabling low-privileged authenticated users to execute arbitrary commands as SYSTEM on the PDCe.

Product: Tenable Identity Exposure

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106126

NVD References: https://www.tenable.com/security/tns-2026-27

CVE-2026-105793 - Microsoft UFO version prior to 3.0.9 allows an authenticated Mobile MCP caller to execute additional commands on an authorized connected device through the `press_key` tool in ufo/client/mcp/http_servers/mobile_mcp_server.py.

Product: Microsoft UFO

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105793

NVD References: https://github.com/microsoft/UFO/security/advisories/GHSA-5cjx-4375-4877

CVE-2026-54472, CVE-2026-61421, CVE-2026-63688, CVE-2026-63692, CVE-2026-67269, CVE-2026-67273 - Multiple vulnerabilities in Dell Container Storage Modules versions prior to 1.18.0.

Product: Dell Container Storage Modules

CVSS Scores: 9.6 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54472 (hard-coded credentials)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61421 (hard-coded credentials)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63688 (missing authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63692 (missing authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67269 (improper privilege management)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67273 (improper neutralization of special elements)

NVD References: https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9

CVE-2026-86360 - Dell System Update versions prior to 2.3.0.0 are susceptible to a critical Path Traversal vulnerability, allowing an unauthenticated attacker to potentially gain filesystem access and execute arbitrary code with root privileges.

Product: Dell System Update

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86360

NVD References: https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities

CVE-2026-104070 - The Crayons plugin for SPIP before 3.5.0 has a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields.

Product: SPIP Crayons plugin

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104070

NVD References: https://www.vulncheck.com/advisories/spip-crayons-plugin-authorization-bypass-rce

CVE-2026-101155 - Software Management Studio Software Repository allows an authenticated remote attacker to access files outside of the intended scope by manipulating requests or file uploads.

Product: Arista CloudVision Portal (On-Premises)

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101155

NVD References: https://www.arista.com/en/support/advisories-notices/security-advisory/24805-security-advisory-0189

CVE-2026-102159 - CV-CUE backend has an access-control flaw that can be exploited by an unauthenticated network attacker to access sensitive information or disrupt services.

Product: Arista CloudVision-CUE on-premises

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102159

NVD References: https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190

CVE-2026-106446 - Handlebars allows for code execution in the server process due to bypassed AST validation in versions 4.0.0 to 4.7.10, affecting Handlebars.compile() and Handlebars.precompile().

Product: Handlebars

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106446

NVD References: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj

CVE-2026-76742 through CVE-2026-76747 - Multiple Vulnerabilities in HPE Networking AOS-Swtich (AOS-S)

Product: HPE Networking AOS-Swtich (AOS-S)

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76742 (authentication bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76743 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76744 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76745 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76746 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76747 (buffer overflow)

NVD References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US

CVE-2026-76750 through CVE-2026-76754, CVE-2026-79794, CVE-2026-79796, CVE-2026-79798, CVE-2026-79801, CVE-2026-79805 - Multiple Vulnerabilities in HPE Networking ClearPass Policy Manager (CPPM)

Product: HPE Networking ClearPass Policy Manager

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76750 (code injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76751 (missing integrity verification)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76752 (authentication bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76753 (use of externally-controlled Format String)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76754 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79794 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79796 (authentication bypass)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79798 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79801 (missing integrity verification)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79805 (path traversal)

NVD References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05158en_us&docLocale=en_US

CVE-2026-79842 - An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713

Product: HPE Intelligent Management Center

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79842

NVD References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05157en_us

CVE-2026-93674, CVE-2026-104334 - Code injection vulnerabilities in IBM Langflow OSS 1.0.0 through 1.12.2.

Product: IBM Langflow OSS

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93674

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104334 (code injection)

NVD References: https://www.ibm.com/support/pages/node/7290694

CVE-2026-14269, CVE-2026-14502, CVE-2026-14990, CVE-2026-14991, CVE-2026-14992, CVE-2026-15762, CVE-2026-16340 - Multiple vulnerabilities in IBM DataPower Gateway

Product: IBM DataPower Gateway

CVSS Score: 9.3 - 9.8

GitHub Stars: -1

Exploitability: 1 %

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14269 (heap-based buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14502 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14990 (cross-site scripting)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14991 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14992 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15762 (out-of-bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16340 (out-of-bounds write)

NVD References:

- https://www.ibm.com/support/pages/node/7289775

- https://www.ibm.com/support/pages/node/7289790

CVE-2026-16823, CVE-2026-16916, CVE-2026-19491, CVE-2026-78401, CVE-2026-78406 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to remote execution of arbitrary code through deserialization of untrusted data.

Product: IBM Security Verify Access

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16823 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16916 (protection mechanism failure)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19491 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78401 (deserialization of untrusted data)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78406 (deserialization of untrusted data)

NVD References: https://www.ibm.com/support/pages/node/7291628

CVE-2026-75875, CVE-2026-80381, CVE-2026-84244, CVE-2026-84249, CVE-2026-84272 - Multiple vulnerabilities in IBM Guardium Data Protection..

Product: IBM Guardium Data Protection

CVSS Scores: 9.3 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75875 (path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80381 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84244 (stored cross-site scripting)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84249 (missing authentication for critical function)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84272 (missing authentication for critical function)

NVD References: https://www.ibm.com/support/pages/node/7291674

NVD References: https://www.ibm.com/support/pages/node/7288035

NVD References: https://www.ibm.com/support/pages/node/7288036

NVD References: https://www.ibm.com/support/pages/node/7288832

CVE-2026-105763 - Twenty CRM platform exposed plaintext passwords in the connectedAccounts query, allowing unauthorized access to external services until version 2.7.0.

Product: Twenty

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105763

NVD References: https://github.com/twentyhq/twenty/security/advisories/GHSA-mq5c-qp77-2cv3

CVE-2026-94293 - Asset Administration Shell allows an unauthenticated remote attacker to modify submodel data via PATCH requests and read exposed data through GET endpoints.

Product: Murrelektronik Software AAS Edge Client all versions

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94293

NVD References: https://www.certvde.com/en/advisories/VDE-2026-108/

CVE-2026-106016 - Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.

Product: Mozilla Firefox

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106016

NVD References: https://www.mozilla.org/security/advisories/mfsa2026-109/

CVE-2026-77178 - Oracle VM VirtualBox before 7.2.8 allows a out-of-bounds write vulnerability in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

Product: Oracle VM VirtualBox

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77178

CVE-2026-105845 - Payload is vulnerable to SQL injection in versions prior to 3.88.0 and 4.0.0-canary.27 due to untrusted user queries on readable collections.

Product: Payload CMS

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105845

NVD References: https://github.com/payloadcms/payload/security/advisories/GHSA-v49j-62m6-pgrr

CVE-2026-105857 - Payload, a free and open source headless content management system, is vulnerable to remote code execution via crafted form submissions in versions before 3.90.0 and 4.0.0-canary.34.

Product: Payload CMS

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105857

NVD References: https://github.com/payloadcms/payload/security/advisories/GHSA-r488-j9vj-wx3q

CVE-2026-105859 - Payload, a free and open source headless content management system, allows attackers to modify collection documents without access control in versions before 3.90.0 and 4.0.0-canary.34.

Product: Payload CMS

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105859

NVD References: https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf

CVE-2026-106102 - Quasar Framework prior to version 2.22.0 allows an attacker to inject executable markup into dynamic page metadata, potentially compromising the integrity of the user interface.

Product: Quasar Framework

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106102

NVD References: https://github.com/quasarframework/quasar/security/advisories/GHSA-pq96-jpmf-w254

CVE-2026-55330 - BluetoothCccHandlerCallbackImpl in bluetooth_ccc.cc has a possible use-after-free vulnerability that could result in remote code execution without requiring user interaction.

Product: Google Android

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55330

NVD References: https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01

CVE-2026-103059 - Gitea's built-in SSH server vulnerability allows an attacker to authenticate as a user by constructing a case variant of another user's registered RSA public key.

Product: Gitea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103059

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp

CVE-2026-73278 - Gitea's OAuth2 and OpenID Connect sign-in paths can be exploited by bypassing WebAuthn challenges, allowing unauthorized access to user sessions without passkey verification.

Product: Gitea

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73278

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-92j2-6qcg-c28c

CVE-2026-94205 - Gitea Actions allowed fork-controlled workflow code to run on base repository's runners without approval based on pull request author.

Product: Gitea

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94205

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp

CVE-2026-95106 - Gitea vulnerability allowed for inconsistent handling of duplicate entries, potentially leading to attacker-controlled content being used during checkouts and CI processes.

Product: Gitea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95106

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-6pv5-8rp7-8c75

CVE-2026-101023 - Gitea's OAuth2 token endpoint fails to verify if a submitted token is a refresh token, allowing unauthorized access beyond its original expiration.

Product: Gitea

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101023

NVD References: https://github.com/go-gitea/gitea/security/advisories/GHSA-469m-x4mw-38r3

CVE-2026-105812 - Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14 allows an authenticated same-account actor to execute arbitrary code through improperly controlled code generation in the agent import functionality.

Product: Amazon Bedrock AgentCore Starter Toolkit

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105812

NVD References: https://aws.amazon.com/security/security-bulletins/2026-127-aws/

CVE-2026-106501 - Backstage is vulnerable to sensitive information exposure in @backstage/plugin-scaffolder-backend prior to versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0, allowing authenticated users to access and potentially exploit internal execution data.

Product: Linuxfoundation Backstage\\/Plugin-Scaffolder-Backend

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106501

NVD References: https://github.com/backstage/backstage/security/advisories/GHSA-g2v8-7jhw-pp8p

CVE-2026-81535 - WolfSSH through version 1.5.0 allows a malicious SSH peer to allocate unbounded per-channel buffers for unauthorized forwarding channels.

Product: WolfSSH

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81535

CVE-2026-59346 - VMware Workstation and Fusion are vulnerable to an integer-overflow issue with VMXNET3 adapter, allowing a local admin on a virtual machine to execute code on the host.

Product: VMware Workstation and Fusion

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59346

NVD References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/security-advisories/0/38288

Multiple vulnerabilities in Google Chrome

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html

CVE-2026-20362 - Cisco Finesse is vulnerable to SSRF attacks due to improper input validation, allowing an unauthenticated remote attacker to obtain limited sensitive information.

Product: Cisco Finesse

CVSS Score: 7.2

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20362

ISC Podcast: https://isc.sans.edu/podcastdetail/10130

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS

CVE-2026-20328, CVE-2026-76454, CVE-2026-76480, CVE-2026-76482, CVE-2026-76483 - Multiple vulnerabilities in Cisco License On-Prem

Product: Cisco License On-Prem

CVSS Scores: 9.1 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20328 (improper password reset checks)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76454 (relative path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76480 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76482 (improper input verification)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76483 (insufficiently protected credentials)

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf

CVE-2026-76471, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76455, CVE-2026-76459, CVE-2026-76465 - Cisco NX-OS Software is vulnerable to an unauthenticated, remote attacker executing arbitrary code with root privileges or causing a denial of service condition through the NX-API feature.

Product: Cisco NX-OS Software

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76471 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76485 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76486 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76501 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76455 (improper access control)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76459 (out-of-bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76465 (improper validation)

NVD References:

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7

CVE-2026-76464 - Cisco networking products are vulnerable to buffer management issues, leading to multiple internally discovered vulnerabilities tracked by CVE-2026-76464.

Product: Cisco networking product

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76464

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH

CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 - Multiple vulnerabilities in Cisco's Application Policy Infrastructure Controller (APIC) software

Product: Cisco Application Policy Infrastructure Controller (APIC)

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76498 (improper access control)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76499 (improper neutralization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76500 (improper control of a resource)

NVD References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh

CVE-2026-76268, CVE-2026-76284, CVE-2026-76285 - Multiple vulnerabilities in Splunk

Product: Splunk

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76268 (missing authentication for critical function)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76284 (improper neutralization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76285 (improper adherence to coding standards)

NVD References: https://advisory.splunk.com/advisories/SVD-2026-1001

CVE-2026-87659 - Brocade Fabric OS versions before 10.0.1 are vulnerable to a critical authorization bypass flaw allowing a compromised switch to execute administrative actions on the target device.

Product: Broadcom Fabric Operating System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-87659

NVD References: https://support.broadcom.com/external/content/SecurityAdvisories/0/39153

CVE-2026-62252 - Homer, prior to version 11.0.283, automatically creates an `admin` account with a known password, allowing immediate full administrative access upon login.

Product: Homer

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62252

NVD References: https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx

CVE-2026-62253 - Homer exposed protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` as completely unauthenticated prior to version 11.0.283 due to an issue with the JWT middleware functions.

Product: Homer

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62253

NVD References: https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9

CVE-2026-107935 - gvproxy in the gvisor-tap-vsock package allows attackers to delete arbitrary host files via an unvalidated endpoint.

Product: gvisor gvproxy

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107935

NVD References: https://access.redhat.com/security/cve/CVE-2026-107935