The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Apple Patches for October 2026

Published: 2026-10-26

Last Updated: 2026-10-27 02:09:55 UTC

by Johannes Ullrich (Version: 1)

Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.

Noteworthy Issue:

CVE-2026-86950: This is an already exploited vulnerability in CoreGraphics, and was patched originally a month ago. This month's update delivers the corresponding patches for iOS 18.

No new vulnerability is marked as already exploited.

Other Interesting issues:

CVE-2026-86990: A malicious app may access the camera without user permissions.

CVE-2026-28864: A local attacker may gain access to user's Keychain items ...

Read the full entry: https://isc.sans.edu/diary/Apple+Patches+for+October+2026/33458/

(Reliable)? php2shell exploitability

Published: 2026-10-23

Last Updated: 2026-10-23 20:04:47 UTC

by Bojan Zdrnja (Version: 1)

Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.

However, after looking closely at some published PoC's - and there is an unbelievable amount of AI generated - erm, slop - it looks like building a universal, reliable, one click exploit is quite difficult (unless I'm missing something, so please do let me know).

The PoC's that have been released so far have several pre-requirements and are almost cheating.

First, in order to have a clean initial state, the one PoC that makes sense sends a POST HTTP request with a number of small fields (3000 bytes each, 1001 of them), for bulk allocation pressure, prepare PHPSESSID and*PHP_SESSION_UPLOAD_PROGRESS and then append a big field of 12 MB.

This guarantees that emalloc fails, since the PoC require that memory limit is set to 8 MB.

This is the first issue; in real world setups memory_limit is usually 128 MB, making this a bit more demanding.

An even bigger issue is that real world setups will have multiple workers - the demo uses a single-worker prefork configuration which guarantees that the next phase lands with this worker. In real world this is not guaranteed and an attacker would have to consume all workers and release one (and catch that one). Not sure how difficult this is ...

Read the full entry: https://isc.sans.edu/diary/Reliable+php2shell+exploitability/33452/

PHP Vulnerability Wrap-Up

Published: 2026-10-23

Last Updated: 2026-10-23 13:43:20 UTC

by Johannes Ullrich (Version: 1)

This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".

Many vendors have released patches for the vulnerability in sync with PHP.net, showing that the coordinated vulnerability disclosure worked and achieved its goal of providing tested and working patches in a timely manner. Some vendor(s) not playing by the rules and leaking details early is unfortunate but should not overshadow the overall success of providing the patches.

At this point, no reliable exploit has been made available publicly as far as I know. Several firms stated that they possess working exploit code, and I consider it a matter of time before such code becomes publicly available, at which point we will likely see more widespread exploitation. Cloudflare and Amazon have stated that they are seeing a large number of exploit attempts, but it is not clear if these are actual working exploits.

Applying the patch remains your best and only reliable defense. Treat the time you have now as a gift and use it wisely to find and patch applications in your organization.

If you are not able to upgrade, do your best to isolate vulnerable applications. There are various workarounds, but none are considered 100% effective. They may buy you more time. The same is true for web application firewall rules ...

Read the full entry: https://isc.sans.edu/diary/PHP+Vulnerability+WrapUp/33450/

YARA-X 1.22.0 Release (2026.10.25)

https://isc.sans.edu/diary/YARAX+1220+Release/33454/

Looking for a Language [Guest Diary] (2026.10.21)

https://isc.sans.edu/diary/Looking+for+a+Language+Guest+Diary/33442/

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow] (2026.20.21)

https://isc.sans.edu/diary/Critical+PHP+Vulnerability+CVE2026109618+CVE2026109619+infocon+yellow/33440/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-111497 - Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

Product: Google Brotli

CVSS Score: 8.1

** KEV since 2026-10-27 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497

ISC Podcast: https://isc.sans.edu/podcastdetail/10150

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497

CVE-2026-109618 - PHP Memory Corruption Vulnerability

Product: Paloaltonetworks Pan-Os -

CVSS Score: 0

** KEV since 2026-10-26 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109618

ISC Podcast: https://isc.sans.edu/podcastdetail/10146

CVE-2026-109619 - PHP Stale Internal Request-State Vulnerability

Product: Paloaltonetworks Pan-Os -

CVSS Score: 0

** KEV since 2026-10-26 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109619

ISC Podcast: https://isc.sans.edu/podcastdetail/10146

CVE-2026-86950 - Apple Multiple Products Out-of-Bounds Write Vulnerability

Product: Apple Macos

CVSS Score: 0

** KEV since 2026-09-29 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86950

ISC Diary: https://isc.sans.edu/diary/33458

ISC Podcast: https://isc.sans.edu/podcastdetail/10152

CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability

Product: Microsoft Windows Shell

CVSS Score: 8.8

** KEV since 2026-10-13 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96951

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 - Multiple vulnerabilities in Plex Media Server

CVSS Score: 0

** KEV since 2026-10-20 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96652 (SSRF)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96654 (Improper Neutralization of Encoded URI Schemes)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96655 (SSRF)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96656 (External Control of File Name or Path)

ISC Podcast: https://isc.sans.edu/podcastdetail/10142

CVE-2026-21589 - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Product: Atlassian

CVSS Score: 0

** KEV since 2026-10-15 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21589

CVE-2026-105133, CVE-2026-105134 - Vulnerabilities in Ahsay AhsayCBS

Product: Ahsay Cloud Backup Suite

CVSS Score: 0

** KEV since 2026-10-14 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105133 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105134 (command injection)

CVE-2026-15410 - SonicWall SMA1000 Appliances Code Injection Vulnerability

Product: SonicWall SMA1000 Appliances

CVSS Score: 0

** KEV since 2026-07-14 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15410

CVE-2026-114625 - Arista VeloCloud Orchestrator SQL Injection Vulnerability

Product: Arista VeloCloud Orchestrator

CVSS Score: 0

** KEV since 2026-10-23 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-114625

CVE-2026-16812 - Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Product: Arista VeloCloud Orchestrator On-Prem

CVSS Score: 0

** KEV since 2026-07-27 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16812

CVE-2026-110447 - Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Product: Collabora Online

CVSS Score: 0

** KEV since 2026-10-23 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110447

CVE-2026-106931 - EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Product: EG Secure Solutions SiteGuard

CVSS Score: 0

** KEV since 2026-10-20 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106931

CVE-2026-65660 - Microsoft SharePoint Code Injection Vulnerability

Product: Microsoft SharePoint

CVSS Score: 0

** KEV since 2026-09-25 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65660

CVE-2026-49869 - Kestra OSS OS Command Injection Vulnerability

Product: Kestra OSS

CVSS Score: 0

** KEV since 2026-09-02 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49869

CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability

Product: Mlflow

CVSS Score: 0

** KEV since 2026-08-19 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64849

CVE-2026-20349 - Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

Product: Cisco Secure Firewall Adaptive Security Appliance (ASA)

CVSS Score: 0

** KEV since 2026-08-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20349

CVE-2026-20316 - Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Product: Cisco Secure_Firewall_Management_Center

CVSS Score: 0

** KEV since 2026-07-29 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20316

CVE-2026-63077 - JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Product: JetBrains Teamcity

CVSS Score: 0

** KEV since 2026-08-05 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63077

CVE-2026-18577 - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Product: N-Able N-Central

CVSS Score: 0

** KEV since 2026-08-03 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18577

CVE-2026-18556 - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Product: N-Able N-Central

CVSS Score: 0

** KEV since 2026-08-04 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18556

CVE-2026-16232 - Check Point SmartConsole Improper Authentication Vulnerability

Product: Check Point SmartConsole

CVSS Score: 0

** KEV since 2026-07-22 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16232

CVE-2026-15409 - SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Product: SonicWall SMA1000 Appliances

CVSS Score: 0

** KEV since 2026-07-14 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15409

CVE-2026-48908 - JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability

Product: JoomShaper SP Page Builder

CVSS Score: 0

** KEV since 2026-07-07 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48908

CVE-2026-48282 - Adobe ColdFusion Path Traversal Vulnerability

Product: Adobe Coldfusion 2025

CVSS Score: 0

** KEV since 2026-07-07 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48282

CVE-2026-71362 - Adobe Commerce and Magento Incorrect Authorization Vulnerability

Product: Adobe Commerce and Magento

CVSS Score: 0

** KEV since 2026-09-24 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-71362

CVE-2026-110936 - Siemens Software Center Uncontrolled Search Path Element Vulnerability

Product: Siemens Software Center

CVSS Score: 0

** KEV since 2026-10-20 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110936

CVE-2026-42016, CVE-2026-42018 - Vulnerabilities in JFrog Artifactory

Product: JFrog Artifactory

CVSS Score: 0

** KEV since 2026-09-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42016 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42018 (improper authentication)

CVE-2026-66384 - JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability

Product: JFrog Artifactory

CVSS Score: 0

** KEV since 2026-08-27 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-66384

CVE-2026-19490 - Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Product: Citrix NetScaler

CVSS Score: 0

** KEV since 2026-09-09 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19490

CVE-2026-59822 - BerriAI LiteLLM Improper Authentication Vulnerability

Product: BerriAI LiteLLM

CVSS Score: 0

** KEV since 2026-09-02 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59822

CVE-2026-9586 - Sangoma Switchvox SQL Injection Vulnerability

Product: Sangoma Switchvox

CVSS Score: 0

** KEV since 2026-09-02 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9586

CVE-2026-65400 - Apple macOS Improper Authentication Vulnerability

Product: Apple macOS

CVSS Score: 0

** KEV since 2026-08-18 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65400

CVE-2026-68820 - Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Product: Microsoft Windows

CVSS Score: 0

** KEV since 2026-08-11 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68820

CVE-2026-9198 - IBM Langflow Code Injection Vulnerability

Product: IBM Langflow

CVSS Score: 0

** KEV since 2026-08-04 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9198

CVE-2026-56291 - Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability

Product: Balbooa Forms

CVSS Score: 0

** KEV since 2026-07-10 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56291

CVE-2026-48939 - iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

Product: iCagenda

CVSS Score: 0

** KEV since 2026-07-10 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48939

CVE-2026-55255 - Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Product: Langflow

CVSS Score: 0

** KEV since 2026-07-07 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55255

CVE-2026-56290 - Joomlack Page Builder Improper Access Control Vulnerability

Product: Joomlack Page Builder

CVSS Score: 0

** KEV since 2026-07-07 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56290

CVE-2026-101767 - The vulnerability in Oracle Application Object Library product of Oracle E-Business Suite (component: Core) allows for a takeover by unauthenticated attackers with network access via HTTP on supported versions 12.2.3-12.2.15.

Product: Oracle E-Business Suite

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101767

ISC Podcast: https://isc.sans.edu/podcastdetail/10144

NVD References: https://www.oracle.com/security-alerts/cpuoct2026.html

CVE-2026-113380 - RingRTC library is vulnerable to interference by a peer saturating a call's FSM queue, hindering local hangup from properly ending the call.

Product: RingRTC

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113380

ISC Podcast: https://isc.sans.edu/podcastdetail/10148

CVE-2026-86990 - iOS and iPadOS had an access issue that could allow malicious apps to access the camera without user permission, now fixed in versions 18.7.11, 26.7.2, and 27.2.

Product: Apple iOS and iPadOS

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86990

ISC Diary: https://isc.sans.edu/diary/33458

ISC Podcast: https://isc.sans.edu/podcastdetail/10152

CVE-2026-28864 - iOS and macOS had a vulnerability that allowed local attackers to access a user's Keychain items, now fixed in the latest software updates.

Product: Multiple Apple products

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28864

ISC Diary: https://isc.sans.edu/diary/33458

ISC Podcast: https://isc.sans.edu/podcastdetail/10152

CVE-2026-106173 - Fortinet FortiSIEM 7.5.0 is vulnerable to path traversal, allowing attackers to execute unauthorized code through crafted packets.

Product: Fortinet FortiSIEM

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106173

ISC Podcast: https://isc.sans.edu/podcastdetail/10144

CVE-2026-100202 - Windows Message Queuing Queue Manager Remote Code Execution Vulnerability

Product: Windows Message Queuing

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100202

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100202

CVE-2026-100219, CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerabilities

Product: Microsoft QUIC

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100219

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105016

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100219

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105016

CVE-2026-100222 - Network Policy Server (NPS) Remote Code Execution Vulnerability

Product: Network Policy Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100222

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100222

CVE-2026-102210 - Windows Text Shaping Remote Code Execution Vulnerability

Product: Microsoft Windows Text Shaping

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102210

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102210

CVE-2026-105010 - Microsoft Windows Search Component Elevation of Privilege Vulnerability

Product: Microsoft Windows Search Component

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105010

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105010

CVE-2026-69634 - Windows iSCSI Remote Code Execution Vulnerability

Product: Microsoft Windows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69634

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69634

CVE-2026-69639 - Windows libarchive Remote Code Execution Vulnerability

Product: Microsoft Windows libarchive

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69639

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69639

CVE-2026-83519 - Windows Error Reporting Remote Code Execution Vulnerability

Product: Microsoft Windows Error Reporting

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83519

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83519

CVE-2026-83782 - Windows Shell Remote Code Execution Vulnerability

Product: Microsoft Windows Shell

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83782

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83782

CVE-2026-110264 - Integer Overflow or Wraparound in GitLab

Product: GitLab

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110264

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110264

CVE-2026-97229 - Integer Overflow or Wraparound in GitLab

Product: GitLab

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97229

CVE-2026-77524 - KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Product: KEDA

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77524

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77524

CVE-2026-78663 - Double flow control refund on HTTP/2 server streams in net/http

Product: Google gRPC

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78663

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78663

CVE-2026-111444 - Wheels through 4.1.2 is vulnerable to SQL injection on MySQL/MariaDB with backslash escaping enabled when an application supplies request data to inline-literal paths.

Product: Wheels

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111444

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111444

CVE-2026-115384 - Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow

Product: Bytecode Alliance Wasmtime

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-115384

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-115384

CVE-2026-57941 - Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Product: Apache HTTP Server

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57941

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57941

CVE-2026-91403 - Oracle Java SE and Oracle GraalVM products are vulnerable to an easily exploitable attack that allows unauthenticated network access, potentially leading to unauthorized creation, deletion, or modification of critical data.

Product: Oracle Java SE and Oracle GraalVM

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91403

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-91403

CVE-2026-105014 - Azure Pipelines Remote Code Execution Vulnerability

Product: Microsoft Azure Pipelines

CVSS Score: 9.1

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105014

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105014

CVE-2026-110063 - VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability

Product: Microsoft VM Inspector for Azure Virtual Machines

CVSS Score: 10.0

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110063

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110063

CVE-2026-83938 - Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

Product: Microsoft Azure Kubernetes Configuration Service

CVSS Score: 10.0

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83938

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83938

CVE-2026-97785 - AAD App Proxy Elevation of Privilege Vulnerability

Product: Microsoft AAD App Proxy

CVSS Score: 10.0

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97785

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97785

CVE-2026-113802 - Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 is vulnerable to an OS command injection due to unsanitized input in the sub_23B54 function, allowing remote unauthenticated attackers to execute arbitrary commands as root.

Product: Wavlink WL-WN530BE1-A firmware

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113802

CVE-2026-113389, CVE-2026-113390, CVE-2026-113391 - Command injection vulnerabilities in DrayTek Vigor2960 1.5.1.6

Product: Draytek Vigor2960

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113389

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113390

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113391

CVE-2026-113506 - aaPanel prior to version 8.25.0 is vulnerable to remote OS command injection via the ExecShell function in File Manager's common.py, exploiting manipulated arguments, with the vendor confirming that authentication is required to exploit the disclosed vulnerabilities.

Product: aaPanel

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113506

CVE-2026-109444 - OpenSRE through 0.1.2026.10.19 has an approval gate bypass vulnerability that allows attackers to execute shell commands without confirmation due to the execution_allowed() function always returning True, enabling them to inject malicious instructions into alerts or Slack messages to gain access to sensitive credentials.

Product: OpenSRE

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109444

CVE-2026-75128 - Langchain-Chatchat versions through 0.3.1.3 are vulnerable due to an unauthenticated POST /tools/call API endpoint that allows remote attackers to execute arbitrary OS commands via the always-registered shell tool.

Product: Langchain-Chatchat

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75128

CVE-2026-77930 - EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to execute host shell commands by exploiting async sub-agents without proper security constraints.

Product: EvoScientist

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77930

CVE-2026-77932 - DB-GPT through 0.8.2 has an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to exploit the /api/v1/chat/react-agent endpoint to execute arbitrary Python or bash commands as root due to improper user role handling.

Product: DB-GPT

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77932

CVE-2026-101356 - Apache Tomcat contains an incorrect object recycling and re-use vulnerability in HTTP/2 processing of asynchronous servlets that can lead to request and/or response mix-ups between users, affecting versions 11.0.22 to 11.0.26, 10.1.55 to 10.1.60, and 9.0.118 to 9.0.122; users are advised to upgrade to versions 11.0.27, 10.1.61, or 9.0.123 to mitigate this issue.

Product: Apache Tomcat

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101356

NVD References: https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27

CVE-2026-103119 - Apache Tomcat is affected by a buffer under-read vulnerability that can cause a large non-blocking write to split the response body between requests, leading to potential request failures and data leakage.

Product: Apache Tomcat

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103119

NVD References: https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80

CVE-2026-113672 - Argo CD versions 0.9.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contain a vulnerability that allows attackers to read sensitive files and exhaust memory by exploiting improper handling of .jsonnet file imports, requiring only minimal permissions to exploit.

Product: Argo CD

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113672

NVD References:

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww

CVE-2026-113708 - Argo CD versions 2.7.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 are vulnerable to command execution via Kustomize due to improper handling of ref or version query values, allowing attackers to run arbitrary commands within the argocd-repo-server when using local transport URLs like file://, potentially exposing sensitive data.

Product: Argo CD

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113708

NVD References:

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-9v9p-x54c-58gc

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch

CVE-2026-113709 - Argo CD, from versions 2.1.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, is vulnerable to arbitrary code execution through Helm plugins due to misconfigured `helmGlobals.configHome`, allowing attackers with limited permissions to exploit repository-controlled locations.

Product: Argo CD

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113709

NVD References:

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx

- https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch

CVE-2026-92559 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 may allow remote attackers to access sensitive information by binding to an unrestricted IP address.

Product: IBM App Connect Enterprise

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92559

NVD References: https://www.ibm.com/support/pages/node/7291781

CVE-2026-77933 - DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that allows attackers to authenticate as root with full database access due to a static MYSQL_ROOT_PASSWORD and exposure of port 3306.

Product: DB-GPT

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77933

CVE-2026-77936 - Letta through 0.16.8 is vulnerable due to a misconfigured compose.yaml that leaves API routes unauthenticated and exposes a superuser PostgreSQL port with default credentials, allowing remote attackers to execute arbitrary Python code, manage admin users, or run OS commands.

Product: Letta

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77936

CVE-2026-105312 - Kubernetes allows tenants with create permission on Console custom resources to deploy arbitrary container images, potentially enabling cross-tenant control-plane access to Strimzi resources through compromised ServiceAccount tokens.

Product: Red Hat

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105312

CVE-2026-113620 - Eclipse ioFog Controller versions 3.8.0 through 3.9.1 are vulnerable to a privilege escalation attack via unverified bearer JWTs in WebSocket upgrades on exec and log routes, allowing attackers to initiate sessions for known microservices or fogs by exploiting self-minted tokens with admin roles.

Product: Eclipse ioFog Controller

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113620

CVE-2026-112380 - Kiro Crew is vulnerable to missing authorization in its WhatsApp group channel, allowing a remote actor to control other agent sessions and execute arbitrary commands on the host via group messages.

Product: Kiro Crew

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112380

NVD References: https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc

CVE-2026-81212 - IBM DataStage on Cloud Pak for Data 5.4.0.0 allows unauthenticated users to perform arbitrary writes to shared Redis, compromising tenant data security by enabling anonymous access to modify cached flow parameters.

Product: IBM DataStage on Cloud Pak for Data

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81212

NVD References: https://www.ibm.com/support/pages/node/7289603

Multiple vulnerabilities in Chromium

Product: Google Chrome

CVSS Score: 9.6

Google:

- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html

- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102304 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102306 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102308 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102309 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102316 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102331 (buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112992 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113007 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113014 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113020 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113023 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113056 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113072 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113078 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113084 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113089 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113116 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113126 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113138 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113169 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113171 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113186 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113189 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113211 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113222 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113235 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113252 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113261 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113263 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113270 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113283 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113300 (out of bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113328 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113336 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113342 (memory corruption)

Oracle's October 2026 Critical Patch Update contains 1295 new security patches across multiple product families, including but not limited to Oracle Supply Chain Products, JD Edwards, MySQL, Fusion Middleware, Helidon, Oracle Analytics, Oracle Communications, Oracle E-Business Suite, Oracle Enterprise Manager, Database, Java SE, HealthCare Applications, Siebel, and PeopleSoft.

- https://www.oracle.com/security-alerts/cpuoct2026.html