The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Multipath TCP: Use and Detection

Published: 2026-11-02

Last Updated: 2026-11-02 14:52:05 UTC

by Johannes Ullrich (Version: 1)

Last week, an often-ignored TCP option, introduced in 2020, made the news due to a new vulnerability in Linux's implementation (RFC 8684, CVE-2026-98432)

Instead of looking at the vulnerability, I am using this diary to talk a bit about multipath TCP (MPTCP) and how you may see it used in your network.

What is MPTCP?

Traditionally, TCP is a connection-oriented protocol. Connections are established between a client and server, and host IP addresses are not expected to change for a specific connection. This restriction to a specific path does not always match modern system architecture. For example, mobile devices may switch from a local WIFI network to a cellular network at any time. Having to re-establish TCP connections may break applications. At the same time, servers often have a hard time "filling" high-bandwidth links using a single TCP connection due to limits on Window Size and the sequence number range [RFC 6182]. MPTCP is supposed to solve these problems by allowing connections to be split and handed over between different IP addresses.

The only widely used implementation I have observed is iOS/iPadOS. In this case, IPv4 connections to Apple (17.0.0.0/8) often utilize MPTCP [Apple]. MPTCP was initially used for Siri, and later for other services like Apple Music.

Two versions of MPTCP are currently defined and used: v0 and v1 ...

Read the full entry: https://isc.sans.edu/diary/Mutipath+TCP+Use+and+Detection/33482/

Deploying a Local Ghidra Server for Your Malware Analysis Lab

Published: 2026-10-29

Last Updated: 2026-10-29 06:17:41 UTC

by Xavier Mertens (Version: 1)

Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it's convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to revert to a previous snapshot, all changes applied to the VM are... lost! Therefore, it's important to store important data outside the VM.

If you do malware analysis with Ghidra, your work lives in "projects". A project is a ".gpr" file and a ".rep" directory sitting on the disk of your analysis machine. Every renamed function, comment, structure and bookmark you added is stored there. And, as said before, hours of work can be lost if your VM has issues or you restart to a clean snapshot. When you create a new project in Ghidra, it always asks you if you want a "shared" or "non-shared" project ...

Ghidra ships with a component that many people ignore: Ghidra Server. It is included in the standard distribution (no extra download, no license) and turns your local projects into "shared projects" backed by a central repository. Here are some reasons why it's useful to deploy one in your lab ...

Read the full entry: https://isc.sans.edu/diary/Deploying+a+Local+Ghidra+Server+for+Your+Malware+Analysis+Lab/33470/

Yet Another ClickFix Campaign

Published: 2026-10-28

Last Updated: 2026-10-29 00:42:15 UTC

by Brad Duncan (Version: 1)

Introduction

On Wednesday, 2026-10-28, I ran across a ClickFix campaign I haven't seen before. Like several other ClickFix campaigns, this one uses a fake Cloudflare verification page. It targets both macOS and Windows.

I don't yet have a name for this specific activity, but this diary shares some screenshots and indicators.

Unfortunately, I was unable to get the macOS or Windows malware distributed through this particular ClickFix campaign.

Screenshots of the Activity ...

When I ran the command on a Windows host, the server hosting the malware responded with a 403 Forbidden error, and I was unable to proceed any further ...

When I ran the ClickFix command on a macOS host, the domain for the server hosting the malware did not resolve, and I was unable to proceed any further ...

Indicators From the Activity on Wednesday, 2026-10-28 ...

Read the full entry: https://isc.sans.edu/diary/Yet+Another+ClickFix+Campaign/33466/

The Classics Return: Vulnerable E-Mail Scripts (2026.11.04)

https://isc.sans.edu/diary/The+Classics+Return+Vulnerable+EMail+Scripts/33488/

OneNote File Extraction (2026.11.01)

https://isc.sans.edu/diary/OneNote+File+Extraction/33478/

Wireshark 5.0.0rc1 Release (2026.10.31)

https://isc.sans.edu/diary/Wireshark+500rc1+Release/33476/

YARA-X 1.22.1 Release (2026.10.31)

https://isc.sans.edu/diary/YARAX+1221+Release/33474/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2026-111497 - Buffer overflow vulnerability in the Brotli decoder

Product: Brotli

CVSS Score: 8.1

** KEV since 2026-10-27 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497

ISC Podcast: https://isc.sans.edu/podcastdetail/10152

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497

CVE-2015-5477 - ISC BIND Data Processing Errors Vulnerability

Product: ISC BIND

CVSS Score: 0

** KEV since 2026-10-08 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2015-5477

CVE-2026-104935 - Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Product: Ivanti Connect Secure

CVSS Score: 0

** KEV since 2026-10-13 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104935

ISC Podcast: https://isc.sans.edu/podcastdetail/10160

CVE-2026-109618 - PHP Memory Corruption Vulnerability

Product: PHP

CVSS Score: 0

** KEV since 2026-10-26 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109618

ISC Podcast: https://isc.sans.edu/podcastdetail/10154

CVE-2026-97229 - Integer Overflow or Wraparound in GitLab

Product: GitLab

CVSS Score: 10.0

** KEV since 2026-10-29 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97229

CVE-2026-109619 - PHP Stale Internal Request-State Vulnerability

Product: PHP

CVSS Score: 0

** KEV since 2026-10-26 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109619

ISC Podcast: https://isc.sans.edu/podcastdetail/10154

CVE-2026-96951 - Windows Shell Security Feature Bypass Vulnerability

Product: Microsoft Windows Shell

CVSS Score: 8.8

** KEV since 2026-10-13 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96951

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951

CVE-2026-118527 - Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Product: Ivanti Connect Secure

CVSS Score: 0

** KEV since 2026-10-30 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118527

ISC Podcast: https://isc.sans.edu/podcastdetail/10160

CVE-2026-111357 - Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Product: Ivanti Connect Secure

CVSS Score: 0

** KEV since 2026-10-30 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111357

ISC Podcast: https://isc.sans.edu/podcastdetail/10160

CVE-2026-48356 - Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Product: Adobe Commerce and Magento

CVSS Score: 0

** KEV since 2026-10-27 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48356

CVE-2026-76418 - Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Product: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

CVSS Score: 8.6

** KEV since 2026-10-29 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76418

NVD References:

- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418

CVE-2026-21589 - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Product: Atlassian Multiple Products

CVSS Score: 0

** KEV since 2026-10-15 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21589

CVE-2026-104286 - Fortinet FortiMail Path Traversal Vulnerability

Product: Fortinet FortiMail

CVSS Score: 0

** KEV since 2026-10-01 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104286

CVE-2026-119977 - WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

Product: WordPress Core

CVSS Score: 0

** KEV since 2026-11-03 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119977

CVE-2026-110447 - Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Product: Collabora Online – Built-in CODE Server

CVSS Score: 0

** KEV since 2026-10-23 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110447

CVE-2026-41709 - Broadcom VMWare ESX Insufficient Logging Vulnerability

Product: VMWare ESX

CVSS Score: 0

** KEV since 2026-10-28 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41709

CVE-2026-58115 - Siemens SIMATIC IoT2050 Advanced has a vulnerability where unauthenticated access to programming nodes through the Node-RED HTTP interface could lead to remote code execution with maximum privileges.

Product: Siemens SIMATIC IoT2050 Advanced

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58115

ISC Podcast: https://isc.sans.edu/podcastdetail/10164

CVE-2026-110264 - Integer Overflow or Wraparound in GitLab

Product: GitLab

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110264

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110264

CVE-2026-78663 - Double flow control refund on HTTP/2 server streams in net/http

Product: HTTP/2 server

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78663

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78663

CVE-2026-100219 - Microsoft QUIC Remote Code Execution Vulnerability

Product: Microsoft QUIC

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100219

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100219

CVE-2026-105008 - Windows Schannel Spoofing Vulnerability

Product: Microsoft Schannel

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105008

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105008

CVE-2026-69705 - Windows iSCSI Remote Code Execution Vulnerability

Product: Microsoft Windows iSCSI

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-69705

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69705

CVE-2026-70147, CVE-2026-70153 - Microsoft PostScript Printer Driver Remote Code Execution Vulnerabilities

Product: Microsoft PostScript Printer Driver

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70147

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70153

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70147

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70153

CVE-2026-70157 - Windows System Information Console Remote Code Execution Vulnerability

Product: Microsoft Windows System Information Console

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70157

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70157

CVE-2026-83517 - Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Product: Microsoft Windows Media Foundation

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83517

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83517

CVE-2026-83519, CVE-2026-83693, CVE-2026-83748 - Windows Error Reporting Remote Code Execution Vulnerabilities

Product: Microsoft Windows Error Reporting

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83519

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83693

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83748

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83519

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83693

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83748

CVE-2026-83578 - Microsoft PowerShell Remote Code Execution Vulnerability

Product: Microsoft PowerShell

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83578

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83578

CVE-2026-83770 - Windows Text Shaping Remote Code Execution Vulnerability

Product: Microsoft Windows Text Shaping

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83770

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83770

CVE-2026-83780 - Windows CCFFilter Driver Remote Code Execution Vulnerability

Product: Microsoft Windows CCFFilter

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83780

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83780

CVE-2026-83782 - Windows Shell Remote Code Execution Vulnerability

Product: Microsoft Windows Shell

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83782

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83782

CVE-2026-83910 - RPC Runtime Library Remote Code Execution Vulnerability

Product: RPC Runtime Library

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83910

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83910

CVE-2026-85928 - Windows Volume Manager Extension Driver Remote Code Execution Vulnerability

Product: Microsoft Windows Volume Manager

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85928

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85928

CVE-2026-96219 - Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability

Product: Microsoft Windows Local Security Authority Subsystem Service (LSASS)

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96219

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96219

CVE-2026-96864 - Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability

Product: Microsoft Failover Cluster Virtual Driver

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96864

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96864

CVE-2026-115893 - Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Product: Wasmtime

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-115893

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-115893

CVE-2026-115889 - Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Product: Wasmtime

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-115889

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-115889

CVE-2026-115384 - Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow

Product: Wasmtime

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-115384

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-115384

CVE-2026-97631 - Pre-boot RCE in EDK II PXE driver

Product: EDK2 BIOS

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97631

ISC Podcast: https://isc.sans.edu/podcastdetail/10156

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97631

Multiple Vulnerabilities in Adobe Campaign Classic

CVSS Scores: 9.1 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104350 (reflected cross-site scripting)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104351 (code injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104353 (OS command injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105781 (SQL Injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104354 (SQL Injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105489 (SQL Injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105779 (SQL Injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105780 (incorrect authorization)

NVD References: https://www.adobe.com/trust/security/products/campaign/apsb26-162.html

CVE-2026-48360 - Adobe Connect is vulnerable to a Code Injection flaw that allows for arbitrary code execution by an attacker with user interaction via a malicious URL or compromised webpage.

Product: Adobe Connect

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48360

NVD References: https://www.adobe.com/trust/security/products/connect/apsb26-182.html

Multiple Arbitrary Code Execution Vulnerabilities in IBM Langflow OSS

CVSS Scores: 9.8 - 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93680 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104339 (improper handling of special OS command elements)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107327 (missing authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107328 (insufficient validation in eval/exec functions)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107329 (inadequate control over code generation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110186 (inadequate control over code generation)

NVD References:

- https://www.ibm.com/support/pages/node/7294467

- https://www.ibm.com/support/pages/node/7293015

- https://www.ibm.com/support/pages/node/7293016

- https://www.ibm.com/support/pages/node/7293016

- https://www.ibm.com/support/pages/node/7293016

- https://www.ibm.com/support/pages/node/7294467

Multiple Vulnerabilities in Progress Software WS_FTP Server

CVSS Scores: 9.0 - 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84295 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90863 (missing authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90864 (path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90865 (OS command injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90866 (path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90868 (OS command injection)

NVD References: https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

CVE-2026-114595 - EPICS Base versions 7.0.10 and prior have an integer overflow in network request processing that can lead to memory corruption, denial of service, or potential remote code execution.

Product: EPICS Base

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-114595

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01

CVE-2026-112352 - Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate users by forging session cookies with only a cleartext username, enabling potential root command execution.

Product: Sunhillo Sureline

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112352

NVD References: https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookie

CVE-2026-116692 - MLflow, from versions 3.12.0rc0 to 3.17.0, has a vulnerability that allows third-party scorer deserialization from request-selected descendants of allowed modules, enabling arbitrary code execution in improperly secured deployments.

Product: MLflow

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116692

NVD References: https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9

CVE-2026-110879 - Jackson-databind validates outer classes of type IDs while allowing attacker-selected and potentially unsafe classes inside generic arguments, bypassing critical validation safeguards and leading to arbitrary command execution in certain configurations.

Product: FasterXML Jackson-databind

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110879

NVD References: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph

Multiple Vulnerabilities in Dell PowerProtect Data Domain

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86400 (improper authentication)

NVD References: https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86397 (improper authentication)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90717 (authentication bypass by spoofing)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86384 (hard-coded cryptographic keys)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103792 (SQL injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103799 (missing authorization)

NVD References: https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

CVE-2026-103406 - Juniper Networks Session Smart Conductor contains a vulnerability that allows remote attackers to execute arbitrary commands as root through an improperly neutralized salt minion ID.

Product: Juniper Networks Session Smart Conductor

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103406

NVD References: https://supportportal.juniper.net/JSA112183

CVE-2026-103409 - Juniper Networks Session Smart Router contains a vulnerability that allows unauthenticated attackers to gain administrative privileges via crafted URL parameters on an insecure endpoint prior to device onboarding to Mist/Conductor.

Product: Juniper Networks Session Smart Router

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103409

NVD References: https://supportportal.juniper.net/JSA112183

CVE-2026-42922 - FUXA (version 1.3.2-2809) contains an authorization bypass vulnerability in the /nodered functionality that allows unauthenticated HTTP requests to execute arbitrary code.

Product: FUXA

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42922

NVD References: https://talosintelligence.com/vulnerability_reports/TALOS-2026-2419

CVE-2026-97854 - Yamaha wireless LAN router NWR100 contains an OS command injection vulnerability that allows arbitrary OS commands to be executed via specially crafted requests.

Product: Yamaha wireless LAN router NWR100

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97854

NVD References:

- https://jvn.jp/en/vu/JVNVU91027179/

- https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU91027179.html

CVE-2026-51863 - DB-GPT v0.7.5 and 0.8.0 are vulnerable to directory traversal, allowing remote attackers to write files outside the intended workspace via the validated exploitation path in use_example_file.

Product: DB-GPT

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51863

CVE-2026-18450 - The BMC fails to enforce integrity and encryption for IPMI commands, allowing an attacker to craft packets that execute arbitrary commands during an active session.

Product: BMC

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18450

NVD References: https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

CVE-2026-67074 - HCL BigFix AEX is vulnerable to a Remote Code Execution flaw that could allow attackers to execute code with the application's privileges, potentially resulting in unauthorized access or system compromise.

Product: HCL BigFix AEX

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67074

NVD References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281

CVE-2026-117574 - ai-gateway-payload-processing contains a flaw that allows an authenticated remote attacker to exploit unauthorized access to another tenant's large language model resources by submitting requests with their model identifiers, bypassing authorization checks for API key retrieval.

Product: ai-gateway-payload-processing

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-117574

NVD References: https://access.redhat.com/security/cve/CVE-2026-117574

CVE-2026-107060 - Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

Product: Tailscale

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107060

NVD References: https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107060.md

CVE-2026-118762 - Monkeytype is vulnerable to arbitrary code execution and credential exfiltration in its CI workflow prior to version 26.43.0, due to insecure handling of pull request tokens that allow external contributors to run untrusted code.

Product: Monkeytype

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118762

NVD References: https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-47v3-j88w-92f8

Multiple vulnerabilities in Google Chrome

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106358 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110136 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110144 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110159 (incorrect authorization)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110161 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-112992 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113007 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113014 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113020 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113023 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113056 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113072 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113078 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113084 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113089 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113116 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113126 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113138 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113169 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113171 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113186 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113189 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113211 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113222 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113235 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113252 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113261 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113263 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113270 (use after free)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113283 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113300 (out-of-bounds write)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113328 (improper input validation)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113336 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-113342 (memory corruption)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118309 (information disclosure)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118321 (use after free)

Chrome References:

- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html (2026.10.27)

- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html (2026.10.20)

- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html (2026.10.13)

- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html (2026.10.06)