Overview of incoming advisories.
2018 results found
A critical vulnerability tracked as CVE-2026-74580 and named 'Vghost' has been discovered in Linux's vhost subsystem. The flaw allows local users to read and write kernel memory arbitrarily, enabling privilege escalation to root. It affects nearly a decade's worth of Linux kernel versions. In virtualization environments, the bug can be exploited by an untrusted virtual machine to write to the host's memory and hijack the hypervisor process, effectively breaking out of the guest VM. The vulnerability was discovered by Tencent Zhuque Lab using AI-assisted techniques. The combination of local privilege escalation and VM escape capabilities makes this a severe security risk for both standalone Linux systems and virtualized infrastructures.
View original advisory →CVE-2026-0322 is a code injection vulnerability affecting Palo Alto Networks PAN-OS. An authenticated attacker with network access can exploit this vulnerability to execute arbitrary code with root privileges on the affected firewall. The vulnerability is tracked by CISA and listed under BOD 26-04, which prioritizes security updates based on risk. CISA provides forensics triage requirements as part of the implementation guidance for this directive. The vulnerability is also documented in the NVD and Palo Alto Networks' own security advisory portal. The high criticality rating reflects the severity of potential root-level code execution on network security devices.
View original advisory →Ahsay AhsayCBS contains an improper authentication vulnerability tracked as CVE-2026-105133. A remote attacker can bypass authentication by manipulating the random parameter in the API component's checkSysPwd function. This vulnerability can be chained with CVE-2026-105134 to potentially increase the severity of exploitation. The issue is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. CISA has also published forensics triage requirements as part of the BOD 26-04 implementation guidance. Ahsay has released a patch addressing both CVE-2026-105133 and CVE-2026-105134. Organizations using AhsayCBS are strongly urged to apply the available patch immediately. The vulnerability poses a significant risk due to its remote exploitability and authentication bypass nature.
View original advisory →CVE-2026-76519 is a relative path traversal vulnerability affecting Cisco Secure Email Gateway (ESA). An unauthenticated, remote attacker could exploit this flaw to write arbitrary files on the underlying operating system, potentially leading to full system compromise. The vulnerability is tracked by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. Cisco has published a security advisory detailing the issue and remediation steps. The vulnerability is rated High criticality. Organizations using Cisco Secure Email Gateway are advised to apply patches immediately and conduct forensic triage as outlined in CISA guidance.
View original advisory →CVE-2026-105134 is a command injection vulnerability affecting Ahsay AhsayCBS backup software. The flaw resides in the Replication Receiver component, specifically the /rps/api/json/UpdateReceivers.do endpoint, where manipulation of the 'random' parameter allows a remote attacker to execute arbitrary operating system commands. This vulnerability can be chained with CVE-2026-105133 to potentially increase the severity or scope of exploitation. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Organizations using AhsayCBS are urged to apply the vendor-released patch immediately. CISA has also outlined forensic triage requirements for affected systems under BOD 26-04 implementation guidance. The vulnerability is catalogued in the NVD and carries a high criticality rating.
View original advisory →A critical heap buffer overflow vulnerability tracked as CVE-2026-39919 has been discovered in the Ghostscript interpreter and rendering engine. The flaw allows attackers to achieve remote code execution by uploading specially crafted PDF files to vulnerable servers. Ghostscript is widely used for processing PostScript and PDF files across many platforms and applications. The vulnerability could allow remote attackers to effectively hijack servers that process PDF uploads. Given Ghostscript's widespread deployment in web applications, print servers, and document processing pipelines, the attack surface is significant. Organizations using Ghostscript-based document processing workflows are advised to apply patches promptly. The critical severity rating reflects the ease of exploitation via a common file format and the potential for full server compromise.
View original advisory →An attacker chained three zero-day vulnerabilities in Ivanti Connect Secure, a widely used VPN appliance, to achieve unauthenticated root-level command execution. The attack chain was discovered and reported to Ivanti by security firm Volexity on October 13, 2026. Ivanti has released patches for two of the three flaws but the third remains unpatched. Ivanti urged customers on affected versions to act immediately. The ability to gain root access without authentication makes this a critical threat. The chaining of multiple zero-days indicates a sophisticated attacker. No specific CVE identifiers were mentioned in the article excerpt. Volexity's disclosure highlights active exploitation risk for organizations using Ivanti Connect Secure.
View original advisory →SAP disclosed a critical CVSS 10.0 vulnerability in its Cloud SDK for Python, affecting multi-tenant applications on SAP Business Technology Platform (BTP). The flaw can cause an application's OAuth2 client credentials to be sent to an attacker-controlled server. The vulnerability specifically impacts applications using the SDK as SAP's official Python client for BTP services. Exploitation requires the attacker to control a tenant subdomain. SAP published a security advisory on October 13, 2026, disclosing the issue. The severity of CVSS 10 indicates maximum criticality, suggesting the flaw is easily exploitable with high impact. Organizations using SAP BTP with the Python Cloud SDK in multi-tenant configurations are at risk of credential compromise and potential unauthorized access to BTP services.
View original advisory →Ivanti has issued an urgent warning to customers about an actively exploited zero-day vulnerability affecting Ivanti Connect Secure (ICS), a widely used remote access gateway product. The company is urging immediate patching to mitigate the risk. The vulnerability is being actively exploited in the wild, indicating a high-severity threat. Ivanti Connect Secure is commonly used by enterprises for remote access, making this a significant risk for corporate environments. This follows a pattern of Ivanti products being targeted by threat actors in previous years. Organizations using ICS are advised to apply patches as soon as possible and review their systems for signs of compromise. The zero-day nature of the flaw means it was exploited before a fix was publicly available, increasing the potential impact.
View original advisory →Docker disclosed a critical vulnerability tracked as CVE-2026-105445 affecting Docker Hub, the widely used container image registry. The flaw allowed attackers to access another user's container repositories by leveraging a personal access token (PAT). This could enable malicious actors to impersonate legitimate users and tamper with container images. Such an attack could have serious supply chain implications, as compromised images could be distributed to downstream users and systems. The vulnerability was classified as critical given the potential for widespread impact across containerized environments. Docker has since disclosed the issue, implying a patch or mitigation has been or is being made available.
View original advisory →Ivanti has patched a critical zero-day vulnerability in Connect Secure that allows unauthenticated remote command execution. The vulnerability has already been actively exploited in the wild prior to the patch being available. No public Proof-of-Concept is currently available, but NCSC expects one to emerge shortly, increasing the risk of widespread exploitation. The advisory was published by the Dutch National Cyber Security Centre (NCSC). Organizations using Ivanti Connect Secure are strongly advised to apply the patch immediately. The high exploitability and pre-authentication nature of the flaw make it especially dangerous for exposed systems.
View original advisory →SAP released its October 2026 security updates addressing 20 security vulnerabilities across multiple products. The most critical flaw is a maximum-severity Server-Side Request Forgery (SSRF) vulnerability found in the Cloud SDK for Python, specifically in its OAuth2 implementation. The vulnerability received the highest possible severity rating, indicating significant risk to affected systems. Organizations using SAP Cloud SDK for Python are urged to apply the patches immediately. The update cycle also covers a range of other SAP products with varying severity levels. SSRF vulnerabilities can allow attackers to make the server send requests to unintended internal or external resources, potentially exposing sensitive data or enabling further attacks. SAP has not disclosed whether the vulnerability is being actively exploited in the wild. Customers are advised to consult SAP's official security portal for detailed patch guidance.
View original advisory →A high-severity vulnerability (CVE-2026-92817) has been identified in Inductive Automation Ignition Software affecting versions 8.1.0-8.1.54 and 8.3.0-8.3.8. The flaw resides in the Ignition Perspective module, which fails to properly validate session privileges when determining Designer-level access. An authenticated low-privilege user with access to a Vision project can supply their valid Vision session identifier to gain Designer-level privileges, enabling arbitrary code execution in the context of the Ignition Gateway process. The vulnerability is classified as CWE-863 Incorrect Authorization, with a CVSS v3.1 score of 8.8 (HIGH). It impacts critical infrastructure sectors including Critical Manufacturing, Energy, and Information Technology. Patches are available via Ignition versions 8.3.9 and 8.1.55. No known public exploitation has been reported at the time of publication.
View original advisory →CISA has issued an alert regarding CVE-2026-104935, a zero-day authentication bypass vulnerability in Ivanti Connect Secure affecting versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The vulnerability allows remote, unauthenticated execution of arbitrary commands, enabling credential theft and data exfiltration. Threat actors are actively exploiting this vulnerability in the wild. CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog as of October 13, 2026. Organizations are urged to immediately update to the latest version of Ivanti Connect Secure. Notably, Ivanti's Integrity Checker Tool may not detect exploitation because threat actor commands execute in memory, requiring network and memory forensics for compromise detection. CISA recommends a recovery process including factory reset, upgrade, configuration restore, and credential/certificate rotation. Ivanti Connect Secure version 22.8 reaches end of life on January 31, 2027.
View original advisory →Three vulnerabilities in LG's webOS platform can be chained together to grant an attacker on the same local network root access to certain LG smart TVs. The attack requires no PIN or user interaction, making it a pre-authentication exploit. The vulnerability chain was confirmed on two TV models: the 32LQ636BPSA and the 27TQ600SW, both running webOS 7.5.7-25 firmware. SSD Secure Disclosure published an advisory on October 12 detailing the vulnerability chain. LG has issued a patch to address the vulnerabilities. The attack surface is limited to the local network, reducing but not eliminating the risk for affected users.
View original advisory →On the night of October 11, attackers remotely hijacked refrigeration controllers made by Danish company Danfoss at hundreds of French supermarkets. The attackers raised temperatures in fridges and freezers to as high as 50°C, causing widespread food spoilage and forcing stores to discard large quantities of food. The attack vector was the remote management capability built into Danfoss controllers, which maintenance firms use to manage refrigeration units across store locations. Multiple French retail chains were affected, including Les Mousquetaires. The incident highlights serious cybersecurity risks in industrial control systems used in retail and food supply infrastructure. This type of attack on operational technology (OT) can have significant physical and financial consequences. The event underscores the need for stronger access controls and security measures on remotely accessible ICS/SCADA devices.
View original advisory →Progress Software disclosed 31 vulnerabilities in MarkLogic Server, with five rated critical. Two of the critical flaws could allow accounts with only delegated manager privileges to gain full administrator control of the server. All 31 vulnerabilities were published on October 12, 2026. Patches were made available on September 10, 2026, in MarkLogic versions 11.3.7 and 12.1.0. Organizations using affected versions are advised to update immediately to prevent unauthorized privilege escalation.
View original advisory →GitLab has released patches addressing a maximum-severity (CVSS 10.0) vulnerability affecting both its Community Edition (CE) and Enterprise Edition (EE). The flaw could allow an unauthenticated user to execute arbitrary code on the GitLab server. Exploitation is triggered via a specially crafted regular expression within a CI/CD configuration. The vulnerability represents a critical risk as it requires no authentication, making it broadly exploitable. GitLab has remediated the issue and urges users to apply the patches immediately. The flaw's maximum CVSS score underscores the severity of potential impact on affected installations. No specific CVE identifier was provided in the article excerpt.
View original advisory →Low-cost Android smartphones built on MediaTek platforms are being shipped with malware pre-installed in the device firmware. The campaign, tracked by Bitdefender as 'Midnight Mimosa', affects multiple brands and allows threat actors to covertly install applications, conduct advertising fraud, and convert infected devices into residential proxies. The malware is embedded at the firmware level, making it difficult to detect or remove through standard means. The activity targets budget Android devices across several manufacturers. This supply-chain-style attack raises significant concerns about the security of low-cost Android hardware and the integrity of device firmware from certain suppliers.
View original advisory →CVE-2026-96951 is a command injection vulnerability affecting Microsoft Windows Shell. It allows an unauthorized remote attacker to bypass security features over a network without requiring authentication. The vulnerability has been flagged by CISA under BOD 26-04, which prioritizes security updates based on risk. Microsoft has published guidance through its Security Response Center (MSRC). CISA has also released implementation guidance for BOD 26-04 to assist organizations in prioritizing remediation. The vulnerability is tracked in the NVD as well. Its high Kans value indicates it is considered a critical or high-priority threat requiring prompt attention and patching.
