🔴 CVE Digest — 23 Oct 2026
7 critical vulnerabilities
🔴 CVE-2026-25784 · CVSS 9.8
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image...
🔴 CVE-2026-112862 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows...
🔴 CVE-2026-112860 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign...
🔴 CVE-2025-30054 · CVSS 9.3
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with...
🔴 CVE-2025-30050 · CVSS 9.4
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified...
🔴 CVE-2025-30047 · CVSS 9.4
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an...
🔴 CVE-2025-30046 · CVSS 9.0
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run...
#CVE #Critical #Vulnerability
7 critical vulnerabilities
🔴 CVE-2026-25784 · CVSS 9.8
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image...
🔴 CVE-2026-112862 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows...
🔴 CVE-2026-112860 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign...
🔴 CVE-2025-30054 · CVSS 9.3
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with...
🔴 CVE-2025-30050 · CVSS 9.4
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified...
🔴 CVE-2025-30047 · CVSS 9.4
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an...
🔴 CVE-2025-30046 · CVSS 9.0
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-25784 - bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation…
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was…
📰 Dark Reading
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack
Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may multiply — not contain — the risk.
#CyberNews #Infosec
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack
Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may multiply — not contain — the risk.
#CyberNews #Infosec
Dark Reading
Microsoft Bets on a Unified Security Stack to Contain AI Agents
Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but policing unpredictable AI with AI is a risky endeavor.
🔴 CVE Digest — 23 Oct 2026
1 critical vulnerability
🔴 CVE-2026-107685 · CVSS 9.1
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-107685 · CVSS 9.1
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-107685 - WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not…
📰 BleepingComputer
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]
#CyberNews #Infosec
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]
#CyberNews #Infosec
BleepingComputer
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.
📰 Dark Reading
As AI Risks Grow, Insurers Split on Covering the Damage
Insurers are split on AI risk: some build specialized agentic AI coverage, while major carriers quietly exclude it — leaving enterprises exposed without their knowledge.
#CyberNews #Infosec
As AI Risks Grow, Insurers Split on Covering the Damage
Insurers are split on AI risk: some build specialized agentic AI coverage, while major carriers quietly exclude it — leaving enterprises exposed without their knowledge.
#CyberNews #Infosec
Dark Reading
As Rogue AI Risks Grow, Insurers Split on Covering the Damage
Some insurers are building specialized agentic AI coverage. Other major carriers quietly exclude it. Enterprises are exposed without their knowledge.
📰 Dark Reading
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate but assurance does not.
#CyberNews #Infosec
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate but assurance does not.
#CyberNews #Infosec
Dark Reading
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate, but assurance does not.
📰 Dark Reading
Cyber Insurance's New Reality: Underwriting Isn't Enough
Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.
#CyberNews #Infosec
Cyber Insurance's New Reality: Underwriting Isn't Enough
Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.
#CyberNews #Infosec
Dark Reading
Cyber Insurance's New Reality: Underwriting Isn't Enough
Cyber insurers are tightening requirements, monitoring risk, and offering security services as threats evolve.
🔴 CVE Digest — 23 Oct 2026
11 critical vulnerabilities
🔴 CVE-2026-53921 · CVSS 9.8
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6...
🔴 CVE-2026-57116 · CVSS 9.8
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI...
🔴 CVE-2026-112859 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object...
🔴 CVE-2026-112858 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects...
🔴 CVE-2026-112857 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue...
🔴 CVE-2026-112856 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This...
🔴 CVE-2026-112855 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects...
🔴 CVE-2026-112854 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object...
🔴 CVE-2026-112853 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue...
🔴 CVE-2026-112851 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue...
🔴 CVE-2026-112848 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue...
#CVE #Critical #Vulnerability
11 critical vulnerabilities
🔴 CVE-2026-53921 · CVSS 9.8
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6...
🔴 CVE-2026-57116 · CVSS 9.8
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI...
🔴 CVE-2026-112859 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object...
🔴 CVE-2026-112858 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects...
🔴 CVE-2026-112857 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue...
🔴 CVE-2026-112856 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This...
🔴 CVE-2026-112855 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects...
🔴 CVE-2026-112854 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object...
🔴 CVE-2026-112853 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue...
🔴 CVE-2026-112851 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue...
🔴 CVE-2026-112848 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-53921 - odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options…
📰 BleepingComputer
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub helps protect agents through skill verification, secure connectivity, and runtime...
#CyberNews #Infosec
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub helps protect agents through skill verification, secure connectivity, and runtime...
#CyberNews #Infosec
📰 BleepingComputer
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
#CyberNews #Infosec
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
#CyberNews #Infosec
BleepingComputer
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
🔴 CVE Digest — 23 Oct 2026
5 critical vulnerabilities
🔴 CVE-2026-55486 · CVSS 9.3
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version...
🔴 CVE-2026-53942 · CVSS 9.9
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub...
🔴 CVE-2026-46652 · CVSS 9.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version...
🔴 CVE-2026-46651 · CVSS 9.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version...
🔴 CVE-2026-114357 · CVSS 9.3
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C...
#CVE #Critical #Vulnerability
5 critical vulnerabilities
🔴 CVE-2026-55486 · CVSS 9.3
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version...
🔴 CVE-2026-53942 · CVSS 9.9
Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub...
🔴 CVE-2026-46652 · CVSS 9.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version...
🔴 CVE-2026-46651 · CVSS 9.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version...
🔴 CVE-2026-114357 · CVSS 9.3
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-55486 - Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter…
📰 BleepingComputer
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]
#CyberNews #Infosec
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]
#CyberNews #Infosec
BleepingComputer
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027.
📰 BleepingComputer
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]
#CyberNews #Infosec
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]
#CyberNews #Infosec
BleepingComputer
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
📰 Dark Reading
AI Tools Are Generating Massive Attacks for Little Cost
One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.
#CyberNews #Infosec
AI Tools Are Generating Massive Attacks for Little Cost
One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.
#CyberNews #Infosec
Dark Reading
AI Tools Are Generating Massive Attacks for Little Cost
One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.
🔴 CVE Digest — 23 Oct 2026
1 critical vulnerability
🔴 CVE-2026-115812 · CVSS 9.8
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-115812 · CVSS 9.8
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-115812 - Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is…
📰 BleepingComputer
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]
#CyberNews #Infosec
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]
#CyberNews #Infosec
BleepingComputer
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026.
📰 BleepingComputer
Abandoned Popcorn Time app exposed millions of device to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]
#CyberNews #Infosec
Abandoned Popcorn Time app exposed millions of device to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]
#CyberNews #Infosec
BleepingComputer
Abandoned Popcorn Time app exposed millions of device to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of…
📰 Dark Reading
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.
#CyberNews #Infosec
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.
#CyberNews #Infosec
Dark Reading
Exposed to PHP? Cyber Experts Weigh in With Advice
Fixing PHP2Shell is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.
📰 Dark Reading
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.
#CyberNews #Infosec
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.
#CyberNews #Infosec
Dark Reading
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors no longer hack in; they call help desks, impersonate trusted brands, and use AI-powered deepfakes to walk through the front door.
🔴 CVE Digest — 24 Oct 2026
3 critical vulnerabilities
🔴 CVE-2026-115931 · CVSS 9.9
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not...
🔴 CVE-2026-115893 · CVSS 9.9
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64...
🔴 CVE-2026-115889 · CVSS 9.9
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value...
#CVE #Critical #Vulnerability
3 critical vulnerabilities
🔴 CVE-2026-115931 · CVSS 9.9
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not...
🔴 CVE-2026-115893 · CVSS 9.9
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64...
🔴 CVE-2026-115889 · CVSS 9.9
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-115931 - Arbitrary file read and backend crash through unrestricted provider method calls
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the…