🔴 CVE Digest — 15 Oct 2026
5 critical vulnerabilities
🔴 CVE-2026-102764 · CVSS 9.3
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not...
🔴 CVE-2026-57496 · CVSS 9.6
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the...
🔴 CVE-2026-47218 · CVSS 9.3
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1...
🔴 CVE-2026-111235 · CVSS 9.1
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The...
🔴 CVE-2026-102946 · CVSS 9.1
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE)...
#CVE #Critical #Vulnerability
5 critical vulnerabilities
🔴 CVE-2026-102764 · CVSS 9.3
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not...
🔴 CVE-2026-57496 · CVSS 9.6
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the...
🔴 CVE-2026-47218 · CVSS 9.3
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1...
🔴 CVE-2026-111235 · CVSS 9.1
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The...
🔴 CVE-2026-102946 · CVSS 9.1
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE)...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-102764 - Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations…
🔍 Zero Day Initiative
ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The...
#ZeroDay #Vulnerability
ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The...
#ZeroDay #Vulnerability
🔍 Zero Day Initiative
ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The...
#ZeroDay #Vulnerability
ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The...
#ZeroDay #Vulnerability
📰 Dark Reading
SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape
The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth.
#CyberNews #Infosec
SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape
The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth.
#CyberNews #Infosec
Dark Reading
SecTor 2026 Reveals a Rapidly Shifting Cybersecurity Landscape
The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth.
📰 Dark Reading
F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud
Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime.
#CyberNews #Infosec
F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud
Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime.
#CyberNews #Infosec
Dark Reading
F-Secure Launches Victim-First Scam Encyclopedia
Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime.
🔴 CVE Digest — 15 Oct 2026
6 critical vulnerabilities
🔴 CVE-2026-111356 · CVSS 9.1
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing...
🔴 CVE-2026-111329 · CVSS 9.8
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated...
🔴 CVE-2026-111322 · CVSS 9.8
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to...
🔴 CVE-2026-111312 · CVSS 9.2
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id]...
🔴 CVE-2026-111283 · CVSS 9.5
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows...
🔴 CVE-2026-111281 · CVSS 9.8
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that...
#CVE #Critical #Vulnerability
6 critical vulnerabilities
🔴 CVE-2026-111356 · CVSS 9.1
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing...
🔴 CVE-2026-111329 · CVSS 9.8
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated...
🔴 CVE-2026-111322 · CVSS 9.8
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to...
🔴 CVE-2026-111312 · CVSS 9.2
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id]...
🔴 CVE-2026-111283 · CVSS 9.5
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows...
🔴 CVE-2026-111281 · CVSS 9.8
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-111356 - MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset…
🔴 CVE Digest — 16 Oct 2026
1 critical vulnerability
🔴 CVE-2026-111444 · CVSS 9.8
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-111444 · CVSS 9.8
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-111444 - Wheels SQL Injection Vulnerability
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions…
📰 BleepingComputer
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
#CyberNews #Infosec
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
#CyberNews #Infosec
BleepingComputer
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.
🔴 CVE Digest — 16 Oct 2026
5 critical vulnerabilities
🔴 CVE-2026-89079 · CVSS 9.8
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to,...
🔴 CVE-2026-103768 · CVSS 9.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in...
🔴 CVE-2026-109515 · CVSS 9.8
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is...
🔴 CVE-2026-109219 · CVSS 9.8
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4...
🔴 CVE-2026-104798 · CVSS 9.8
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions...
#CVE #Critical #Vulnerability
5 critical vulnerabilities
🔴 CVE-2026-89079 · CVSS 9.8
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to,...
🔴 CVE-2026-103768 · CVSS 9.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in...
🔴 CVE-2026-109515 · CVSS 9.8
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is...
🔴 CVE-2026-109219 · CVSS 9.8
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4...
🔴 CVE-2026-104798 · CVSS 9.8
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-89079 - Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data…
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it…
📰 BleepingComputer
BAE Systems cyberattack disrupts US federal court operations
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]
#CyberNews #Infosec
BAE Systems cyberattack disrupts US federal court operations
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]
#CyberNews #Infosec
BleepingComputer
BAE Systems cyberattack disrupts US federal court operations
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts.
📰 BleepingComputer
Microsoft: October Windows update may break Smart App Control
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]
#CyberNews #Infosec
Microsoft: October Windows update may break Smart App Control
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]
#CyberNews #Infosec
BleepingComputer
Microsoft: October Windows update may break Smart App Control
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update.
🔴 CVE Digest — 16 Oct 2026
3 critical vulnerabilities
🔴 CVE-2026-94388 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green...
🔴 CVE-2026-94169 · CVSS 10.0
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command...
🔴 CVE-2026-104730 · CVSS 9.8
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to...
#CVE #Critical #Vulnerability
3 critical vulnerabilities
🔴 CVE-2026-94388 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green...
🔴 CVE-2026-94169 · CVSS 10.0
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command...
🔴 CVE-2026-104730 · CVSS 9.8
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-94388 - WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.
🔴 CVE Digest — 16 Oct 2026
1 critical vulnerability
🔴 CVE-2026-111472 · CVSS 9.3
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-111472 · CVSS 9.3
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-111472 - SQL injection in TSG Profleet
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’…
📰 BleepingComputer
Burger King Japan data breach exposes 11 million customer records
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]
#CyberNews #Infosec
Burger King Japan data breach exposes 11 million customer records
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]
#CyberNews #Infosec
BleepingComputer
Burger King Japan data breach exposes 11 million customer records
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records.
📰 Dark Reading
When AI Agents Commit Breaches, Humans May Not Be Held Liable
As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.
#CyberNews #Infosec
When AI Agents Commit Breaches, Humans May Not Be Held Liable
As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.
#CyberNews #Infosec
Dark Reading
When AI Agents Commit Breaches, Humans May Not Be Held Liable
As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.
🔴 CVE Digest — 16 Oct 2026
1 critical vulnerability
🔴 CVE-2026-111391 · CVSS 9.2
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-111391 · CVSS 9.2
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-111391 - SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to…
📰 BleepingComputer
Employees using personal ChatGPT at work? Here's what IT admins need to do
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. [...]
#CyberNews #Infosec
Employees using personal ChatGPT at work? Here's what IT admins need to do
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. [...]
#CyberNews #Infosec
BleepingComputer
Employees using personal ChatGPT at work? Here's what IT admins need to do
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information…
📰 Dark Reading
When Your Ransomware Negotiator Works for the Other Side
The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.
#CyberNews #Infosec
When Your Ransomware Negotiator Works for the Other Side
The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.
#CyberNews #Infosec
Dark Reading
When Your Ransomware Negotiator Works for the Other Side
The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.
🔴 CVE Digest — 16 Oct 2026
3 critical vulnerabilities
🔴 CVE-2026-18516 · CVSS 9.6
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated...
🔴 CVE-2026-107617 · CVSS 9.8
An attacker can use a hard-coded credential to log in to EseeCloud devices.
🔴 CVE-2026-97851 · CVSS 9.1
The storage status-change REST service allows location records still associated with DICOM instances to be changed to...
#CVE #Critical #Vulnerability
3 critical vulnerabilities
🔴 CVE-2026-18516 · CVSS 9.6
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated...
🔴 CVE-2026-107617 · CVSS 9.8
An attacker can use a hard-coded credential to log in to EseeCloud devices.
🔴 CVE-2026-97851 · CVSS 9.1
The storage status-change REST service allows location records still associated with DICOM instances to be changed to...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-18516 - Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
🔍 Zero Day Initiative
ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The...
#ZeroDay #Vulnerability
ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.4. The...
#ZeroDay #Vulnerability