☁️ AWS Security Blog
Managing identity source transition for AWS IAM Identity Center
October 20, 2026: This post was republished to reflect the new migration capability from Active Directory to an external identity provider (IdP) or the Identity Center directory, now available in IAM Identity Center. September 2, 2026: This post was republished to include Active Directory migration...
#AWS #CloudSecurity
Managing identity source transition for AWS IAM Identity Center
October 20, 2026: This post was republished to reflect the new migration capability from Active Directory to an external identity provider (IdP) or the Identity Center directory, now available in IAM Identity Center. September 2, 2026: This post was republished to include Active Directory migration...
#AWS #CloudSecurity
Amazon
Managing identity source transition for AWS IAM Identity Center | Amazon Web Services
October 20, 2026: This post was republished to reflect the new migration capability from Active Directory to an external identity provider (IdP) or the Identity Center directory, now available in IAM Identity Center. September 2, 2026: This post was republished…
🔴 CVE Digest — 20 Oct 2026
7 critical vulnerabilities
🔴 CVE-2026-93475 · CVSS 9.3
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts...
🔴 CVE-2026-86471 · CVSS 9.3
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server...
🔴 CVE-2026-113703 · CVSS 9.3
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where...
🔴 CVE-2026-113682 · CVSS 9.1
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that...
🔴 CVE-2026-113678 · CVSS 9.9
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows...
🔴 CVE-2026-113613 · CVSS 9.2
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to...
🔴 CVE-2026-103119 · CVSS 9.1
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response...
#CVE #Critical #Vulnerability
7 critical vulnerabilities
🔴 CVE-2026-93475 · CVSS 9.3
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts...
🔴 CVE-2026-86471 · CVSS 9.3
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server...
🔴 CVE-2026-113703 · CVSS 9.3
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where...
🔴 CVE-2026-113682 · CVSS 9.1
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that...
🔴 CVE-2026-113678 · CVSS 9.9
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows...
🔴 CVE-2026-113613 · CVSS 9.2
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to...
🔴 CVE-2026-103119 · CVSS 9.1
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-93475 - Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus…
📰 BleepingComputer
OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]
#CyberNews #Infosec
OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]
#CyberNews #Infosec
BleepingComputer
OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages.
⚠️ CERT/CC Vulnerability Notes
Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting
An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent...
#Advisory #Vulnerability
Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting
An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent...
#Advisory #Vulnerability
kb.cert.org
CERT/CC Vulnerability Note VU#645818
Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting
📰 BleepingComputer
Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]
#CyberNews #Infosec
Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]
#CyberNews #Infosec
BleepingComputer
Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information…
📰 Dark Reading
Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties
A judge ordered that Abdulrahman Alfozan be detained after he was arrested earlier this month for allegedly bugging an OpenAI conference room.
#CyberNews #Infosec
Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties
A judge ordered that Abdulrahman Alfozan be detained after he was arrested earlier this month for allegedly bugging an OpenAI conference room.
#CyberNews #Infosec
Dark Reading
Ex-OpenAI Engineer Detained After Planting Secret Recorder at HQ
The perp, who has Saudi ties, was arrested for allegedly bugging an OpenAI conference room, highlighting a preventable insider threat vector.
🔴 CVE Digest — 20 Oct 2026
6 critical vulnerabilities
🔴 CVE-2026-113802 · CVSS 9.8
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54...
🔴 CVE-2026-113672 · CVSS 9.9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and...
🔴 CVE-2026-113506 · CVSS 9.9
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file...
🔴 CVE-2026-105772 · CVSS 9.1
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0...
🔴 CVE-2026-113709 · CVSS 9.9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and...
🔴 CVE-2026-113708 · CVSS 9.9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and...
#CVE #Critical #Vulnerability
6 critical vulnerabilities
🔴 CVE-2026-113802 · CVSS 9.8
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54...
🔴 CVE-2026-113672 · CVSS 9.9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and...
🔴 CVE-2026-113506 · CVSS 9.9
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file...
🔴 CVE-2026-105772 · CVSS 9.1
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0...
🔴 CVE-2026-113709 · CVSS 9.9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and...
🔴 CVE-2026-113708 · CVSS 9.9
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and...
#CVE #Critical #Vulnerability
📰 BleepingComputer
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]
#CyberNews #Infosec
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]
#CyberNews #Infosec
BleepingComputer
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
📰 Dark Reading
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
#CyberNews #Infosec
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised.
#CyberNews #Infosec
Dark Reading
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian certificate authority (CA).
🔴 CVE Digest — 20 Oct 2026
22 critical vulnerabilities
🔴 CVE-2026-112712 · CVSS 9.1
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use()...
🔴 CVE-2026-35499 · CVSS 9.1
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R...
🔴 CVE-2026-40627 · CVSS 9.1
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R...
🔴 CVE-2026-28763 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R...
🔴 CVE-2026-41223 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R...
🔴 CVE-2026-33568 · CVSS 9.1
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s):...
🔴 CVE-2026-41222 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R...
🔴 CVE-2026-40615 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R...
🔴 CVE-2026-42020 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink...
🔴 CVE-2026-42019 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink...
🔴 CVE-2026-42024 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42023 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42022 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42021 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42026 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality...
🔴 CVE-2026-42025 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality...
🔴 CVE-2026-9660 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R...
🔴 CVE-2026-9659 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R...
🔴 CVE-2026-9814 · CVSS 9.1
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s):...
🔴 CVE-2026-9817 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s):...
#CVE #Critical #Vulnerability
22 critical vulnerabilities
🔴 CVE-2026-112712 · CVSS 9.1
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use()...
🔴 CVE-2026-35499 · CVSS 9.1
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R...
🔴 CVE-2026-40627 · CVSS 9.1
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R...
🔴 CVE-2026-28763 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R...
🔴 CVE-2026-41223 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R...
🔴 CVE-2026-33568 · CVSS 9.1
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s):...
🔴 CVE-2026-41222 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R...
🔴 CVE-2026-40615 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R...
🔴 CVE-2026-42020 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink...
🔴 CVE-2026-42019 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink...
🔴 CVE-2026-42024 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42023 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42022 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42021 · CVSS 9.1
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration...
🔴 CVE-2026-42026 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality...
🔴 CVE-2026-42025 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality...
🔴 CVE-2026-9660 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R...
🔴 CVE-2026-9659 · CVSS 9.1
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R...
🔴 CVE-2026-9814 · CVSS 9.1
An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s):...
🔴 CVE-2026-9817 · CVSS 9.1
A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s):...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-112712 - @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router…
🔴 CVE Digest — 21 Oct 2026
11 critical vulnerabilities
🔴 CVE-2026-92559 · CVSS 9.8
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due...
🔴 CVE-2026-91665 · CVSS 9.8
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91663 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91658 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91656 · CVSS 9.1
Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is...
🔴 CVE-2026-91655 · CVSS 9.1
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91644 · CVSS 9.3
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91638 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91637 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91624 · CVSS 9.1
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component:...
🔴 CVE-2026-91622 · CVSS 9.3
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component:...
#CVE #Critical #Vulnerability
11 critical vulnerabilities
🔴 CVE-2026-92559 · CVSS 9.8
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due...
🔴 CVE-2026-91665 · CVSS 9.8
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91663 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91658 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91656 · CVSS 9.1
Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is...
🔴 CVE-2026-91655 · CVSS 9.1
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91644 · CVSS 9.3
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91638 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91637 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily...
🔴 CVE-2026-91624 · CVSS 9.1
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component:...
🔴 CVE-2026-91622 · CVSS 9.3
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component:...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-92559 - IBM App Connect Enterprise is vulnerable to a credential exposure
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
📰 BleepingComputer
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]
#CyberNews #Infosec
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]
#CyberNews #Infosec
BleepingComputer
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
📰 BleepingComputer
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]
#CyberNews #Infosec
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]
#CyberNews #Infosec
BleepingComputer
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites.
🔴 CVE Digest — 21 Oct 2026
2 critical vulnerabilities
🔴 CVE-2026-114119 · CVSS 9.8
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that...
🔴 CVE-2026-114108 · CVSS 9.8
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-114119 · CVSS 9.8
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that...
🔴 CVE-2026-114108 · CVSS 9.8
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-114119 - Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database…
🔴 CVE Digest — 21 Oct 2026
1 critical vulnerability
🔴 CVE-2026-113744 · CVSS 10.0
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-113744 · CVSS 10.0
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-113744 - Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads…
🔴 CVE Digest — 21 Oct 2026
1 critical vulnerability
🔴 CVE-2026-71195 · CVSS 9.9
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-71195 · CVSS 9.9
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-71195 - OpenStack Manila Improper Authorization Vulnerability
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re…
📰 BleepingComputer
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
#CyberNews #Infosec
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
#CyberNews #Infosec
BleepingComputer
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024.
📰 BleepingComputer
Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. [...]
#CyberNews #Infosec
Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. [...]
#CyberNews #Infosec
BleepingComputer
Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates.
🔴 CVE Digest — 21 Oct 2026
1 critical vulnerability
🔴 CVE-2026-87095 · CVSS 9.1
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-87095 · CVSS 9.1
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-87095 - Acronis Cyber Infrastructure Improper Authorization Vulnerability
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber…
📰 BleepingComputer
Microsoft PowerToys adds CursorHide, Button Lock mouse tools
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. [...]
#CyberNews #Infosec
Microsoft PowerToys adds CursorHide, Button Lock mouse tools
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. [...]
#CyberNews #Infosec
BleepingComputer
Microsoft PowerToys adds CursorHide, Button Lock mouse tools
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements.