Saturday, October 3, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 2 critical 80
- Apache 1 critical 69
- YesWiki 35
- Legion of the Bouncy Castle Inc. 16
- Repasat 16
- ZcashFoundation 15
- Unknown 14
- Google 1 critical 11
- Microsoft 9
- HashiCorp 7
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel
Hackers turned a Microsoft SQL Server into a channel for running commands and moving collected files in an intrusion linked to a Viva Aerobus environment. Their own publicly accessible server then exposed attack tools and stolen material to unrelated internet users. The activity, observed between September 25 and 29, 2026, involved credential harvesting, source code collection, and preparation to access additional systems. The investigation did not establish how the attackers first entered the environment or identify a named malware family. The available records describe a toolkit rather than…
Also in Infosecurity Magazine The Record SecurityWeek +3
-
Critical GitLab AI Gateway Vulnerability Enables Remote Code Execution Attacks
GitLab has released urgent security updates for a critical AI Gateway vulnerability that could allow authenticated attackers to execute commands remotely. Tracked as CVE-2026-90970, the flaw carries a CVSS score of 9.9 and affects self-hosted deployments used to support GitLab Duo AI features. The company released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to address the issue. GitLab strongly recommends that customers running affected self-hosted gateways upgrade immediately. It also contacted self-hosted AI Gateway customers before publishing its security advisory to provide early…
Also in CCCS Alerts & Advisories The Hacker News Bleeping Computer
-
Citrix NetScaler Keeps Rebooting Following the 0-Day Patch
Citrix NetScaler customers are reporting repeated appliance reboots after installing build 14.1-73.37, the emergency update released for two zero-day flaws under active attack. The failures appear linked to crafted SAML authentication traffic that crashes the nsaaad service. Citrix says its engineering and support teams are tracking a newly seen SAML issue and plan to release a fresh security bulletin and fixed build. The key point is that the reboot reports do not yet prove attackers have bypassed the September patch. Build 14.1-73.37 remains Citrix’s fixed 14.1 release for CVE-2026-88771…
-
Debian has Patched 1,313 Flaws in Massive Update Leading to DoS and Privilege Escalation Attacks
Debian has released a major Linux kernel security update covering 1,313 CVE entries, addressing flaws that could allow privilege escalation, denial of service, and information leaks. The fixes are available for Debian’s stable release, Trixie, in Linux source package version 6.12.111-1. Security team member Salvatore Bonaccorso published advisory DSA-6528-1 on September 29, 2026. Debian recommends upgrading the affected linux packages. Importantly, the update prevents potential attacks; the advisory does not say that installing it causes security problems or that attackers have exploited…
Also in Dark Reading Rapid7 Blog
-
Fortinet sounds the alarm over actively exploited FortiMail zero-day
Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform. Fortinet describes the vulnerability as a combination of path traversal and improper handling of null characters in FortiMail's web interface. An unauthenticated attacker can exploit it using specially crafted HTTP or HTTPS requests to write arbitrary files to the underlying system. Writing…
Also in SecurityWeek Bleeping Computer CISA Alerts & Advisories
-
Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control
Dell has released security update DSA-2026-448 to address multiple critical vulnerabilities in its Container Storage Modules, including flaws that could allow unauthenticated remote attackers to take full administrative control of affected storage environments. Organizations using vulnerable Dell CSM deployments should upgrade immediately, as Dell stated that no workarounds or mitigations are available. The advisory affects Dell Container Storage Modules versions before 1.17.0, with fixes available in 1.18.0 and later, covering CSM Authorization, CSM Operator, CSI components, and third-party…
Also in The Hacker News Bleeping Computer
-
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with
Also in Infosecurity Magazine CCCS Alerts & Advisories The Hacker News +1
-
Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version
Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon, that it said is being rolled out to a set of trusted cyber defenders through its Fairwind Program. "It delivers frontier performance in complex workflows across real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense," Koray Kavukcuoglu,
Also in CCCS Alerts & Advisories Dark Reading Infosecurity Magazine
-
Apple changes full-disk access permissions to curb abuse from AI agents
Apple says it is changing its macOS privacy settings to stop third-party app developers from misusing them to access message histories. Friday's announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to…
Also in The Hacker News
-
RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail
The offensive cyber operations startup looks to evolve red teaming beyond traditional methods to simulate attackers' increasingly advanced capabilities.
Also in Microsoft Security Blog
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-104610 | HG7Tenda | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads … Attack
Exploitation
|
|||||||||
| CVE-2026-103956 | loomAWS | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isMissing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading store… Attack
Exploitation
|
|||||||||
| CVE-2026-90970 | GitLab AI GatewayGitLab | Critical | 9.9 | — | — | None linked | story 2, 4 sources | CVSS 9.9No fix linkedin the news | |
What it isGitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an au… Attack
Exploitation
|
|||||||||
| CVE-2026-82041 | UTMStackUTMStack | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isUTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied bef… Attack
Exploitation
|
|||||||||
| CVE-2026-105080 | ConvertXC4illin | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isIn ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file. Attack
Exploitation
|
|||||||||
| CVE-2026-97637 | JSON API AuthWordPress | Critical | 9.8 | 0.6% | — | None linked | — | EPSS 0.6%CVSS 9.8No fix linked | |
What it isThe JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin ca… Attack
Exploitation
|
|||||||||
| CVE-2026-94541 | WPMobile.App – Android and iOS App BuilderApple | Critical | 9.8 | 0.5% | — | None linked | — | EPSS 0.5%CVSS 9.8No fix linked | |
What it isThe WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an a… Attack
Exploitation
|
|||||||||
| CVE-2026-19652 | Divi MembershipWordPress | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress role… Attack
Exploitation
|
|||||||||
| CVE-2026-104846 | serovallxsmnsyc | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isSeroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing… Attack
Exploitation
|
|||||||||
| CVE-2023-54405 | CVMH3C | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isH3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary fil… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.