Sunday, October 4, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Legion of the Bouncy Castle Inc. 9
- OpenIdentityPlatform 9
- WordPress 1 critical 8
- laradashboard 5
- Omega Solution 4
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at a
Also in The Hacker News Infosecurity Magazine The Record +3
-
Citrix NetScaler Keeps Rebooting Following the 0-Day Patch
Citrix NetScaler customers are reporting repeated appliance reboots after installing build 14.1-73.37, the emergency update released for two zero-day flaws under active attack. The failures appear linked to crafted SAML authentication traffic that crashes the nsaaad service. Citrix says its engineering and support teams are tracking a newly seen SAML issue and plan to release a fresh security bulletin and fixed build. The key point is that the reboot reports do not yet prove attackers have bypassed the September patch. Build 14.1-73.37 remains Citrix’s fixed 14.1 release for CVE-2026-88771…
Also in CCCS Alerts & Advisories Dark Reading
-
Critical GitLab AI Gateway Vulnerability Enables Remote Code Execution Attacks
GitLab has released urgent security updates for a critical AI Gateway vulnerability that could allow authenticated attackers to execute commands remotely. Tracked as CVE-2026-90970, the flaw carries a CVSS score of 9.9 and affects self-hosted deployments used to support GitLab Duo AI features. The company released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to address the issue. GitLab strongly recommends that customers running affected self-hosted gateways upgrade immediately. It also contacted self-hosted AI Gateway customers before publishing its security advisory to provide early…
Also in CCCS Alerts & Advisories The Hacker News Bleeping Computer
-
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and
Also in Cyber Security News
-
Google Gemini could soon get full access to your Mac’s files, apps and the web
Google's Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time.
Also in CCCS Alerts & Advisories
-
Debian has Patched 1,313 Flaws in Massive Update Leading to DoS and Privilege Escalation Attacks
Debian has released a major Linux kernel security update covering 1,313 CVE entries, addressing flaws that could allow privilege escalation, denial of service, and information leaks. The fixes are available for Debian’s stable release, Trixie, in Linux source package version 6.12.111-1. Security team member Salvatore Bonaccorso published advisory DSA-6528-1 on September 29, 2026. Debian recommends upgrading the affected linux packages. Importantly, the update prevents potential attacks; the advisory does not say that installing it causes security problems or that attackers have exploited…
Also in Dark Reading Rapid7 Blog
-
Critical Dell Container Storage Flaws Let Unauthenticated Attackers Gain Full Administrative Control
Dell has released security update DSA-2026-448 to address multiple critical vulnerabilities in its Container Storage Modules, including flaws that could allow unauthenticated remote attackers to take full administrative control of affected storage environments. Organizations using vulnerable Dell CSM deployments should upgrade immediately, as Dell stated that no workarounds or mitigations are available. The advisory affects Dell Container Storage Modules versions before 1.17.0, with fixes available in 1.18.0 and later, covering CSM Authorization, CSM Operator, CSI components, and third-party…
Also in The Hacker News Bleeping Computer
-
Microsoft Pushes New Exchange V2 Update After Discovering New Security Flaw
Microsoft has released September 2026 V2 security updates to fix an Exchange Server flaw that lets authenticated attackers access other users’ mailboxes within the same organization. Tracked as CVE-2026 – 96940 , the vulnerability could expose email messages and attachments, making it a serious concern for businesses running Exchange on-premises. The flaw involves weak authorization, allowing an attacker with authenticated access to gain privileges over a network. Public vulnerability records list a CVSS score of 8.8. Unlike attacks that require someone to open a malicious file, exploitation…
Also in Microsoft Security
-
Fortinet sounds the alarm over actively exploited FortiMail zero-day
Fortinet is warning customers to lock down FortiMail after attackers started exploiting a critical bug that lets them write files to vulnerable systems without logging in. The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform. Fortinet describes the vulnerability as a combination of path traversal and improper handling of null characters in FortiMail's web interface. An unauthenticated attacker can exploit it using specially crafted HTTP or HTTPS requests to write arbitrary files to the underlying system. Writing…
Also in SecurityWeek Bleeping Computer
-
Apple changes full-disk access permissions to curb abuse from AI agents
Apple says it is changing its macOS privacy settings to stop third-party app developers from misusing them to access message histories. Friday's announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to…
Also in SecurityWeek
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-105134 | AhsayCBSAhsay | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os… Attack
Exploitation
|
|||||||||
| CVE-2026-105135 | MindSearchInternLM | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code inj… Attack
Exploitation
|
|||||||||
| CVE-2026-105105 | AIT-CoreNASA-AMMOS | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isCWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message … Attack
Exploitation
|
|||||||||
| CVE-2026-92084 | Beaver Builder Page Builder – Drag and Drop Website BuilderWordPress | Critical | 9.1 | 0.5% | — | None linked | — | EPSS 0.5%CVSS 9.1No fix linked | |
What it isThe The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an… Attack
Exploitation
|
|||||||||
| CVE-2026-96451 | Ultimate MemberUltimate Member | High | 8.8 | — | — | None linked | — | CVSS 8.8No fix linked | |
What it isAuthorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1. Attack
Exploitation
|
|||||||||
| CVE-2026-105123 | wcmsvincent-peugnet | High | 8.8 | — | — | None linked | — | CVSS 8.8No fix linked | |
What it isW (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .p… Attack
Exploitation
|
|||||||||
| CVE-2026-105115 | OpenAMOpenIdentityPlatform | High | 8.6 | — | — | None linked | — | CVSS 8.6No fix linked | |
What it isOpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxr… Attack
Exploitation
|
|||||||||
| CVE-2026-103065 | KirkiThemeum | High | 8.2 | — | — | None linked | — | CVSS 8.2No fix linked | |
What it isImproper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1. Attack
Exploitation
|
|||||||||
| CVE-2026-105133 | AhsayCBSAhsay | High | 7.3 | — | — | None linked | — | CVSS 7.3No fix linked | |
What it isA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in imprope… Attack
Exploitation
|
|||||||||
| CVE-2026-105126 | laradashboardlaradashboard | High | 7.2 | — | — | None linked | — | CVSS 7.2No fix linked | |
What it isLaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.