Monday, October 12, 2026 · generated · about 4 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Samsung Mobile 24
- jeecgboot 23
- zephyrproject 11
- erzhongxmu 9
- OTRS GmbH (former OTRS AG) 2 critical 9
- zhayujie 5
- ZKTeco 5
- Apple 4
- Microsoft 4
- UnicomAI 4
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year
-
Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident
Ahold Delhaize has taken some systems offline after identifying a security issue within its network, the food retail group said on October 12, 2026. The company, based in Zaandam, the Netherlands, said its teams were assessing the issue and taking steps to limit its impact. Physical stores remain open and continue serving customers. In its official statement , Ahold Delhaize described the shutdowns as protective measures. “Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority,” the company said, apologizing for inconvenience caused to…
Also in Bleeping Computer
-
Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions
A critical vulnerability in Google’s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger remote code execution across several Google-owned developer websites, according to researcher Simon Koeck. The issue affected the OAuth flow used by Google developer documentation sites, including developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com. Google reportedly fixed the flaw on October 7, 2026, after receiving the report in August and awarding the researcher $90,000 through…
Also in Cyber Security News Bleeping Computer
-
Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers
GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers without logging in. Tracked as CVE-2026-97229, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company released patches on October 12, 2026. The vulnerability involves an integer overflow in GitLab’s CI/CD regular expression compiler. GitLab says insufficient regular expression validation could allow an unauthenticated attacker to trigger code execution through a specially…
Also in Bleeping Computer
-
WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows
A malicious WhatsApp attachment is being used to deploy a Windows remote access trojan that can reach SYSTEM-level access, giving its operators deep control over infected machines. The campaign begins with a ZIP archive carrying a financial-document lure and an executable named Statement.exe . Once the recipient opens the file, the malware starts a long, hidden chain that moves from a user-level process into a Windows service running with LocalSystem rights. The final payload, named VulcanRAT207.A, gives remote operators the ability to collect system data, run commands, manage files, capture…
Also in Bleeping Computer
-
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The
Also in SecurityWeek
-
Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners
Hackers are exploiting two flaws in AhsayCBS backup servers to run commands, plant webshells, and install XMRig cryptocurrency miners disguised as Microsoft Edge. Huntress first observed exploitation on October 7, 2026, at 23:20:15 UTC. By October 8, its researchers had seen five organizations targeted, with attackers checking systems and setting up tools to maintain access. The campaign targets Ahsay Cloud Backup Server, a management platform used by managed service providers and system integrators. Administrators use it to manage backup users, policies, and operations. According to…
Also in Bleeping Computer
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-108576 | X300TOZED | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be … Attack
Exploitation
|
|||||||||
| CVE-2026-108804 | TEW-751DRTRENDnet | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service result… Attack
Exploitation
|
|||||||||
| CVE-2026-66086 | ModemUnisoc (Shanghai) Technologies Co., Ltd. | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isIn the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privil… Attack
Exploitation
|
|||||||||
| CVE-2026-108753 | agnaiagnaistic | Critical | 9.4 | — | — | None linked | — | CVSS 9.4No fix linked | |
What it isAgnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT wi… Attack
Exploitation
|
|||||||||
| CVE-2026-93582 | OTRSOTRS GmbH (former OTRS AG) | Critical | 9.4 | — | — | None linked | — | CVSS 9.4No fix linked | |
What it isThe HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request head… Attack
Exploitation
|
|||||||||
| CVE-2026-108860 | BotSharpSciSharp | Critical | 9.1 | — | — | None linked | — | CVSS 9.1No fix linked | |
What it isBotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the commi… Attack
Exploitation
|
|||||||||
| CVE-2026-78357 | OTRSOTRS GmbH (former OTRS AG) | Critical | 9.1 | — | — | None linked | — | CVSS 9.1No fix linked | |
What it isPreviously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, … Attack
Exploitation
|
|||||||||
| CVE-2026-108746 | vearchVearch | High | 8.8 | — | — | None linked | — | CVSS 8.8No fix linked | |
What it isVearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and… Attack
Exploitation
|
|||||||||
| CVE-2026-108963 | databasementDavid-Crty | High | 8.8 | — | — | None linked | — | CVSS 8.8No fix linked | |
What it isdatabasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to… Attack
Exploitation
|
|||||||||
| CVE-2026-108980 | BlinkoBlinko | High | 8.8 | — | — | None linked | — | CVSS 8.8No fix linked | |
What it isBlinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.