Tuesday, October 13, 2026 · generated · about 4 min read
Morning Brief
Patch today Patch Tuesday vendors with the most new CVEs today
- frappe 84
- IBM 6 critical 61
- Progress 5 critical 34
- Microsoft 1 critical 30
- ImageMagick 25
- GitLab 1 critical 24
- SAP 4 critical 20
- FreeRDP 16
- open-webui 15
- Unknown 14
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Rapid7 Blog CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229 , an integer overflow or wraparound ( CWE-190 ) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the vulnerability a CVSSv3.1 score of 10.0 . Under certain conditions, a remote attacker can execute arbitrary code on an affected GitLab server through a specially crafted regular expression stored in a malicious CI/CD configuration. While the vendor supplied CVSS score indicates that exploitation is fully unauthenticated, in…
Also in The Hacker News Bleeping Computer
-
Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock
A public exploit package now lets owners of Amazon’s third-generation Fire TV Cube gain persistent root access and unlock the bootloader on firmware PS7717 or older. Released by XDA developer Pro-me3us, the project targets devices known as “gazelle”. It combines temporary root access with a separate bootloader flaw to enable deeper system changes. According to the XDA development thread , the unlock installs Magisk and TWRP recovery, opens restricted boot options, and supports alternative operating systems. However, the developer warns that the process can permanently damage the device. It…
Also in The Hacker News Malwarebytes Labs
-
Retail giant Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it had to take some systems offline in response to a "cybersecurity incident" affecting its network.
Also in SecurityWeek
-
IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion
IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business. Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can communicate across a network, independent of the underlying network technology. The California-based company reports more than 100 global deployments and says revenue and customer counts have doubled year over year, with no…
Also in SecurityWeek
-
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The
Also in SecurityWeek
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-108892 | E1700Linksys | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack… Attack
Exploitation
|
|||||||||
| CVE-2026-108907 | NR268Netcore | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been public… Attack
Exploitation
|
|||||||||
| CVE-2026-108917 | BR-6208ACEdimax | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be per… Attack
Exploitation
|
|||||||||
| CVE-2026-108918 | BR-6208ACEdimax | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. Th… Attack
Exploitation
|
|||||||||
| CVE-2026-89111 | SAP CloudSAP | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isThe SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing… Attack
Exploitation
|
|||||||||
| CVE-2026-97229 | GitLabGitLab | Critical | 10.0 | — | — | None linked | story 1, 3 sources | CVSS 10.0No fix linkedin the news | |
What it isGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code o… Attack
Exploitation
|
|||||||||
| CVE-2026-109109 | WL-WN530BE1-AWavlink | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COO… Attack
Exploitation
|
|||||||||
| CVE-2026-108893 | E1700Linksys | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launc… Attack
Exploitation
|
|||||||||
| CVE-2026-108894 | E1700Linksys | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_set… Attack
Exploitation
|
|||||||||
| CVE-2026-108895 | E1700Linksys | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be execu… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.