Thursday, October 15, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Juniper 15 critical 153
- WordPress 3 critical 78
- Linux 42
- Red Hat 30
- Gitea 1 critical 29
- Microsoft 2 critical 21
- HP 21
- error311 20
- HashiCorp 13
- Progress 12
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely
Microsoft has disclosed three Active Directory vulnerabilities that could let a remote attacker bypass a key security feature in Windows domain environments. The issues are tracked as CVE-2026-69982, CVE-2026-96252, and CVE-2026-108131, and administrators should review Microsoft’s Security Update Guide entries and deploy the available fixes as soon as possible. Active Directory is the central identity service many organizations use to manage users, computers, permissions, and access to business systems. A weakness that bypasses a security control in this environment can be serious because…
Also in Infosecurity Magazine Bleeping Computer CyberScoop +3
CVE-2026-69982 ↗CVE-2026-96252 ↗CVE-2026-96951 ↗View on Security Feed
-
Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco has warned that attackers are actively exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway that can give them root access to affected appliances. Tracked as CVE-2026-76519, the flaw carries a CVSS score of 9.8 and allows attacks through specially crafted email attachments without requiring a login. Cisco published its advisory on October 14, 2026. The company said its security response team became aware of active exploitation in October. Public reporting has not identified the attackers or established how many devices have been compromised, leaving the scale of…
Also in SecurityWeek The Register Security CCCS Alerts & Advisories +3
-
Top 10 Best DevSecOps Platforms in 2026 [Ranked & Scored]
DevSecOps succeeds when security rides the pipeline instead of blocking it and fails when ten scanners produce ten backlogs nobody owns. Modern engineering teams aligning with enterprise DevSecOps playbooks recognize that vulnerability volume is a vanity metric; the true measure of a program is whether developers actually remediate what their tooling flags. We scored ten platforms on the metric that matters: whether developers actually fix what the tools find. GitLab takes 1 for making the whole discipline one product decision; GitHub Advanced Security and Snyk complete the podium. Key…
Also in Huntress SecurityWeek The Hacker News +2
-
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands. "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," the vendor said in its advisory. There are limited indicators of compromise available at…
Also in Bleeping Computer The Hacker News CyberScoop +3
-
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
Also in Cyber Security News Bleeping Computer CISA Alerts & Advisories
-
UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
UAT-6275 hackers have used a known WinRAR flaw to plant malware on Windows systems while targeting government organizations across the Commonwealth of Independent States (CIS). The activity shows how an unpatched archive tool can turn a routine attachment into lasting remote access, with the malicious program starting when the victim next signs in. The campaign involves CVE-2025-8088, a path traversal flaw that lets crafted archives write files outside the folder chosen for extraction. Researchers observed the group adding this method in April 2026, alongside older attacks using Word macros…
Also in Microsoft Security Microsoft Security Microsoft Security +1
CVE-2026-69366 ↗CVE-2026-69676 ↗CVE-2026-70584 ↗View on Security Feed
-
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
Also in SecurityWeek Bleeping Computer The Hacker News +1
-
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
Also in Rapid7 Blog CISA Alerts & Advisories CISA Alerts & Advisories
-
Fake Chrome App on Google Play Evades Detection and Reaches 100,000+ Downloads
A fake Google Chrome app appeared on Google Play with a screenshot showing more than 100,000 downloads, raising fresh concerns about app checks and paid search results. The listing copied Chrome’s name, icon, and description, but its developer was Hizbartech rather than Google LLC. The app reportedly appeared above the real browser as a sponsored result. However, the download badge does not prove that 100,000 people installed it while it carried Chrome’s branding. Available reports also do not establish password theft, a banking Trojan, or a confirmed malware payload. Researchers at…
Also in The Register Security The Hacker News
-
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
CVE-2026-35029 and CVE-2026-59823 affect LiteLLM, which is commonly used by enterprises to connect their AI applications to providers like OpenAI and Anthropic
Also in Check Point Research
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-107594 | File Upload to OrderWordPress | Critical | 10.0 | 0.2% | — | None linked | — | EPSS 0.2%CVSS 10.0No fix linked | |
What it isThe File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated … Attack
Exploitation
|
|||||||||
| CVE-2026-55572 | e107e107inc | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it ise107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e10… Attack
Exploitation
|
|||||||||
| CVE-2026-110536 | DIR-868LD-Link | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. … Attack
Exploitation
|
|||||||||
| CVE-2026-89310 | JTL-WMSJTL SW GmbH | Critical | 9.9 | 0.5% | — | None linked | — | EPSS 0.5%CVSS 9.9No fix linked | |
What it isA parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account. Attack
Exploitation
|
|||||||||
| CVE-2026-77524 | kedaKubernetes | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isKEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled en… Attack
Exploitation
|
|||||||||
| CVE-2026-108390 | hestiacphestiacp | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isHestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user'… Attack
Exploitation
|
|||||||||
| CVE-2026-104748 | SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead NotificationsWordPress | Critical | 9.8 | 0.7% | — | None linked | — | EPSS 0.7%CVSS 9.8No fix linked | |
What it isThe SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_r… Attack
Exploitation
|
|||||||||
| CVE-2026-107424 | Frontend DashboardM A Vinoth Kumar | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isIncorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Privilege Escalation.This issue affects Frontend Dashboard: from n/a through 3.0.7. Attack
Exploitation
|
|||||||||
| CVE-2026-108291 | Affiliatesitthinx | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isDeserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1. Attack
Exploitation
|
|||||||||
| CVE-2026-16740 | TR7 ASPTR7 Cyber Defense Inc. | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isMissing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229 , an integer overflow or wraparound ( CWE-190 ) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the vulnerability a CVSSv3.1 score of 10.0 . Under certain conditions, a remote attacker can execute arbitrary code on an affected GitLab server through a specially crafted regular expression stored in a malicious CI/CD configuration. While the vendor supplied CVSS score indicates that exploitation is fully unauthenticated, in…
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.