{"date_iso":"2026-10-16","date_human":"Friday, October 16, 2026","generated_utc":"2026-10-16 12:56 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages","link":"https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html","reason":"Microsoft","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Cisco Talos","CyberScoop","Dark Reading","Huntress","Infosecurity Magazine","Krebs On Security","Malwarebytes Labs","Rapid7 Blog","SANS Internet Storm Center","SecurityWeek","Tenable Blog","The Hacker News"],"coverage":14,"cve_ids":["CVE-2026-96951"],"summary":"Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of\u2026","source":"The Hacker News","date_rel":"14 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtmZA0sGFnGRVBoPOHXGNOr-Q1MpdbCUNVrfxBTV6z_URgCka1DOH4xcc_WuismhU3W1BEiostTKZetIhtrFyXrInKdz_jqK6Dtia5TDOqRiu4rkktKmF2Iz1br28coCyU3c5td-yrINUgjYIdwG-7q_n1fEZT_mumUoVBp2HfNPKHnqC3jTryRDL7hxAL/s1600/phish-shop.jpg","description":"Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. \"Since January 2026, the threat actors behind these kits have been responsible for","related":[{"title":"Microsoft: October Windows update may break Smart App Control","link":"https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/","source":"Bleeping Computer","date_rel":"4h ago"},{"title":"Microsoft Patches Two Dozen RCE Flaws in Office","link":"https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/","source":"SecurityWeek","date_rel":"5h ago"},{"title":"Microsoft: Windows Server 2022 reached end of mainstream support","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/","source":"Bleeping Computer","date_rel":"23h ago"},{"title":"Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages","link":"https://www.infosecurity-magazine.com/news/microsoft-yam-store-one-billion/","source":"Infosecurity Magazine","date_rel":"15 Oct"},{"title":"Microsoft fixes bug causing Windows black screens, Explorer crashes","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-bug-causing-windows-black-screens-explorer-crashes/","source":"Bleeping Computer","date_rel":"15 Oct"},{"title":"Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities","link":"https://cyberscoop.com/microsoft-patch-tuesday-october-2026/","source":"CyberScoop","date_rel":"14 Oct"}]},{"title":"How Multi-Campus Universities can Build a more Connected Security Program","link":"https://www.rapid7.com/blog/post/it-multi-campus-universities-building-more-connected-security-programs","reason":"Teams","category":"Research","sources":["Cisco Security Advisories","Huntress","Infosecurity Magazine","Rapid7 Blog","SecurityWeek","The Hacker News","Wiz Research"],"coverage":7,"cve_ids":[],"summary":"Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments\u2026","source":"Rapid7 Blog","date_rel":"17h ago","thumbnail":"https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt30cad4cead79d2d3/6846a7113860835cfa35e65d/surface-command.jpg","description":"Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act. This final part is about what changes when a university\u2026","related":[{"title":"Cisco Meraki Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"17h ago"},{"title":"Context Is King in the Fight Against Modern Cyberattacks","link":"https://www.securityweek.com/context-is-king-in-the-fight-against-modern-cyberattacks/","source":"SecurityWeek","date_rel":"19h ago"},{"title":"10 Endpoint Security Trends and Tips for 2027 | Huntress","link":"https://www.huntress.com/blog/endpoint-security-trends","source":"Huntress","date_rel":"14 Oct"},{"title":"How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team","link":"https://thehackernews.com/2026/10/how-to-run-deepfake-readiness-drill.html","source":"The Hacker News","date_rel":"14 Oct"},{"title":"Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov","link":"https://www.wiz.io/blog/wiz-for-gov-agents-fedramp","source":"Wiz Research","date_rel":"14 Oct"},{"title":"Defenders Reluctant to Deploy Agentic AI as a Cybersecurity Tool","link":"https://www.infosecurity-magazine.com/news/defenders-skeptical-agentic-ai/","source":"Infosecurity Magazine","date_rel":"13 Oct"}]},{"title":"AI-Powered Espionage Campaign Targets Government Linux Infrastructure","link":"https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/","reason":"Linux","category":"Threat Intel","sources":["Bleeping Computer","CCCS Alerts & Advisories","Palo Alto Unit 42","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.","source":"Palo Alto Unit 42","date_rel":"14h ago","thumbnail":"https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/AdobeStock_637057734.jpg","description":"","related":[{"title":"Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory","link":"https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html","source":"The Hacker News","date_rel":"16h ago"},{"title":"SUSE Linux security advisory (AV26-1053)","link":"https://cyber.gc.ca/en/alerts-advisories/suse-linux-security-advisory-av26-1053","source":"CCCS Alerts & Advisories","date_rel":"17h ago"},{"title":"Fake Arch Linux packages push malware with root privileges","link":"https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/","source":"Bleeping Computer","date_rel":"19h ago"},{"title":"AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host","link":"https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html","source":"The Hacker News","date_rel":"14 Oct"}]},{"title":"AI worms could spread across your smart devices, Anthropic warns","link":"https://www.malwarebytes.com/blog/ai/2026/10/ai-worms-could-spread-across-your-smart-devices-anthropic-warns","reason":"Google","category":"Threat Intel","sources":["CCCS Alerts & Advisories","Infosecurity Magazine","Malwarebytes Labs"],"coverage":3,"cve_ids":[],"summary":"Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model. Researchers at Anthropic demonstrated this by running a Google Gemma model across\u2026","source":"Malwarebytes Labs","date_rel":"14 Oct","thumbnail":"","description":"Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model. Researchers at Anthropic demonstrated this by running a Google Gemma model across 15 off-brand Android TV boxes. They warn that small models could soon spread across vulnerable internet-of-things (IoT) devices, including smart ovens and TV boxes, stating: \u201cOur experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV\u2026","related":[{"title":"China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns","link":"https://www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/","source":"Infosecurity Magazine","date_rel":"2h ago"},{"title":"Google security advisory (AV26-1045)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1045","source":"CCCS Alerts & Advisories","date_rel":"22h ago"},{"title":"Fake Calendly \u201cMeta Careers\u201d pages steal Facebook and Google logins","link":"https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-calendly-meta-careers-pages-steal-facebook-and-google-logins","source":"Malwarebytes Labs","date_rel":"14 Oct"}]},{"title":"PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions","link":"https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html","reason":"Fortinet","category":"News","sources":["CCCS Alerts & Advisories","The Hacker News","Zero Day Initiative"],"coverage":3,"cve_ids":[],"summary":"A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the\u2026","source":"The Hacker News","date_rel":"7h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMvdc6m999SfUEEWC89wHnBiUX9WAMCSdWtbFP_lrH4DuREHfOJL7G29LkM4uAvittg3XsHxnq6dq_VEX1zB_jCGi5RJDbQZlrq37gHSCXpRrn11FEN-hezQn0Dt4Xcw4DcanklKW_8iLEnQN6JpzkQ7JHBOS1_dMzDAs2h_jJcWDqOGjbkMoeabOCkSFK/s1600/f.jpg","description":"A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a","related":[{"title":"ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-772/","source":"Zero Day Initiative","date_rel":"15 Oct"},{"title":"ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-771/","source":"Zero Day Initiative","date_rel":"15 Oct"},{"title":"Fortinet security advisory (AV26-1037)","link":"https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","source":"CCCS Alerts & Advisories","date_rel":"13 Oct"}]},{"title":"NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks","link":"https://thehackernews.com/2026/10/nginx-fixes-5-flaws-including-possible.html","reason":"F5","category":"News","sources":["CCCS Alerts & Advisories","SecurityWeek","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a\u2026","source":"The Hacker News","date_rel":"23h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEionuV8CAd7SP0bgEbHyb-0hp7JWNkWpPjYtkNH9p86nRQrxDN1T97D1cragnVVzAwCEFCuqrwuysgwzxJLfvTXrYhMSGj5rbBzrpjW-VPvAmrc2-9EAR_hBmPigJUOjynvkm0ArpyasyzCOAWUWFYdCqzsbCJVOsxC09LnYwH2dcV4j4Vm9S9VDelXUlc/s1600/tls.jpg","description":"NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could","related":[{"title":"F5, Juniper Networks Patch Critical Vulnerabilities","link":"https://www.securityweek.com/f5-juniper-networks-patch-critical-vulnerabilities/","source":"SecurityWeek","date_rel":"3h ago"},{"title":"F5 security advisory (AV26-1049)","link":"https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-1049","source":"CCCS Alerts & Advisories","date_rel":"18h ago"}]},{"title":"Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks","link":"https://cybersecuritynews.com/hackers-exploit-d-link/","reason":"Sap","category":"News","sources":["CCCS Alerts & Advisories","Cyber Security News","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"A cybercrime campaign has compromised at least 143 devices in 34 countries by exploiting flaws in D-Link, Ubiquiti and SAP products. The attackers installed Pawns.app proxy software on victim devices, turning their\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Hackers-Exploit-D-Link-Ubiquiti-and-SAP-Flaws-to-Hijack-Devices-for-Proxy-Networks.webp","description":"A cybercrime campaign has compromised at least 143 devices in 34 countries by exploiting flaws in D-Link, Ubiquiti and SAP products. The attackers installed Pawns.app proxy software on victim devices, turning their internet connections into residential proxy nodes. That lets the operator route internet traffic through the victims\u2019 real IP addresses, which can make the activity harder to trace and may help it blend in with ordinary user traffic. GreyNoise researchers identified the campaign and linked it to an actor tracked as \u201cskynox7.\u201d The group used known vulnerabilities in network storage\u2026","related":[{"title":"SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft","link":"https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html","source":"The Hacker News","date_rel":"13 Oct"},{"title":"SAP security advisory \u2013 October 2026 monthly rollup (AV26-1030)","link":"https://cyber.gc.ca/en/alerts-advisories/sap-security-advisory-october-2026-monthly-rollup-av26-1030","source":"CCCS Alerts & Advisories","date_rel":"13 Oct"}]},{"title":"Google Automatically Adds Your Phone Number to Every Google Account on Your Android Phone","link":"https://cybersecuritynews.com/google-automatically-adds-your-phone-number/","reason":"Android","category":"News","sources":["Bleeping Computer","Cyber Security News","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"Google automatically verifies phone numbers on Android devices and adds them to every Google account signed in on the Phone. The setting is enabled by default, raising privacy concerns for users who keep personal, work\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Google-Automatically-Adds-Your-Phone-Number-to-Every-Google-Account-on-Your-Android-Phone.webp","description":"Google automatically verifies phone numbers on Android devices and adds them to every Google account signed in on the Phone. The setting is enabled by default, raising privacy concerns for users who keep personal, work, and secondary accounts separate. Google\u2019s documentation confirms that the behavior covers both existing accounts and accounts added later. The feature, called Phone number verification, also covers new phone numbers added to a device. Adding another Google account can link it to numbers already on the Phone, while adding a new number can attach it to accounts already signed\u2026","related":[{"title":"Android gets AI defenses against messaging scams, fake calls","link":"https://www.bleepingcomputer.com/news/security/android-gets-ai-defenses-against-messaging-scams-fake-calls/","source":"Bleeping Computer","date_rel":"17h ago"},{"title":"Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks","link":"https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html","source":"The Hacker News","date_rel":"14 Oct"},{"title":"Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets","link":"https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html","source":"The Hacker News","date_rel":"13 Oct"}]},{"title":"ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More","link":"https://thehackernews.com/2026/10/threatsday-adobe-rce-dns-wallet-theft.html","reason":"Adobe","category":"News","sources":["CCCS Alerts & Advisories","The Hacker News","Zero Day Initiative"],"coverage":3,"cve_ids":[],"summary":"Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that\u2019s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different\u2026","source":"The Hacker News","date_rel":"18h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8jHVMYXIjddaTrqHbBuPm3mQ6G_g8qlALwitmiIRM9OplZpPxLPDFet7ySOV0OVxPj6cW1oz0K6rydDvGYQGalR1jSt10bz8kti4dWnM0d3NnUBjuymD77_cReujy6AXmFgJgQQvl2qeICur3VHf5vYyOrxz8OFM-bEunzmK9PGDzCzzTVFVEdQyswYho/s1600/threatsday-oct.jpg","description":"Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that\u2019s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and","related":[{"title":"ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-778/","source":"Zero Day Initiative","date_rel":"15 Oct"},{"title":"ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-777/","source":"Zero Day Initiative","date_rel":"15 Oct"},{"title":"Adobe security advisory (AV26-1039)","link":"https://cyber.gc.ca/en/alerts-advisories/adobe-security-advisory-av26-1039","source":"CCCS Alerts & Advisories","date_rel":"14 Oct"}]},{"title":"Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks","link":"https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095","reason":"Ivanti","category":"News","sources":["CCCS Alerts & Advisories","CyberScoop","The Hacker News","The Register Security","Volexity"],"coverage":5,"cve_ids":[],"summary":"Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix\u2026","source":"The Register Security","date_rel":"14 Oct","thumbnail":"https://image.theregister.com/?imageId=232983&width=800","description":"Ivanti customers are being urged to update Connect Secure and check for compromise after attackers exploited a newly disclosed zero-day vulnerability. On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity. Rated 8.6 on the CVSS scale, it allows remote, unauthenticated attackers to execute arbitrary commands. \"We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure,\" the vendor said in its advisory. There are limited indicators of compromise available at\u2026","related":[{"title":"CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts","link":"https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html","source":"The Hacker News","date_rel":"14 Oct"},{"title":"Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day","link":"https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/","source":"CyberScoop","date_rel":"13 Oct"},{"title":"Ivanti security advisory (AV26-1035)","link":"https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035","source":"CCCS Alerts & Advisories","date_rel":"13 Oct"},{"title":"Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far","link":"https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html","source":"The Hacker News","date_rel":"13 Oct"},{"title":"A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days","link":"https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/","source":"Volexity","date_rel":"13 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-110957","vendor":"Wavlink","product":"WL-WN530BE2-A","severity":"CRITICAL","score":10.0,"description":"A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os com\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin","https://github.com/F-yyjy/cve/blob/main/WN530BE2-A_api-cgi.md","https://vuldb.com/cve/CVE-2026-110957"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110957"},{"id":"CVE-2026-110958","vendor":"Wavlink","product":"WN530HG4B","severity":"CRITICAL","score":10.0,"description":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The explo\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin","https://drive.google.com/file/d/12OOh8g9YDCbD-Q4cc52J6TH9KuOoD44A/view?usp=drive_link","https://vuldb.com/cve/CVE-2026-110958"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110958"},{"id":"CVE-2026-57155","vendor":"opnsense","product":"core","severity":"CRITICAL","score":9.9,"description":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country\u2026","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-57155"},{"id":"CVE-2026-110812","vendor":"AWS","product":"Amazon Neptune Engine","severity":"CRITICAL","score":9.9,"description":"Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credent\u2026","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://aws.amazon.com/security/security-bulletins/2026-136-aws/","https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html","https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110812"},{"id":"CVE-2026-105037","vendor":"EnergizeLab","product":"station-middleware","severity":"CRITICAL","score":9.9,"description":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and s\u2026","cwe":"CWE-73","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/xn0tsa/your-secrets-are-safe-with-me","https://takeonme.org/gcves/GCVE-1337-2026-00000000000000110111111111111111110000000000000000000011111100011111111110000000000000000000011111111111111000000000000000000010001/","https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-105037"},{"id":"CVE-2026-109145","vendor":"WordPress","product":"User Rights Access Manager","severity":"CRITICAL","score":9.8,"description":"The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allow\u2026","cwe":"CWE-269","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0014,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-220c14eb719a/"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-109145"},{"id":"CVE-2026-109694","vendor":"WP ManageNinja LLC","product":"Fluent CRM","severity":"CRITICAL","score":9.8,"description":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.","cwe":"CWE-266","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/fluent-crm/vulnerability/wordpress-fluent-crm-plugin-3-2-5-privilege-escalation-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-109694"},{"id":"CVE-2026-109686","vendor":"Link Whisper INC","product":"Link Whisper Free","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-9-7-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-109686"},{"id":"CVE-2026-109892","vendor":"Shabti Kaplan","product":"Frontend Admin by DynamiApps","severity":"CRITICAL","score":9.8,"description":"Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.","cwe":"CWE-266","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-29-13-privilege-escalation-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-109892"},{"id":"CVE-2026-84731","vendor":"Nutanix","product":"Acropolis Operating System (AOS)","severity":"CRITICAL","score":9.8,"description":"An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfigura\u2026","cwe":"CWE-290","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://download.nutanix.com/alerts/Security_Advisory_0058.pdf","https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=AOS","https://www.nutanix.com/support"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-84731"}],"vendor_spikes":[{"vendor":"WordPress","count":74,"critical_count":5},{"vendor":"Microsoft","count":45,"critical_count":1},{"vendor":"QNAP","count":35,"critical_count":0},{"vendor":"HP","count":23,"critical_count":0},{"vendor":"Eclipse Foundation","count":21,"critical_count":0},{"vendor":"Netgate","count":20,"critical_count":0},{"vendor":"Unknown","count":19,"critical_count":0},{"vendor":"Progress","count":14,"critical_count":0},{"vendor":"FreeBSD","count":13,"critical_count":0},{"vendor":"espocrm","count":12,"critical_count":1}],"epss_risers":[],"developing_map":{},"trending_count":20,"new_cve_count":618,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-96951":{"anchor":"#dev-1","rank":1,"coverage":14}}}