{"date_iso":"2026-10-17","date_human":"Saturday, October 17, 2026","generated_utc":"2026-10-17 12:21 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts","link":"https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/","reason":"Microsoft","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Cyber Security News","CyberScoop","Huntress","Infosecurity Magazine","SecurityWeek","The Hacker News"],"coverage":8,"cve_ids":[],"summary":"Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/ConnectWise-Credentials-Microsoft-365-Accounts.webp","description":"Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor secret can create risk across many organizations when a multitenant app already has wide permissions. The affected product is ConnectWise Cloud Backup, formerly known as SkyKick Backup. Managed service providers use the platform to protect Microsoft 365 and Google Workspace data. To perform backup and recovery tasks, the Microsoft 365 app may receive access to Exchange\u2026","related":[{"title":"Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants","link":"https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html","source":"The Hacker News","date_rel":"6h ago"},{"title":"ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks","link":"https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access","source":"Huntress","date_rel":"13h ago"},{"title":"Microsoft: October Windows update may break Smart App Control","link":"https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/","source":"Bleeping Computer","date_rel":"16 Oct"},{"title":"Microsoft Patches Two Dozen RCE Flaws in Office","link":"https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/","source":"SecurityWeek","date_rel":"16 Oct"},{"title":"Microsoft: Windows Server 2022 reached end of mainstream support","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/","source":"Bleeping Computer","date_rel":"15 Oct"},{"title":"Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages","link":"https://www.infosecurity-magazine.com/news/microsoft-yam-store-one-billion/","source":"Infosecurity Magazine","date_rel":"15 Oct"}]},{"title":"Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI","link":"https://cybersecuritynews.com/google-fixes-10-chrome-vulnerabilities/","reason":"Chrome","category":"News","sources":["Cyber Security News","Malwarebytes Labs","SecurityWeek","The Register Security","Volexity"],"coverage":5,"cve_ids":[],"summary":"Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The\u2026","source":"Cyber Security News","date_rel":"6h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Google-Fixes-Chrome-Vulnerabilities-Including-Memory-Corruption-Flaw-Found-With-Claude-AI.webp","description":"Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026. Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome\u2019s About page to\u2026","related":[{"title":"Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP","link":"https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/","source":"Volexity","date_rel":"17h ago"},{"title":"In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit","link":"https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/","source":"SecurityWeek","date_rel":"22h ago"},{"title":"Update Chrome: Google fixes 37 security flaws, including seven critical bugs","link":"https://www.malwarebytes.com/blog/bugs/2026/10/update-chrome-google-fixes-37-security-flaws-including-seven-critical-bugs","source":"Malwarebytes Labs","date_rel":"15 Oct"},{"title":"Security researchers spent 6 days doing their Chromework, built 1B user exploit","link":"https://www.theregister.com/security/2026/10/14/security-researchers-spent-6-days-doing-their-chromework-built-1b-user-exploit/5303134","source":"The Register Security","date_rel":"14 Oct"}]},{"title":"How Multi-Campus Universities can Build a more Connected Security Program","link":"https://www.rapid7.com/blog/post/it-multi-campus-universities-building-more-connected-security-programs","reason":"Teams","category":"Research","sources":["Bleeping Computer","Cisco Security Advisories","Huntress","Rapid7 Blog","SecurityWeek"],"coverage":5,"cve_ids":[],"summary":"Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments\u2026","source":"Rapid7 Blog","date_rel":"15 Oct","thumbnail":"https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt30cad4cead79d2d3/6846a7113860835cfa35e65d/surface-command.jpg","description":"Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act. This final part is about what changes when a university\u2026","related":[{"title":"Employees using personal ChatGPT at work? Here's what IT admins need to do","link":"https://www.bleepingcomputer.com/news/security/employees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"Cisco Meraki Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"15 Oct"},{"title":"Context Is King in the Fight Against Modern Cyberattacks","link":"https://www.securityweek.com/context-is-king-in-the-fight-against-modern-cyberattacks/","source":"SecurityWeek","date_rel":"15 Oct"},{"title":"10 Endpoint Security Trends and Tips for 2027 | Huntress","link":"https://www.huntress.com/blog/endpoint-security-trends","source":"Huntress","date_rel":"14 Oct"}]},{"title":"Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords","link":"https://cybersecuritynews.com/hackers-use-ai-generated-scripts/","reason":"Linux","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Cyber Security News","Palo Alto Unit 42","The Hacker News"],"coverage":5,"cve_ids":[],"summary":"A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The\u2026","source":"Cyber Security News","date_rel":"22h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Hackers-Use-AI-Generated-Scripts-to-Hijack-Linux-Sudo-Commands-and-Steal-Passwords.webp","description":"A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The attackers altered users\u2019 shell startup files to intercept the sudo command, then copied entered passwords to a file while passing them to the real command. This let a user\u2019s request appear to work normally as the password was stolen. Unit 42\u2019s investigation says the activity also involved web shells, custom malware, mailbox searches and attempts to erase evidence. The operation shows\u2026","related":[{"title":"AI-Powered Espionage Campaign Targets Government Linux Infrastructure","link":"https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/","source":"Palo Alto Unit 42","date_rel":"15 Oct"},{"title":"Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory","link":"https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html","source":"The Hacker News","date_rel":"15 Oct"},{"title":"SUSE Linux security advisory (AV26-1053)","link":"https://cyber.gc.ca/en/alerts-advisories/suse-linux-security-advisory-av26-1053","source":"CCCS Alerts & Advisories","date_rel":"15 Oct"},{"title":"Fake Arch Linux packages push malware with root privileges","link":"https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/","source":"Bleeping Computer","date_rel":"15 Oct"}]},{"title":"UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing","link":"https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html","reason":"Google","category":"News","sources":["CCCS Alerts & Advisories","Infosecurity Magazine","Malwarebytes Labs","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an\u2026","source":"The Hacker News","date_rel":"20h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPclyw7bJ19im5Qmzj9jgFlsM4XJqPK6hyphenhyphenRDCcQ0bnpWrteeTWgPNlip5T0P_oj_AC6V3osZ2xIpYipKjXWQw3BfFEQ1n28dleNCLRi7difLnPLY8Yc-oJ6BCVZ1V0VBpF_ZNu36qM_yCvyvbgBsSfh2AXq-IBIk7QjnBSR_T7s8ajMCOkIEhA5YGeYWg4/s1600/google-phish.jpg","description":"Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by","related":[{"title":"Google security advisory (AV26-1060)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1060","source":"CCCS Alerts & Advisories","date_rel":"16h ago"},{"title":"China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns","link":"https://www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/","source":"Infosecurity Magazine","date_rel":"16 Oct"},{"title":"Google security advisory (AV26-1045)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1045","source":"CCCS Alerts & Advisories","date_rel":"15 Oct"},{"title":"AI worms could spread across your smart devices, Anthropic warns","link":"https://www.malwarebytes.com/blog/ai/2026/10/ai-worms-could-spread-across-your-smart-devices-anthropic-warns","source":"Malwarebytes Labs","date_rel":"14 Oct"}]},{"title":"ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More","link":"https://thehackernews.com/2026/10/threatsday-adobe-rce-dns-wallet-theft.html","reason":"Adobe","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","The Hacker News","Zero Day Initiative"],"coverage":4,"cve_ids":["CVE-2026-103849"],"summary":"Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that\u2019s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different\u2026","source":"The Hacker News","date_rel":"15 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8jHVMYXIjddaTrqHbBuPm3mQ6G_g8qlALwitmiIRM9OplZpPxLPDFet7ySOV0OVxPj6cW1oz0K6rydDvGYQGalR1jSt10bz8kti4dWnM0d3NnUBjuymD77_cReujy6AXmFgJgQQvl2qeICur3VHf5vYyOrxz8OFM-bEunzmK9PGDzCzzTVFVEdQyswYho/s1600/threatsday-oct.jpg","description":"Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that\u2019s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and","related":[{"title":"Critical BlockStrap flaw lets hackers run code on Magento servers","link":"https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/","source":"Bleeping Computer","date_rel":"16h ago"},{"title":"ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-778/","source":"Zero Day Initiative","date_rel":"15 Oct"},{"title":"ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-777/","source":"Zero Day Initiative","date_rel":"15 Oct"},{"title":"Adobe security advisory (AV26-1039)","link":"https://cyber.gc.ca/en/alerts-advisories/adobe-security-advisory-av26-1039","source":"CCCS Alerts & Advisories","date_rel":"14 Oct"}]},{"title":"MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon","link":"https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html","reason":"Windows","category":"News","sources":["Microsoft Security","The Hacker News","The Register Security"],"coverage":3,"cve_ids":["CVE-2026-108465"],"summary":"Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package\u2026","source":"The Hacker News","date_rel":"1h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8fNb_yEvP6C_CENfQMUx3EDGofY1ejEHusnumTjCLnX3s8pevEbl_cgrtFHhzeEUhyphenhyphenyKe_X41OzQOGL5zlXeLLBnj_ZrLqH1IUag1QWm4QS9V2hgc5ucEzEZKjhstvtde8CFs8anPSZv9w3op67F8Q_MHVC_demESnH8lpAYLLpIRizCyvF5gsi5PDKzm/s1600/npm-dll.jpg","description":"Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of","related":[{"title":"Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor","link":"https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html","source":"The Hacker News","date_rel":"19h ago"},{"title":"Networking problems after the October 2026 Windows update? NTLM might be to blame","link":"https://www.theregister.com/security/2026/10/16/networking-problems-after-the-october-2026-windows-update-ntlm-might-be-to-blame/5303503","source":"The Register Security","date_rel":"20h ago"},{"title":"CVE-2026-108465 Windows Update Delivery Optimization Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108465","source":"Microsoft Security","date_rel":"22h ago"}]},{"title":"Cisco make-me-root email bug exploited as a 0-day by unknown crims","link":"https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/5303168","reason":"Cisco","category":"News","sources":["CCCS Alerts & Advisories","Dark Reading","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"Cisco \u201cstrongly\u201d implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The\u2026","source":"The Register Security","date_rel":"14 Oct","thumbnail":"https://image.theregister.com/?imageId=4094206&width=800","description":"Cisco \u201cstrongly\u201d implored customers to patch yet another critical, make-me-root vulnerability in its Secure Email Gateway (SEG), one that has already been exploited in zero-day attacks. A Cisco spokesperson told The Register that the critical vuln, which received a 9.8 out of 10 CVSS rating, affects \u201ca limited number of customers.\u201d The bug, now tracked as CVE\u20112026\u201176519, allows remote, unauthenticated attackers to write files and execute commands with root privileges on the appliance\u2019s operating system - simply by sending a malicious email. In separate Wednesday advisories, both the\u2026","related":[{"title":"BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs","link":"https://www.darkreading.com/endpoint-security/beyondtrust-remote-support-exploited-edge-bugs","source":"Dark Reading","date_rel":"15h ago"},{"title":"Cisco security advisory (AV26-1042) \u2013 Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-1042","source":"CCCS Alerts & Advisories","date_rel":"14 Oct"},{"title":"Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability","link":"https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html","source":"The Hacker News","date_rel":"14 Oct"}]},{"title":"Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles","link":"https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching","reason":"Ivanti","category":"News","sources":["CCCS Alerts & Advisories","Dark Reading","The Hacker News","The Register Security"],"coverage":4,"cve_ids":["CVE-2026-104935"],"summary":"CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.","source":"Dark Reading","date_rel":"14 Oct","thumbnail":"https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt5c7ce56f98018528/6acfd608b8750c62d9a7bd46/patching-Florencio_Horcajo_Alvarez-Getty-2270656800.jpg?width=720&quality=80&disable=upscale","description":"","related":[{"title":"Ivanti security advisory (AV26-1035) - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035","source":"CCCS Alerts & Advisories","date_rel":"21h ago"},{"title":"Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks","link":"https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095","source":"The Register Security","date_rel":"14 Oct"},{"title":"CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts","link":"https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html","source":"The Hacker News","date_rel":"14 Oct"}]},{"title":"PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions","link":"https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html","reason":"Fortinet","category":"News","sources":["CISA Alerts & Advisories","The Hacker News","Zero Day Initiative"],"coverage":3,"cve_ids":["CVE-2025-61624"],"summary":"A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the\u2026","source":"The Hacker News","date_rel":"16 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMvdc6m999SfUEEWC89wHnBiUX9WAMCSdWtbFP_lrH4DuREHfOJL7G29LkM4uAvittg3XsHxnq6dq_VEX1zB_jCGi5RJDbQZlrq37gHSCXpRrn11FEN-hezQn0Dt4Xcw4DcanklKW_8iLEnQN6JpzkQ7JHBOS1_dMzDAs2h_jJcWDqOGjbkMoeabOCkSFK/s1600/f.jpg","description":"A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a","related":[{"title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA Alerts & Advisories","date_rel":"16 Oct"},{"title":"ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-772/","source":"Zero Day Initiative","date_rel":"15 Oct"},{"title":"ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-771/","source":"Zero Day Initiative","date_rel":"15 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-94169","vendor":"Theme-one","product":"The Grid","severity":"CRITICAL","score":10.0,"description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0098,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-1-remote-code-execution-rce-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-94169"},{"id":"CVE-2026-95182","vendor":"Unknown","product":"","severity":"CRITICAL","score":10.0,"description":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.","cwe":"CWE-426","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["http://deepseek.com","https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32","https://github.com/lkloliver/poc/tree/main/CVE-2026-95182"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-95182"},{"id":"CVE-2026-85746","vendor":"Oracle","product":"server","severity":"CRITICAL","score":9.9,"description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections \u2026","cwe":"CWE-787","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-85746"},{"id":"CVE-2026-85748","vendor":"Oracle","product":"server","severity":"CRITICAL","score":9.9,"description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacke\u2026","cwe":"CWE-416","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-85748"},{"id":"CVE-2026-92262","vendor":"Oracle","product":"server","severity":"CRITICAL","score":9.9,"description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-na\u2026","cwe":"CWE-706","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-92262"},{"id":"CVE-2026-104730","vendor":"WordPress","product":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","severity":"CRITICAL","score":9.8,"description":"The Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it \u2026","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0051,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-frontend.php#L195","https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-image.php#L177","https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L164"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-104730"},{"id":"CVE-2026-107617","vendor":"Guangzhou Juan IoT Technology Co., Ltd.","product":"EseeCloud App","severity":"CRITICAL","score":9.8,"description":"An attacker can use a hard-coded credential to log in to EseeCloud devices.","cwe":"CWE-798","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://eseecloud.app/","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json","https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-107617"},{"id":"CVE-2026-49868","vendor":"RIOT-OS","product":"RIOT","severity":"CRITICAL","score":9.8,"description":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before\u2026","cwe":"CWE-125","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17","https://github.com/RIOT-OS/RIOT/pull/22322","https://github.com/RIOT-OS/RIOT/releases/tag/2026.07"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-49868"},{"id":"CVE-2026-111626","vendor":"Webreaper","product":"Damselfly","severity":"CRITICAL","score":9.8,"description":"Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/u\u2026","cwe":"CWE-306","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53","https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242","https://github.com/Webreaper/Damselfly/issues/409"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111626"},{"id":"CVE-2026-111641","vendor":"fastapiadmin","product":"FastapiAdmin","severity":"CRITICAL","score":9.8,"description":"FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login\u2026","cwe":"CWE-306","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/auth/controller.py#L173-L251","https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret","https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111641"}],"vendor_spikes":[{"vendor":"WordPress","count":84,"critical_count":3},{"vendor":"Unknown","count":21,"critical_count":1},{"vendor":"Red Hat","count":15,"critical_count":0},{"vendor":"Mattermost","count":13,"critical_count":0},{"vendor":"Microsoft","count":13,"critical_count":0},{"vendor":"Apache","count":12,"critical_count":0},{"vendor":"Oracle","count":10,"critical_count":3},{"vendor":"IBM","count":9,"critical_count":0},{"vendor":"mz-automation","count":6,"critical_count":0},{"vendor":"TandoorRecipes","count":6,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":20,"new_cve_count":404,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-103849":{"anchor":"#dev-6","rank":6,"coverage":4},"CVE-2026-108465":{"anchor":"#dev-7","rank":7,"coverage":3},"CVE-2026-104935":{"anchor":"#dev-9","rank":9,"coverage":4},"CVE-2025-61624":{"anchor":"#dev-10","rank":10,"coverage":3}}}