{"date_iso":"2026-10-18","date_human":"Sunday, October 18, 2026","generated_utc":"2026-10-18 12:46 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants","link":"https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News","Huntress","SecurityWeek","The Hacker News"],"coverage":5,"cve_ids":[],"summary":"ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application\u2026","source":"The Hacker News","date_rel":"4h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxTJ5xsWsmrBmF1q18Gi5uaokNeC6-M0VbSf0T5X3KMQH7QGMhC7mz4XB6TUJuE7P9tjknMAqaGQ-Iz_7UuQ-NdKKXJTgqLhHMipRcd57VUOpwfJ2xxO8Hq_PX8hotdp_KZddNDzfQFw3bLHbYYLasThNbqGlidzhZ485ApBIKh2KUgn4g6PeBbhMwhc0T/s1600/ms-connect.jpg","description":"ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise","related":[{"title":"Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack","link":"https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/","source":"Bleeping Computer","date_rel":"21h ago"},{"title":"Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts","link":"https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/","source":"Cyber Security News","date_rel":"17 Oct"},{"title":"Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants","link":"https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html","source":"The Hacker News","date_rel":"17 Oct"},{"title":"ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks","link":"https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access","source":"Huntress","date_rel":"16 Oct"},{"title":"Microsoft: October Windows update may break Smart App Control","link":"https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/","source":"Bleeping Computer","date_rel":"16 Oct"},{"title":"Microsoft Patches Two Dozen RCE Flaws in Office","link":"https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/","source":"SecurityWeek","date_rel":"16 Oct"}]},{"title":"Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords","link":"https://cybersecuritynews.com/hackers-use-ai-generated-scripts/","reason":"Linux","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Cyber Security News","Palo Alto Unit 42","The Hacker News"],"coverage":5,"cve_ids":[],"summary":"A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The\u2026","source":"Cyber Security News","date_rel":"16 Oct","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Hackers-Use-AI-Generated-Scripts-to-Hijack-Linux-Sudo-Commands-and-Steal-Passwords.webp","description":"A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The attackers altered users\u2019 shell startup files to intercept the sudo command, then copied entered passwords to a file while passing them to the real command. This let a user\u2019s request appear to work normally as the password was stolen. Unit 42\u2019s investigation says the activity also involved web shells, custom malware, mailbox searches and attempts to erase evidence. The operation shows\u2026","related":[{"title":"AI-Powered Espionage Campaign Targets Government Linux Infrastructure","link":"https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/","source":"Palo Alto Unit 42","date_rel":"15 Oct"},{"title":"Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory","link":"https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html","source":"The Hacker News","date_rel":"15 Oct"},{"title":"SUSE Linux security advisory (AV26-1053)","link":"https://cyber.gc.ca/en/alerts-advisories/suse-linux-security-advisory-av26-1053","source":"CCCS Alerts & Advisories","date_rel":"15 Oct"},{"title":"Fake Arch Linux packages push malware with root privileges","link":"https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/","source":"Bleeping Computer","date_rel":"15 Oct"}]},{"title":"Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI","link":"https://cybersecuritynews.com/google-fixes-10-chrome-vulnerabilities/","reason":"Chrome","category":"News","sources":["Cyber Security News","Malwarebytes Labs","SecurityWeek","Volexity"],"coverage":4,"cve_ids":[],"summary":"Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The\u2026","source":"Cyber Security News","date_rel":"17 Oct","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Google-Fixes-Chrome-Vulnerabilities-Including-Memory-Corruption-Flaw-Found-With-Claude-AI.webp","description":"Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026. Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome\u2019s About page to\u2026","related":[{"title":"Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP","link":"https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/","source":"Volexity","date_rel":"16 Oct"},{"title":"In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit","link":"https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/","source":"SecurityWeek","date_rel":"16 Oct"},{"title":"Update Chrome: Google fixes 37 security flaws, including seven critical bugs","link":"https://www.malwarebytes.com/blog/bugs/2026/10/update-chrome-google-fixes-37-security-flaws-including-seven-critical-bugs","source":"Malwarebytes Labs","date_rel":"15 Oct"}]},{"title":"MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon","link":"https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html","reason":"Windows","category":"News","sources":["Microsoft Security","The Hacker News","The Register Security"],"coverage":3,"cve_ids":["CVE-2026-108465"],"summary":"Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package\u2026","source":"The Hacker News","date_rel":"17 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8fNb_yEvP6C_CENfQMUx3EDGofY1ejEHusnumTjCLnX3s8pevEbl_cgrtFHhzeEUhyphenhyphenyKe_X41OzQOGL5zlXeLLBnj_ZrLqH1IUag1QWm4QS9V2hgc5ucEzEZKjhstvtde8CFs8anPSZv9w3op67F8Q_MHVC_demESnH8lpAYLLpIRizCyvF5gsi5PDKzm/s1600/npm-dll.jpg","description":"Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of","related":[{"title":"Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor","link":"https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html","source":"The Hacker News","date_rel":"16 Oct"},{"title":"Networking problems after the October 2026 Windows update? NTLM might be to blame","link":"https://www.theregister.com/security/2026/10/16/networking-problems-after-the-october-2026-windows-update-ntlm-might-be-to-blame/5303503","source":"The Register Security","date_rel":"16 Oct"},{"title":"CVE-2026-108465 Windows Update Delivery Optimization Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108465","source":"Microsoft Security","date_rel":"16 Oct"}]},{"title":"How Multi-Campus Universities can Build a more Connected Security Program","link":"https://www.rapid7.com/blog/post/it-multi-campus-universities-building-more-connected-security-programs","reason":"Teams","category":"Research","sources":["Bleeping Computer","Cisco Security Advisories","Rapid7 Blog","SecurityWeek"],"coverage":4,"cve_ids":[],"summary":"Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments\u2026","source":"Rapid7 Blog","date_rel":"15 Oct","thumbnail":"https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt30cad4cead79d2d3/6846a7113860835cfa35e65d/surface-command.jpg","description":"Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act. This final part is about what changes when a university\u2026","related":[{"title":"Employees using personal ChatGPT at work? Here's what IT admins need to do","link":"https://www.bleepingcomputer.com/news/security/employees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do/","source":"Bleeping Computer","date_rel":"16 Oct"},{"title":"Cisco Meraki Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Meraki%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"15 Oct"},{"title":"Context Is King in the Fight Against Modern Cyberattacks","link":"https://www.securityweek.com/context-is-king-in-the-fight-against-modern-cyberattacks/","source":"SecurityWeek","date_rel":"15 Oct"}]},{"title":"UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing","link":"https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html","reason":"Google","category":"News","sources":["CCCS Alerts & Advisories","Infosecurity Magazine","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an\u2026","source":"The Hacker News","date_rel":"16 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPclyw7bJ19im5Qmzj9jgFlsM4XJqPK6hyphenhyphenRDCcQ0bnpWrteeTWgPNlip5T0P_oj_AC6V3osZ2xIpYipKjXWQw3BfFEQ1n28dleNCLRi7difLnPLY8Yc-oJ6BCVZ1V0VBpF_ZNu36qM_yCvyvbgBsSfh2AXq-IBIk7QjnBSR_T7s8ajMCOkIEhA5YGeYWg4/s1600/google-phish.jpg","description":"Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by","related":[{"title":"Google security advisory (AV26-1060)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1060","source":"CCCS Alerts & Advisories","date_rel":"16 Oct"},{"title":"China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns","link":"https://www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/","source":"Infosecurity Magazine","date_rel":"16 Oct"},{"title":"Google security advisory (AV26-1045)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1045","source":"CCCS Alerts & Advisories","date_rel":"15 Oct"}]},{"title":"Drupal patches critical RCE flaws, warns exploits may emerge soon","link":"https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/","reason":"Drupal","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories"],"coverage":2,"cve_ids":[],"summary":"Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.","source":"Bleeping Computer","date_rel":"22h ago","thumbnail":"","description":"","related":[{"title":"Drupal security advisory (AV26-1047)","link":"https://cyber.gc.ca/en/alerts-advisories/drupal-security-advisory-av26-1047","source":"CCCS Alerts & Advisories","date_rel":"15 Oct"}]},{"title":"CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support","link":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","reason":"CVE-2026-102764","category":"Advisory","sources":["CCCS Alerts & Advisories","CISA Alerts & Advisories","SecurityWeek"],"coverage":3,"cve_ids":["CVE-2026-102764"],"summary":"CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1\u2026","source":"CISA Alerts & Advisories","date_rel":"16 Oct","thumbnail":"","description":"CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. CISA urges organizations with affected self-hosted\u2026","related":[{"title":"AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support \u2013 CVE-2026-102764","link":"https://cyber.gc.ca/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764","source":"CCCS Alerts & Advisories","date_rel":"16 Oct"},{"title":"Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day","link":"https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/","source":"SecurityWeek","date_rel":"16 Oct"}]},{"title":"NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks","link":"https://thehackernews.com/2026/10/nginx-fixes-5-flaws-including-possible.html","reason":"F5","category":"News","sources":["CCCS Alerts & Advisories","SecurityWeek","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a\u2026","source":"The Hacker News","date_rel":"15 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEionuV8CAd7SP0bgEbHyb-0hp7JWNkWpPjYtkNH9p86nRQrxDN1T97D1cragnVVzAwCEFCuqrwuysgwzxJLfvTXrYhMSGj5rbBzrpjW-VPvAmrc2-9EAR_hBmPigJUOjynvkm0ArpyasyzCOAWUWFYdCqzsbCJVOsxC09LnYwH2dcV4j4Vm9S9VDelXUlc/s1600/tls.jpg","description":"NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could","related":[{"title":"F5, Juniper Networks Patch Critical Vulnerabilities","link":"https://www.securityweek.com/f5-juniper-networks-patch-critical-vulnerabilities/","source":"SecurityWeek","date_rel":"16 Oct"},{"title":"F5 security advisory (AV26-1049)","link":"https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-1049","source":"CCCS Alerts & Advisories","date_rel":"15 Oct"}]},{"title":"Proofpoint lines up $6.3 billion deal for Varonis\u2019 data security","link":"https://therecord.media/proofpoint-varonis-cybersecurity-acquisition","reason":"Proofpoint","category":"News","sources":["CyberScoop","SecurityWeek","The Record"],"coverage":3,"cve_ids":[],"summary":"Cybersecurity giant Proofpoint says it will acquire Miami-based data visibility and security company Varonis in an all-cash transaction worth $6.3 billion.","source":"The Record","date_rel":"16 Oct","thumbnail":"http://cms.therecord.media/uploads/proofpoint_rsac_2026_f941477750.jpg","description":"","related":[{"title":"Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis","link":"https://www.securityweek.com/proofpoint-inks-6-3-billion-all-cash-deal-to-acquire-varonis/","source":"SecurityWeek","date_rel":"16 Oct"},{"title":"Proofpoint to buy Varonis for $6.3 billion","link":"https://cyberscoop.com/proofpoint-acquires-varonis-systems-data-security/","source":"CyberScoop","date_rel":"15 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-111911","vendor":"thorsten","product":"phpMyFAQ","severity":"CRITICAL","score":9.8,"description":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submi\u2026","cwe":"CWE-287","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111911"},{"id":"CVE-2026-111884","vendor":"thorsten","product":"phpMyFAQ","severity":"HIGH","score":8.3,"description":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF t\u2026","cwe":"CWE-308","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7554-gx6g-xx77","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-missing-current-password-step-up-on-e-mail-change-enables-account-takeover"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111884"},{"id":"CVE-2026-111908","vendor":"thorsten","product":"phpMyFAQ","severity":"HIGH","score":8.3,"description":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access t\u2026","cwe":"CWE-639","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r","https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111908"},{"id":"CVE-2026-111882","vendor":"thorsten","product":"phpMyFAQ","severity":"HIGH","score":8.1,"description":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. \u2026","cwe":"CWE-287","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-43g3-pp5p-fg96","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8fvf-747v-qjr6","https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-alpha-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-totp-2fa-bypass-via-sso-callbacks"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111882"},{"id":"CVE-2026-111909","vendor":"thorsten","product":"phpMyFAQ","severity":"HIGH","score":8.1,"description":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /a\u2026","cwe":"CWE-269","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7j43-ww55-pm3g","https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-missing-authorization-allows-superadmin-deletion-via-deleteuser-api"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111909"},{"id":"CVE-2026-111927","vendor":"Citrix","product":"coder","severity":"HIGH","score":7.7,"description":"Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is\u2026","cwe":"CWE-522","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg","https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111927"},{"id":"CVE-2026-111881","vendor":"FreeRDP","product":"FreeRDP","severity":"HIGH","score":7.6,"description":"FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp\u2026","cwe":"CWE-191","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","fix":false,"fix_url":"","refs":["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-27m7-gwhh-6hhf","https://www.vulncheck.com/advisories/freerdp-3.14.1-before-3.32.0-integer-underflow-in-bmp-writer-via-clipboard"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111881"},{"id":"CVE-2026-110889","vendor":"Gantry","product":"Gantry 5 Framework","severity":"HIGH","score":7.5,"description":"Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.","cwe":"CWE-209","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/gantry5/vulnerability/wordpress-gantry-5-framework-plugin-5-6-4-sensitive-data-exposure-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110889"},{"id":"CVE-2026-111898","vendor":"thorsten","product":"phpMyFAQ","severity":"HIGH","score":7.5,"description":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a collidin\u2026","cwe":"CWE-287","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg4w-2j3r-2hhp","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-account-takeover-via-keycloak-implicit-account-linking"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111898"},{"id":"CVE-2026-111901","vendor":"thorsten","product":"phpMyFAQ","severity":"HIGH","score":7.5,"description":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records i\u2026","cwe":"CWE-400","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","fix":false,"fix_url":"","refs":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111901"}],"vendor_spikes":[{"vendor":"thorsten","count":26,"critical_count":1},{"vendor":"coder","count":7,"critical_count":0},{"vendor":"WordPress","count":6,"critical_count":0},{"vendor":"go-vikunja","count":6,"critical_count":0},{"vendor":"Unknown","count":6,"critical_count":0},{"vendor":"Admidio","count":4,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":16,"new_cve_count":78,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-108465":{"anchor":"#dev-4","rank":4,"coverage":3},"CVE-2026-102764":{"anchor":"#dev-8","rank":8,"coverage":3}}}