{"date_iso":"2026-10-20","date_human":"Tuesday, October 20, 2026","generated_utc":"2026-10-20 12:56 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Researchers Infiltrate Microsoft Tech Support Scam Operation","link":"https://www.darkreading.com/threat-intelligence/microsoft-tech-support-scam-operation","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News","Dark Reading","Infosecurity Magazine","SecurityWeek","Sophos Threat Research","Tenable Blog","The Hacker News"],"coverage":8,"cve_ids":[],"summary":"A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.","source":"Dark Reading","date_rel":"15h ago","thumbnail":"https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2a7fd796cffad616/6ad6756d20d56c6557294d94/techsupportscam-Cravetiger-Getty-2234087419.jpg?width=720&quality=80&disable=upscale","description":"","related":[{"title":"Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring","link":"https://www.securityweek.com/microsoft-targets-rogue-ai-agents-with-dynamic-permissions-risk-scoring/","source":"SecurityWeek","date_rel":"1h ago"},{"title":"Windows Server 2025 gets support for quick machine recovery","link":"https://www.bleepingcomputer.com/news/microsoft/windows-server-2025-gets-support-for-quick-machine-recovery/","source":"Bleeping Computer","date_rel":"1h ago"},{"title":"ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs","link":"https://www.darkreading.com/identity-access-management-security/connectwise-disables-cloud-backups-downstream-msps","source":"Dark Reading","date_rel":"17h ago"},{"title":"Microsoft Says AI Agents Cannot Be Trusted and Could Become Insider Security Threats","link":"https://cybersecuritynews.com/ai-models-as-insider-threats/","source":"Cyber Security News","date_rel":"18h ago"},{"title":"Microsoft fixes game, app crashes caused by recent Windows update","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-game-app-crashes-caused-by-windows-kb5124010-preview-update/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"Unmasking the robots: Why it\u2019s critical to discover AI agent identities and how Tenable helps you secure them","link":"https://www.tenable.com/blog/secure-ai-agent-identities-microsoft-entra-agent-id-tenable-one","source":"Tenable Blog","date_rel":"23h ago"}]},{"title":"Hackers Hijack AOMEI Software Updates for Just 5 Minutes to Secretly Install Backdoors","link":"https://cybersecuritynews.com/hackers-hijack-aomei-software-updates/","reason":"Google","category":"News","sources":["Cyber Security News","Infosecurity Magazine","Malwarebytes Labs","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"A short-lived change to AOMEI\u2019s software update system gave hackers a way to deliver malware through a trusted route. Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI\u2019s\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Hackers-Hijack-AOMEI-Software-Updates-for-Just-5-Minutes-to-Secretly-Install-Backdoors.webp","description":"A short-lived change to AOMEI\u2019s software update system gave hackers a way to deliver malware through a trusted route. Google Threat Intelligence Group (GTIG) and Mandiant found that attackers repeatedly altered AOMEI\u2019s update settings for only a few minutes at a time between April and July 2026. Any AOMEI Backupper computer checking for updates during an active window could receive a malicious download instead of a genuine update. The operation did not rely on a software flaw or require users to open a suspicious file. Instead, the attackers changed two configuration files on AOMEI\u2019s servers\u2026","related":[{"title":"Google may add your number to all your accounts: How to stop it","link":"https://www.malwarebytes.com/blog/mobile/2026/10/google-may-add-your-number-to-all-your-accounts-how-to-stop-it","source":"Malwarebytes Labs","date_rel":"10m ago"},{"title":"Hackers Using Fake Google Meet Pages to Steal Google Credentials","link":"https://cybersecuritynews.com/fake-google-meet-pages/","source":"Cyber Security News","date_rel":"5h ago"},{"title":"AOMEI Backupper update servers hijacked to push malware: Check your PC","link":"https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc","source":"Malwarebytes Labs","date_rel":"22h ago"},{"title":"OpenCode Breach Could Affect OpenAI, Anthropic and Google","link":"https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/","source":"Infosecurity Magazine","date_rel":"23h ago"},{"title":"OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys","link":"https://thehackernews.com/2026/10/opencode-console-breach-may-have.html","source":"The Hacker News","date_rel":"19 Oct"}]},{"title":"What Security Teams Can Do To Tame Wild Code","link":"https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html","reason":"Teams","category":"News","sources":["Dark Reading","Rapid7 Blog","The Hacker News","Wiz Research"],"coverage":4,"cve_ids":[],"summary":"A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon\u2026","source":"The Hacker News","date_rel":"1h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7Q3156iY5WJRnphGSZ5PuIiMopF0sG7ku3FR-WROda9fE4jCSIOQpClG1HOBRCvbuqDyLHgsC0N3UFjowgnXzZN4T1mDpkQbTz2gX7z4NRZsfoEpimVlZ7hevcXmeTfpOt1iFrHqvLXubegNIRz15gjlQNHIBBYzQVAmy8MNAGiZs6OXIEuWNntLwTlI/s1600/tines-main.jpg","description":"A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team\u2019s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them","related":[{"title":"Your Next Insider Threat Won\u2019t be Human: Securing AI Agents From the Outside in","link":"https://www.rapid7.com/blog/post/ai-inhuman-insider-threats-securing-agents","source":"Rapid7 Blog","date_rel":"20h ago"},{"title":"Supply Chain Zero Days: Closing the Gap Between Publication and Detection","link":"https://www.wiz.io/blog/detect-supply-chain-zero-days-at-publication","source":"Wiz Research","date_rel":"22h ago"},{"title":"The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience","link":"https://www.darkreading.com/vulnerabilities-threats/cybersecurity-lexicon-vulnerability-discovery-resilience","source":"Dark Reading","date_rel":"22h ago"}]},{"title":"Hackers Hijack OVHcloud GitHub Releases to Distribute Secret-Stealing Malware","link":"https://cybersecuritynews.com/ovhcloud-supply-chain-attack/","reason":"Github","category":"News","sources":["Bleeping Computer","Cyber Security News","Hak5","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Hackers compromised the GitHub account of an OVHcloud developer and used it to distribute malicious files through the company\u2019s official command-line tool releases. The October 19, 2026, supply chain attack targeted\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/OVHcloud-Supply-Chain-Attack.webp","description":"Hackers compromised the GitHub account of an OVHcloud developer and used it to distribute malicious files through the company\u2019s official command-line tool releases. The October 19, 2026, supply chain attack targeted users downloading the OVHcloud CLI, with malware designed to collect secrets stored on their computers. A customer spotted suspicious release changes and alerted the cloud provider, which blocked the malicious files within 94 minutes. OVHcloud CEO Octave Klaba said the affected releases were v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0. He identified v0.10.0 as clean and\u2026","related":[{"title":"OVHcloud CLI releases backdoored on GitHub to steal developer secrets","link":"https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/","source":"Bleeping Computer","date_rel":"1h ago"},{"title":"Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware","link":"https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html","source":"The Hacker News","date_rel":"4h ago"},{"title":"GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories","link":"https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html","source":"The Hacker News","date_rel":"23h ago"},{"title":"Hackers Turned GitHub Against Its Own Users | Threat Wire","link":"https://www.youtube.com/watch?v=ANaZvokz4e8","source":"Hak5","date_rel":"18 Oct"},{"title":"\ud83c\udf4d\ud83d\udcdf New Deauth Attack for WPA3 - WiFi Pineapple Pager #pentesting #cybersecurity Aircrack-NG PR 2724","link":"https://www.youtube.com/shorts/g73zfXEf47U","source":"Hak5","date_rel":"18 Oct"}]},{"title":"ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan","link":"https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html","reason":"Siemens","category":"News","sources":["CCCS Alerts & Advisories","Infosecurity Magazine","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":["CVE-2026-110936"],"summary":"Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score\u2026","source":"The Hacker News","date_rel":"5h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUJqb8f_ibR_O_dPoJqAVHZOVmgi23TsxhFzv19_3uzAbEqH6L6QMJUWdelmEKmDe6U9wj6KKyDpPKi_1a93IK1KJa-Ql0kFRtfqVe9sKQpVFj0dA65dCfRKCN7H0LQYgMdzqdJoLgSb6rRFBA4bfmf4oUqItqe6pVCsyxmEzCnHx02h_m1WsK6sJu7jy2/s1600/siemens.jpg","description":"Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the","related":[{"title":"Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw","link":"https://www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/","source":"Infosecurity Magazine","date_rel":"2h ago"},{"title":"Siemens security advisory (AV26-1063)","link":"https://cyber.gc.ca/en/alerts-advisories/siemens-security-advisory-av26-1063","source":"CCCS Alerts & Advisories","date_rel":"16h ago"},{"title":"Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks","link":"https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/","source":"SecurityWeek","date_rel":"18h ago"}]},{"title":"Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors","link":"https://cybersecuritynews.com/rank-math-pro-plugin-compromised/","reason":"Wordpress","category":"News","sources":["Bleeping Computer","Cyber Security News","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Hackers planted malware in copies of the Rank Math PRO WordPress plugin, exposing websites to hidden backdoors that can rebuild themselves after removal. Rank Math confirmed that some version 3.0.123 packages\u2026","source":"Cyber Security News","date_rel":"4h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Rank-Math-PRO-Plugin-Compromised.webp","description":"Hackers planted malware in copies of the Rank Math PRO WordPress plugin, exposing websites to hidden backdoors that can rebuild themselves after removal. Rank Math confirmed that some version 3.0.123 packages distributed during a limited October download window contained malicious code that could compromise websites when activated. The company removed the affected files and released clean version 3.0.124. The affected window ran from October 15, 2026, at 20:02 UTC to October 16 at 07:12 UTC. Rank Math described the impact as limited but did not provide an affected website count in its\u2026","related":[{"title":"WordPress SEO plugin Rank Math compromised to backdoor websites","link":"https://www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/","source":"Bleeping Computer","date_rel":"15h ago"},{"title":"Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor","link":"https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html","source":"The Hacker News","date_rel":"20h ago"},{"title":"Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack","link":"https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/","source":"SecurityWeek","date_rel":"21h ago"}]},{"title":"Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication","link":"https://cybersecuritynews.com/drupal-rce-vulnerability/","reason":"Drupal","category":"News","sources":["Cyber Security News","SecurityWeek"],"coverage":2,"cve_ids":["CVE-2026-108097"],"summary":"Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI\u2026","source":"Cyber Security News","date_rel":"18h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Critical-Drupal-RCE-Vulnerability-Could-Let-Attackers-Take-Over-Websites-Without-Authentication.webp","description":"Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as CVE-2026-108097, the flaw affects the Field UI module in Drupal core. The Drupal Security Team published its warning on October 14, 2026. The official security advisory, SA-CORE-2026-014, assigns the issue a risk score of 19 out of 25 under Drupal\u2019s rating system. Successful exploitation could expose all private website data and allow attackers to change or delete information. The score is not a CVSS rating. The most\u2026","related":[{"title":"Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw","link":"https://www.securityweek.com/drupal-warns-of-fast-exploitation-risk-for-critical-core-rce-flaw/","source":"SecurityWeek","date_rel":"21h ago"}]},{"title":"Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor","link":"https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html","reason":"Linux","category":"News","sources":["The Hacker News","The Register Security"],"coverage":2,"cve_ids":[],"summary":"Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher\u2026","source":"The Hacker News","date_rel":"19h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjF_Xo8mH5AxIDYx4hFrS1_uhblD0IoGUTo6bioM38mwy-whZAbcq1aaGeH1iZrS8nmk5Ow25NfX67HRXKiWFfzLc8C1A2zs2n948DwyW_NSSkowFDnEzxUofGxhNV72vTEWkgPmbO6XJyDUPwBR-lzSekj5_m8tY3JHjozUXETGEBg6GrLZrekhilW9W_R/s1600/plex-hack.jpg","description":"Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities","related":[{"title":"Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking","link":"https://www.theregister.com/virtualization/2026/10/19/linux-kvm-guest-host-escape-rated-critical-may-represent-a-new-way-to-attack-penguin-powered-networking/5303744","source":"The Register Security","date_rel":"19 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-111057","vendor":"mljar","product":"mercury","severity":"CRITICAL","score":10.0,"description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /a\u2026","cwe":"CWE-185","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f","https://github.com/mljar/mercury/releases/tag/v3.2.4","https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111057"},{"id":"CVE-2026-110887","vendor":"HivePress","product":"HivePress","severity":"CRITICAL","score":9.9,"description":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-7-32-remote-code-execution-rce-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110887"},{"id":"CVE-2026-111406","vendor":"PT Norther Lights Production","product":"MapSVG","severity":"CRITICAL","score":9.9,"description":"Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.","cwe":"CWE-434","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-16-1-arbitrary-file-upload-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111406"},{"id":"CVE-2026-112370","vendor":"H3C","product":"Magic NX15","severity":"CRITICAL","score":9.9,"description":"A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The expl\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce","https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_cmdi_root_rce/poc","https://vuldb.com/cve/CVE-2026-112370"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112370"},{"id":"CVE-2026-112371","vendor":"H3C","product":"Magic NX15","severity":"CRITICAL","score":9.9,"description":"A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be \u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/file_write_root_rce","https://vuldb.com/cve/CVE-2026-112371","https://vuldb.com/submit/983538"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112371"},{"id":"CVE-2026-90910","vendor":"Apache","product":"Apache Answer","severity":"CRITICAL","score":9.8,"description":"Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction m\u2026","cwe":"CWE-306","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3","http://www.openwall.com/lists/oss-security/2026/10/16/34"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-90910"},{"id":"CVE-2026-112292","vendor":"operacle","product":"checkcle","severity":"CRITICAL","score":9.8,"description":"CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/\u2026","cwe":"CWE-862","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/operacle/checkcle/blob/v1.6.0/application/public/upload/data/pb_schema_latest.json","https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75","https://github.com/operacle/checkcle/issues/214"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112292"},{"id":"CVE-2026-112296","vendor":"sunkaifei","product":"FlyCms","severity":"CRITICAL","score":9.8,"description":"FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /ap\u2026","cwe":"CWE-1392","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/README.md","https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/sql/flycms_20260928_093335.sql","https://github.com/sunkaifei/FlyCms/issues/19"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112296"},{"id":"CVE-2026-109432","vendor":"Camunda","product":"Camunda 7","severity":"CRITICAL","score":9.8,"description":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowin\u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://codeant.ai/security-research/camunda-adhoc-query-expression-rce-cve-2026-109432","https://docs.camunda.org/enterprise/download/","https://www.vulncheck.com/advisories/camunda-expression-injection-via-orqueries-rce"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-109432"},{"id":"CVE-2026-111058","vendor":"mljar","product":"mercury","severity":"CRITICAL","score":9.8,"description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arb\u2026","cwe":"CWE-862","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/mljar/mercury/commit/73a40ceb0becf057f495a5738ad7f5a5222a53e1","https://github.com/mljar/mercury/releases/tag/3.2.6","https://github.com/mljar/mercury/security/advisories/GHSA-rv4m-xm3f-3ccq"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111058"}],"vendor_spikes":[{"vendor":"Unknown","count":128,"critical_count":1},{"vendor":"Apache","count":63,"critical_count":1},{"vendor":"Apple","count":47,"critical_count":0},{"vendor":"IBM","count":38,"critical_count":0},{"vendor":"python-pillow","count":25,"critical_count":0},{"vendor":"WordPress","count":21,"critical_count":1},{"vendor":"Red Hat","count":10,"critical_count":0},{"vendor":"MISP","count":8,"critical_count":0},{"vendor":"Microsoft","count":7,"critical_count":0},{"vendor":"WSO2","count":7,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":8,"new_cve_count":576,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-110936":{"anchor":"#dev-5","rank":5,"coverage":4},"CVE-2026-108097":{"anchor":"#dev-7","rank":7,"coverage":2}}}