{"date_iso":"2026-10-21","date_human":"Wednesday, October 21, 2026","generated_utc":"2026-10-21 12:56 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Microsoft Offers $40,000 for Complete Azure Vulnerability Reports, Just $4,000 for Incomplete Ones","link":"https://cybersecuritynews.com/microsoft-new-report-assessment/","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cisco Talos","Cyber Security News","Dark Reading","Huntress","Infosecurity Magazine","Sophos Threat Research","Tenable Blog"],"coverage":8,"cve_ids":[],"summary":"Microsoft has introduced a new report-assessment system across its bug bounty programs , making the evidence security researchers submit a key factor in their rewards. Under the Azure bounty program, eligible critical\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Microsoft-Offers-40000-for-Complete-Azure-Vulnerability-Reports-Just-4000-for-Incomplete-Ones.webp","description":"Microsoft has introduced a new report-assessment system across its bug bounty programs , making the evidence security researchers submit a key factor in their rewards. Under the Azure bounty program, eligible critical remote code execution and privilege escalation reports can earn $40,000 when assessed as Complete, compared with $4,000 when marked Not Complete. The change applies to reports submitted from October 20, 2026, at 8 AM Pacific Time. Earlier submissions remain subject to the previous report quality requirements. Microsoft says the update aims to reduce requests for missing details\u2026","related":[{"title":"Microsoft PowerToys adds CursorHide, Button Lock mouse tools","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-powertoys-adds-cursorhide-button-lock-mouse-tools/","source":"Bleeping Computer","date_rel":"35m ago"},{"title":"Microsoft says October updates didn\u2019t actually fix VPN issues","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-didnt-actually-fix-vpn-issues-caused-by-windows-updates/","source":"Bleeping Computer","date_rel":"2h ago"},{"title":"Microsoft Unveils New OneDrive Command-Line Tool to Manage Sync Deployments","link":"https://cybersecuritynews.com/onedrive-command-line-tool/","source":"Cyber Security News","date_rel":"3h ago"},{"title":"There's only so much code: the rise in vulnerability numbers","link":"https://blog.talosintelligence.com/theres-only-so-much-code-the-rise-in-vulnerability-numbers/","source":"Cisco Talos","date_rel":"21h ago"},{"title":"Introducing ITDR Lookback: Find Out Who Was in Your Microsoft 365 Tenant Before You Were","link":"https://www.huntress.com/blog/managed-itdr-lookback-feature","source":"Huntress","date_rel":"23h ago"},{"title":"Identity Posture Assessment for Microsoft 365 | Managed ISPM","link":"https://www.huntress.com/blog/identity-posture-assessment-microsoft-365","source":"Huntress","date_rel":"23h ago"}]},{"title":"PHP2Shell Vulnerability Gets a Public PoC Exploit for Security Testing","link":"https://cybersecuritynews.com/php2shell-vulnerability/","reason":"CVE-2026-109618","category":"News","sources":["Cyber Security News","Huntress","SANS Internet Storm Center","SecurityWeek","Tenable Blog"],"coverage":5,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"A public proof-of-concept repository shares verification tools and a lab setup to test two critical PHP vulnerabilities known as php2shell. The flaws, tracked by researchers as CVE-2026-109618 and CVE-2026-109619, are\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/PHP2Shell-Vulnerability.webp","description":"A public proof-of-concept repository shares verification tools and a lab setup to test two critical PHP vulnerabilities known as php2shell. The flaws, tracked by researchers as CVE-2026-109618 and CVE-2026-109619, are reported to affect PHP\u2019s session.upload_progress feature and could lead to remote code execution under certain conditions. The release adds technical detail to a fast-moving security issue. PHP\u2019s security team announced that an emergency release would address two critical vulnerabilities, each rated 9.2 under CVSS v4.0, and urged users to prepare to upgrade. Its notice scheduled\u2026","related":[{"title":"Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)","link":"https://isc.sans.edu/diary/rss/33440","source":"SANS Internet Storm Center","date_rel":"11m ago"},{"title":"php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities","link":"https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote","source":"Tenable Blog","date_rel":"3h ago"},{"title":"PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws","link":"https://www.securityweek.com/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws/","source":"SecurityWeek","date_rel":"5h ago"},{"title":"Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)","link":"https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities","source":"Huntress","date_rel":"8h ago"}]},{"title":"From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage","link":"https://www.wiz.io/blog/from-phishing-to-llmjacking","reason":"Google","category":"Research","sources":["Infosecurity Magazine","Malwarebytes Labs","The Hacker News","Wiz Research"],"coverage":4,"cve_ids":[],"summary":"How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage","source":"Wiz Research","date_rel":"16h ago","thumbnail":"https://www.datocms-assets.com/75231/1792511853-4-1.png","description":"","related":[{"title":"Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software","link":"https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html","source":"The Hacker News","date_rel":"19h ago"},{"title":"Google may add your number to all your accounts: How to stop it","link":"https://www.malwarebytes.com/blog/mobile/2026/10/google-may-add-your-number-to-all-your-accounts-how-to-stop-it","source":"Malwarebytes Labs","date_rel":"20 Oct"},{"title":"AOMEI Backupper update servers hijacked to push malware: Check your PC","link":"https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc","source":"Malwarebytes Labs","date_rel":"19 Oct"},{"title":"OpenCode Breach Could Affect OpenAI, Anthropic and Google","link":"https://www.infosecurity-magazine.com/news/opencode-breach-openai-anthropic/","source":"Infosecurity Magazine","date_rel":"19 Oct"},{"title":"OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys","link":"https://thehackernews.com/2026/10/opencode-console-breach-may-have.html","source":"The Hacker News","date_rel":"19 Oct"}]},{"title":"Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic","link":"https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html","reason":"Windows","category":"News","sources":["CISA Alerts & Advisories","CISA ICS Advisories","Microsoft Security","SecurityWeek","The Hacker News"],"coverage":5,"cve_ids":["CVE-2026-70074","CVE-2026-83839","CVE-2026-96913"],"summary":"A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for\u2026","source":"The Hacker News","date_rel":"19 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAw5A6yrE0NkMreq5lBZaS4ndrFrorAZaVrjJ218aS1RcJoQVYOJOVejIn8rBH5RHIIZ_cpvtzHnQMwMMWVOFbpfcs01tolLCmlYAY3qy-onWaOUQhzB6H2VjlWaUgBCL_0vAjRB7VmumClnaiIxDds6j9wD3lt9vD-kptWl6bUft29O6Z0cTNgBQV6t76/s1600/npm-apex.jpg","description":"A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. \"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic","related":[{"title":"CVE-2026-96913 Windows Kernel Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96913","source":"Microsoft Security","date_rel":"22h ago"},{"title":"CVE-2026-70074 Windows DNS Information Disclosure Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70074","source":"Microsoft Security","date_rel":"22h ago"},{"title":"CVE-2026-83839 Windows Hyper-V Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83839","source":"Microsoft Security","date_rel":"22h ago"},{"title":"AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign","link":"https://www.securityweek.com/aomei-backupper-compromised-in-short-burst-supply-chain-campaign/","source":"SecurityWeek","date_rel":"23h ago"},{"title":"HMS Networks PEAK-System PCAN Windows drivers","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01","source":"CISA ICS Advisories","date_rel":"20 Oct"},{"title":"HMS Networks PEAK-System PCAN Windows drivers","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-01","source":"CISA Alerts & Advisories","date_rel":"20 Oct"}]},{"title":"CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws","link":"https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html","reason":"Siemens","category":"News","sources":["CCCS Alerts & Advisories","Infosecurity Magazine","The Hacker News"],"coverage":3,"cve_ids":["CVE-2026-110936"],"summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server\u2026","source":"The Hacker News","date_rel":"5h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiNWLuogjq0EVRQo6oTMUucF21anDW9Jpvs5w98qm-I6hOqH4fU1ZeHA1DqNilI_drxE548BnZD4vkXfB3KmWXAm4xfU3KU3j38LI-ZXhB03kZy4rWc9qiQqSED6vVjxihA1-uM_46qlXjjDchlvKmtgFG-ym3oosqXFEED6w2mG_Zb-yHjq4IIPcFDeX13/s1600/cisa-patch.jpg","description":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)","related":[{"title":"Siemens security advisory (AV26-1063) \u2013 Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/siemens-security-advisory-av26-1063","source":"CCCS Alerts & Advisories","date_rel":"16h ago"},{"title":"Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw","link":"https://www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/","source":"Infosecurity Magazine","date_rel":"20 Oct"},{"title":"ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan","link":"https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html","source":"The Hacker News","date_rel":"20 Oct"}]},{"title":"What Security Teams Can Do To Tame Wild Code","link":"https://thehackernews.com/2026/10/what-security-teams-can-do-to-tame-wild.html","reason":"Teams","category":"News","sources":["Dark Reading","Rapid7 Blog","The Hacker News","Wiz Research"],"coverage":4,"cve_ids":[],"summary":"A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon\u2026","source":"The Hacker News","date_rel":"20 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7Q3156iY5WJRnphGSZ5PuIiMopF0sG7ku3FR-WROda9fE4jCSIOQpClG1HOBRCvbuqDyLHgsC0N3UFjowgnXzZN4T1mDpkQbTz2gX7z4NRZsfoEpimVlZ7hevcXmeTfpOt1iFrHqvLXubegNIRz15gjlQNHIBBYzQVAmy8MNAGiZs6OXIEuWNntLwTlI/s1600/tines-main.jpg","description":"A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team\u2019s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them","related":[{"title":"Your Next Insider Threat Won\u2019t be Human: Securing AI Agents From the Outside in","link":"https://www.rapid7.com/blog/post/ai-inhuman-insider-threats-securing-agents","source":"Rapid7 Blog","date_rel":"19 Oct"},{"title":"Supply Chain Zero Days: Closing the Gap Between Publication and Detection","link":"https://www.wiz.io/blog/detect-supply-chain-zero-days-at-publication","source":"Wiz Research","date_rel":"19 Oct"},{"title":"The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience","link":"https://www.darkreading.com/vulnerabilities-threats/cybersecurity-lexicon-vulnerability-discovery-resilience","source":"Dark Reading","date_rel":"19 Oct"}]},{"title":"Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor","link":"https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html","reason":"Linux","category":"News","sources":["Microsoft Security","The Hacker News","The Register Security"],"coverage":3,"cve_ids":["CVE-2026-102204"],"summary":"Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher\u2026","source":"The Hacker News","date_rel":"19 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjF_Xo8mH5AxIDYx4hFrS1_uhblD0IoGUTo6bioM38mwy-whZAbcq1aaGeH1iZrS8nmk5Ow25NfX67HRXKiWFfzLc8C1A2zs2n948DwyW_NSSkowFDnEzxUofGxhNV72vTEWkgPmbO6XJyDUPwBR-lzSekj5_m8tY3JHjozUXETGEBg6GrLZrekhilW9W_R/s1600/plex-hack.jpg","description":"Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities","related":[{"title":"CVE-2026-102204 Windows Subsystem for Linux Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102204","source":"Microsoft Security","date_rel":"22h ago"},{"title":"Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking","link":"https://www.theregister.com/virtualization/2026/10/19/linux-kvm-guest-host-escape-rated-critical-may-represent-a-new-way-to-attack-penguin-powered-networking/5303744","source":"The Register Security","date_rel":"19 Oct"}]},{"title":"Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware","link":"https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html","reason":"Github","category":"News","sources":["Bleeping Computer","Hak5","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a\u2026","source":"The Hacker News","date_rel":"20 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSRX5Jjz6vqh8EcVVYoXU8S9qh0rFzQ3DDnjNIlkRrBq97brmk6hUw0u2pbLqyTAG1_mYfG9bGHCnMkgSMEPFu6fIR67F1jZMmS7G7-DFe6i7PtG_LzdTgHLCTXSwE5hCa2EApQeAIYGIMYATwbLEp-2FcPmV9aAHVqrRRBYk_wY7ZTuES0frFAPGjhnU/s1600/ovhcloud.jpg","description":"An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,","related":[{"title":"OVHcloud CLI releases backdoored on GitHub to steal developer secrets","link":"https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/","source":"Bleeping Computer","date_rel":"20 Oct"},{"title":"GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories","link":"https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html","source":"The Hacker News","date_rel":"19 Oct"},{"title":"Hackers Turned GitHub Against Its Own Users | Threat Wire","link":"https://www.youtube.com/watch?v=ANaZvokz4e8","source":"Hak5","date_rel":"18 Oct"},{"title":"\ud83c\udf4d\ud83d\udcdf New Deauth Attack for WPA3 - WiFi Pineapple Pager #pentesting #cybersecurity Aircrack-NG PR 2724","link":"https://www.youtube.com/shorts/g73zfXEf47U","source":"Hak5","date_rel":"18 Oct"}]},{"title":"DeepSeek deep-sixed at all US federal civilian agencies","link":"https://www.theregister.com/security/2026/10/20/deepseek-deep-sixed-at-all-us-federal-civilian-agencies/5304010","reason":"Civilian Agencies Deepseek","category":"News","sources":["Bleeping Computer","CyberScoop","The Register Security"],"coverage":3,"cve_ids":[],"summary":"The US Department of Homeland Security on Monday issued an order directing federal civilian agencies not to use technology products from Chinese AI lab DeepSeek, and to remove any existing implementations. The order\u2026","source":"The Register Security","date_rel":"20 Oct","thumbnail":"https://image.theregister.com/?imageId=5304014&width=800","description":"The US Department of Homeland Security on Monday issued an order directing federal civilian agencies not to use technology products from Chinese AI lab DeepSeek, and to remove any existing implementations. The order [PDF] is broad, as it requires agencies to ditch \"all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations.\" Complying will be tricky as it is not clear which third-party products and services have been developed using DeepSeek's wares. Nor is it clear whether \"developed using\" means providing ongoing access to\u2026","related":[{"title":"DHS bans DeepSeek products across US federal civilian agencies","link":"https://www.bleepingcomputer.com/news/security/dhs-bans-deepseek-products-across-us-federal-civilian-agencies/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"DHS to ban DeepSeek from federal civilian agencies","link":"https://cyberscoop.com/dhs-bans-deepseek-federal-agencies/","source":"CyberScoop","date_rel":"19 Oct"}]},{"title":"Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites","link":"https://thehackernews.com/2026/10/attackers-abuse-updraftcentral-keys-to.html","reason":"Wordpress","category":"News","sources":["Bleeping Computer","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites\u2026","source":"The Hacker News","date_rel":"3h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdsSYB_dpfRL3wD0MeCT_VyPyFJS8HjQAW0VuBHSTviFY4WBOQfa8MCP79qyJR3zYyMBesIXiCtL8XwwtjjLGm9Stxdv_qoIkf3_Rpc7YGFwZuzVS974TbuDfF5GkLRJX2DxFaDudlMlXSDyiZ8fvoVGaKaA-tpCr_eAvvEsfQr1uyfdBk-8KyK4aisYgC/s1600/wp-backdoor.jpg","description":"Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote","related":[{"title":"Stolen UpdraftCentral keys used to backdoor WordPress sites","link":"https://www.bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/","source":"Bleeping Computer","date_rel":"11h ago"},{"title":"Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor","link":"https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html","source":"The Hacker News","date_rel":"19 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-101809","vendor":"Oracle","product":"Workflow","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netw\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-101809"},{"id":"CVE-2026-81212","vendor":"IBM","product":"DataStage on Cloud Pak for Data","severity":"CRITICAL","score":10.0,"description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poi\u2026","cwe":"CWE-285","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://www.ibm.com/support/pages/node/7289603"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-81212"},{"id":"CVE-2026-87337","vendor":"Oracle","product":"Oracle Access Manager","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-87337"},{"id":"CVE-2026-91216","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91216"},{"id":"CVE-2026-91221","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91221"},{"id":"CVE-2026-91231","vendor":"Oracle","product":"Oracle SOA Suite","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with net\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91231"},{"id":"CVE-2026-91299","vendor":"Oracle","product":"JD Edwards EnterpriseOne Orchestrator","severity":"CRITICAL","score":10.0,"description":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthent\u2026","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-91299"},{"id":"CVE-2026-113744","vendor":"Tenda","product":"AC19","severity":"CRITICAL","score":10.0,"description":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argumen\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/henrythekingofuk/TendaCVE","https://vuldb.com/cve/CVE-2026-113744","https://vuldb.com/submit/1018542"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-113744"},{"id":"CVE-2026-105312","vendor":"Red Hat","product":"StreamsHub Console for Apache Kafka\u00ae","severity":"CRITICAL","score":9.9,"description":"A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding t\u2026","cwe":"CWE-269","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","fix":false,"fix_url":"","refs":["https://access.redhat.com/security/cve/CVE-2026-105312","https://bugzilla.redhat.com/show_bug.cgi?id=2510863"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-105312"},{"id":"CVE-2026-113389","vendor":"DrayTek","product":"Vigor2960","severity":"CRITICAL","score":9.9,"description":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectionty\u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection","https://vuldb.com/cve/CVE-2026-113389","https://vuldb.com/submit/992223"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-113389"}],"vendor_spikes":[{"vendor":"Oracle","count":1080,"critical_count":64},{"vendor":"Google","count":359,"critical_count":29},{"vendor":"WordPress","count":58,"critical_count":0},{"vendor":"apostrophecms","count":31,"critical_count":0},{"vendor":"totolink","count":30,"critical_count":30},{"vendor":"Eclipse Foundation","count":29,"critical_count":1},{"vendor":"triggerdotdev","count":28,"critical_count":0},{"vendor":"Advantech","count":24,"critical_count":0},{"vendor":"Unknown","count":23,"critical_count":1},{"vendor":"curl","count":23,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":13,"new_cve_count":1997,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-109618":{"anchor":"#dev-2","rank":2,"coverage":5},"CVE-2026-109619":{"anchor":"#dev-2","rank":2,"coverage":5},"CVE-2026-70074":{"anchor":"#dev-4","rank":4,"coverage":5},"CVE-2026-83839":{"anchor":"#dev-4","rank":4,"coverage":5},"CVE-2026-96913":{"anchor":"#dev-4","rank":4,"coverage":5},"CVE-2026-110936":{"anchor":"#dev-5","rank":5,"coverage":3},"CVE-2026-102204":{"anchor":"#dev-7","rank":7,"coverage":3}}}