{"date_iso":"2026-10-25","date_human":"Sunday, October 25, 2026","generated_utc":"2026-10-25 12:57 UTC","read_minutes":6,"patch_tuesday":false,"top_stories":[{"title":"Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations","link":"https://cybersecuritynews.com/microsoft-teams-ai-detection/","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News","Dark Reading","Huntress","Infosecurity Magazine"],"coverage":5,"cve_ids":[],"summary":"Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations\u2026","source":"Cyber Security News","date_rel":"6h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Microsoft-Teams-AI-Detection.webp","description":"Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations with external contacts, where attackers can pose as trusted support staff and ask employees to share sensitive information. Microsoft detailed the change in Message Center notice MC1519866 , published on October 21, 2026. Targeted Release is scheduled to begin in early November and finish by mid-November. Worldwide general availability is expected to start in early December and\u2026","related":[{"title":"Microsoft Teams to get AI-powered, context-aware phishing detection","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/","source":"Bleeping Computer","date_rel":"23 Oct"},{"title":"Microsoft: Windows Server 2016 reaches end of support in January","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january/","source":"Bleeping Computer","date_rel":"23 Oct"},{"title":"AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack","link":"https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack","source":"Dark Reading","date_rel":"23 Oct"},{"title":"Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise","link":"https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/","source":"Infosecurity Magazine","date_rel":"23 Oct"},{"title":"Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack","link":"https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack","source":"Dark Reading","date_rel":"22 Oct"},{"title":"M365 Token Spray and Replay Campaign Compromises Business Email Accounts","link":"https://www.huntress.com/blog/token-replay-spray","source":"Huntress","date_rel":"22 Oct"}]},{"title":"Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products","link":"https://cybersecuritynews.com/palo-alto-confirms-php-rce-vulnerabilities/","reason":"CVE-2026-109618","category":"News","sources":["CCCS Alerts & Advisories","Cisco Security Advisories","Cyber Security News","Palo Alto Unit 42"],"coverage":4,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have\u2026","source":"Cyber Security News","date_rel":"24 Oct","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Palo-Alto-Confirms-PHP-RCE-Vulnerabilities.webp","description":"Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell . PHP RCE Vulnerabilities Both flaws involve PHP\u2019s\u2026","related":[{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"23 Oct"},{"title":"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)","link":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","source":"Palo Alto Unit 42","date_rel":"23 Oct"},{"title":"AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619","source":"CCCS Alerts & Advisories","date_rel":"23 Oct"}]},{"title":"Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline","link":"https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html","reason":"Github","category":"News","sources":["Bleeping Computer","Cyber Security News","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python\u2026","source":"The Hacker News","date_rel":"24 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipiDo2Yur6TXZHLped9EQgORAH65rC4APGTaq_EZzlDnspAaULTQCKblBC0FeIah7nOCKTiQa2Oi8cyx-bbxHj042Km9oYAf2s78XmStFxzPBTSQ_oqv4ZcWGEkUP1wo5JfJ1UDrWQpAtz8ZHd9i3ZbGWWe8s6CMeUU_nObp5tCEywMWGovqFh9NA1H8Sv/s1600/lite.jpg","description":"LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. \"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of","related":[{"title":"Anthropic\u2019s Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers","link":"https://cybersecuritynews.com/claude-mythos-5-inject-malicious-code/","source":"Cyber Security News","date_rel":"24 Oct"},{"title":"LiteLLM Compromised in Fresh Supply Chain Attack","link":"https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/","source":"SecurityWeek","date_rel":"23 Oct"},{"title":"Machine speed attacks require machine speed detection and response","link":"https://www.bleepingcomputer.com/news/security/machine-speed-attacks-require-machine-speed-detection-and-response/","source":"Bleeping Computer","date_rel":"22 Oct"}]},{"title":"BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations","link":"https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html","reason":"Windows","category":"News","sources":["Microsoft Security","The Hacker News"],"coverage":2,"cve_ids":["CVE-2026-102208","CVE-2026-83862"],"summary":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan\u2026","source":"The Hacker News","date_rel":"23 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0cTK7D5hQFR-3qGTicTlfi6_CbnMIgCJWIojDeXmZr91hrIPqhhxZ72mAsnB6kBOcCdscZOL_VN8RhAdYIxq3d128rkaDweIApSaV5w3IzB1YGN3XNnlarG0IKN5VuDJy_RnPBxXZoKQ1Yh950YFNz-b_pbvEY_QlQa5Tr-BP4366UgkGIg968J-QEN1M/s1600/uefi.jpg","description":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report","related":[{"title":"CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83862","source":"Microsoft Security","date_rel":"23 Oct"},{"title":"CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102208","source":"Microsoft Security","date_rel":"23 Oct"}]},{"title":"Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands","link":"https://cybersecuritynews.com/okta-access-gateway-flaw/","reason":"Okta","category":"News","sources":["Cyber Security News","Wiz Research"],"coverage":2,"cve_ids":["CVE-2026-115547"],"summary":"Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance\u2019s Admin Console. Tracked as CVE-2026-115547, the vulnerability\u2026","source":"Cyber Security News","date_rel":"23 Oct","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Critical-Okta-Access-Gateway-Flaw-Lets-Attackers-With-Admin-Access-Execute-System-Commands.webp","description":"Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance\u2019s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values. An attacker with administrative access can use those values to trigger command execution under the OAG service account. The disclosure does not describe an\u2026","related":[{"title":"ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors","link":"https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors","source":"Wiz Research","date_rel":"22 Oct"}]},{"title":"Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","link":"https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html","reason":"Fortinet","category":"News","sources":["CCCS Alerts & Advisories","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this\u2026","source":"The Hacker News","date_rel":"23 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSk-Q06Dd5YyYmXWMt9b860DzGRKbTae_QwvoZDKNICaEznAj2AUurJmv6vPnpcH7qqDjauFZWWx7GX1RN93BLaU9Rqgiqe9j1iQRg2Vqcz3HpSqgesA6oS-GrMTyx4CTzwOD7C_z205k57ZpT70Gv4RXi-65X-nyI04wpA3raJ5nh46pN5ox42cyLnHjv/s1600/1000117358.jpg","description":"Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,","related":[{"title":"Fortinet security advisory (AV26-1081)","link":"https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1081","source":"CCCS Alerts & Advisories","date_rel":"23 Oct"},{"title":"Fortinet security advisory (AV26-1037) - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","source":"CCCS Alerts & Advisories","date_rel":"23 Oct"}]},{"title":"Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws","link":"https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html","reason":"Gitlab","category":"News","sources":["The Hacker News","The Register Security"],"coverage":2,"cve_ids":[],"summary":"Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past\u2026","source":"The Hacker News","date_rel":"23 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA5n8ST_yuElQgTwbfq1oFnVAoiTvZCW_Ct1b8lT_OQ9dnyeXfocrqzTUJJ1t920YaEa-7Sonxl9KlthV4x7lXI3dmJxc9_S11NjWRJ6dcgfsX4UGhv0KFWZsZrzXKpjh92JPyDdHPlCPQh1AHd0YKM44sVcc9d-57r8_BdrIb3V06MWfk8bRAy4kDU6I/s1600/ruby-rce.jpg","description":"Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any","related":[{"title":"ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More","link":"https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html","source":"The Hacker News","date_rel":"22 Oct"},{"title":"Max-severity GitLab bug allows remote code execution over 12 years of releases","link":"https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854","source":"The Register Security","date_rel":"22 Oct"}]},{"title":"Quest Diagnostics confirms data breach exposed patient records","link":"https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/","reason":"Diagnostics Exposed Records","category":"News","sources":["Bleeping Computer","SecurityWeek"],"coverage":2,"cve_ids":[],"summary":"American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.","source":"Bleeping Computer","date_rel":"23 Oct","thumbnail":"","description":"","related":[{"title":"Quest Diagnostics Data Breach Exposed \u2018Certain Patient Records\u2019","link":"https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records/","source":"SecurityWeek","date_rel":"23 Oct"}]},{"title":"Atlassian Patches 75 Flaws in Data Center and Server Products","link":"https://www.securityweek.com/atlassian-patches-75-third-party-flaws-in-data-center-and-server-products/","reason":"Atlassian","category":"News","sources":["CCCS Alerts & Advisories","SecurityWeek"],"coverage":2,"cve_ids":[],"summary":"Atlassian\u2019s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.","source":"SecurityWeek","date_rel":"23 Oct","thumbnail":"","description":"","related":[{"title":"Atlassian security advisory (AV26-1076)","link":"https://cyber.gc.ca/en/alerts-advisories/atlassian-security-advisory-av26-1076","source":"CCCS Alerts & Advisories","date_rel":"22 Oct"}]},{"title":"Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches","link":"https://www.theregister.com/columnists/2026/10/23/torvalds-ai-is-fine-for-competent-devs-but-spare-us-the-drive-by-patches/5304357","reason":"Linux","category":"News","sources":["The Hacker News","The Register Security"],"coverage":2,"cve_ids":[],"summary":"Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as \"Linus\u2026","source":"The Register Security","date_rel":"23 Oct","thumbnail":"https://image.theregister.com/?imageId=5226908&width=800","description":"Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as \"Linus Torvalds Turns to Slop.\" In the podcast Pivot to AI, podcaster David Gerard agreed: \"Linux kernel goes full AI slop code.\" Meanwhile, in the Tom's Hardware comments section, commenter \"LordVile\" wrote: \"This is a publicity stunt from his AI overlords [The Linux Foundation] who pay his wage.\" They followed this by saying this is the \"same reason he's flipped-flopped on AI.\" I've\u2026","related":[{"title":"Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes","link":"https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html","source":"The Hacker News","date_rel":"22 Oct"}]}],"worth_reading":[{"title":"Hackers got a four-day head start on epic PHP2Shell vulnerability","link":"https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/","reason":"Amazon","category":"Media","sources":["Ars Technica Security","Bleeping Computer"],"coverage":2,"cve_ids":[],"summary":"Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being \u201cbroadly exploited\u201d as governments and companies rush to secure their systems\u2026","source":"Ars Technica Security","date_rel":"22 Oct","thumbnail":"https://cdn.arstechnica.net/wp-content/uploads/2022/03/internet-routing-500x500.jpeg","description":"Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being \u201cbroadly exploited\u201d as governments and companies rush to secure their systems. The world\u2019s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were \u201cnow being broadly exploited in the wild.\u201d Read full article Comments","related":[{"title":"Amazon says PHP2Shell exploitation began 4 days before patches","link":"https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/","source":"Bleeping Computer","date_rel":"22 Oct"}]}],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-115933","vendor":"GitroomHQ","product":"postiz-app","severity":"CRITICAL","score":9.9,"description":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request it\u2026","cwe":"CWE-290","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gadvisory.org/advisories/PSA-2026-YT2HMH","https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115933"},{"id":"CVE-2026-114196","vendor":"paytiumsupport","product":"Paytium","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0056,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/paytium/vulnerability/wordpress-paytium-plugin-5-0-5-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-114196"},{"id":"CVE-2026-94075","vendor":"Microsoft","product":"Newsletters","severity":"CRITICAL","score":9.8,"description":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0056,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-php-object-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-94075"},{"id":"CVE-2026-115932","vendor":"GitroomHQ","product":"postiz-app","severity":"CRITICAL","score":9.6,"description":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a pos\u2026","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://gadvisory.org/advisories/PSA-2026-E9AHFV","https://github.com/gitroomhq/postiz-app","https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115932"},{"id":"CVE-2026-115995","vendor":"Unitree Robotics","product":"Unitree Go2","severity":"CRITICAL","score":9.6,"description":"A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to \u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://unitree-firmware.oss-cn-hangzhou.aliyuncs.com/firmware/release/package_1.1.11.5_GO2_Edu_Max_Pro_X_1761128358872.upk","https://vuldb.com/cve/CVE-2026-115995","https://vuldb.com/submit/990502"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115995"},{"id":"CVE-2026-111402","vendor":"Microsoft","product":"Newsletters","severity":"CRITICAL","score":9.3,"description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.","cwe":"CWE-89","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.004,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-111402"},{"id":"CVE-2026-112866","vendor":"WPFactory","product":"Product Filter by WBW","severity":"CRITICAL","score":9.3,"description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3\u2026","cwe":"CWE-89","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.004,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","fix":false,"fix_url":"","refs":["https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-4-6-sql-injection-vulnerability?_s_id=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-112866"},{"id":"CVE-2026-114820","vendor":"Oracle","product":"Oracle Java SE","severity":"CRITICAL","score":9.1,"description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17\u2026","cwe":"CWE-327","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-114820"},{"id":"CVE-2026-110018","vendor":"WordPress","product":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","severity":"HIGH","score":8.8,"description":"The aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builde\u2026","cwe":"CWE-269","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L345","https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L353","https://plugins.trac.wordpress.org/browser/ablocks/tags/2.16.0/includes/api/form-builder-controller.php#L685"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110018"},{"id":"CVE-2026-116009","vendor":"owen2345","product":"camaleon-cms","severity":"HIGH","score":8.8,"description":"Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_\u2026","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5","https://github.com/owen2345/camaleon-cms/blob/2.9.2/app/helpers/camaleon_cms/uploader_helper.rb#L277-L287","https://github.com/owen2345/camaleon-cms/commit/430cce27ea63a397a7b7fa0260b4ec2128ea63fd"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116009"}],"vendor_spikes":[{"vendor":"WordPress","count":16,"critical_count":0},{"vendor":"Unknown","count":7,"critical_count":0},{"vendor":"YunaiV","count":4,"critical_count":0},{"vendor":"CervantesSec","count":3,"critical_count":0},{"vendor":"Travisun","count":3,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":13,"new_cve_count":79,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-109618":{"anchor":"#dev-2","rank":2,"coverage":4},"CVE-2026-109619":{"anchor":"#dev-2","rank":2,"coverage":4},"CVE-2026-102208":{"anchor":"#dev-4","rank":4,"coverage":2},"CVE-2026-83862":{"anchor":"#dev-4","rank":4,"coverage":2},"CVE-2026-115547":{"anchor":"#dev-5","rank":5,"coverage":2}}}