{"date_iso":"2026-10-26","date_human":"Monday, October 26, 2026","generated_utc":"2026-10-26 12:57 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations","link":"https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Infosecurity Magazine","Proofpoint Threat Insight","The Hacker News"],"coverage":4,"cve_ids":[],"summary":"Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into\u2026","source":"The Hacker News","date_rel":"4h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKwJ8hpTcgaV_VMCyzQDPQQOPlZmmE3Fg-XAOrUfFazMKgVGEoT7OHQgWhyJLhCpHO6Hvp35u_YZGBfyGXAuJfpwP4BriicsNfvhPXjq4BzNyULVQPzNCWzmSIGnDLN7P2RNW2sfm15qZxLrVzpDg8FvOcGTZBhMsBFPH3IhiV1k3NdGAHFRC7kkKaOMMn/s1600/contoso.jpg","description":"Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across","related":[{"title":"Proofpoint Joins Microsoft Integrated Cloud Email Security (ICES) Ecosystem","link":"https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-joins-microsoft-integrated-cloud-email-security-ices-ecosystem","source":"Proofpoint Threat Insight","date_rel":"just now"},{"title":"Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw","link":"https://www.infosecurity-magazine.com/news/microsoft-patch-update-net-flaw/","source":"Infosecurity Magazine","date_rel":"11m ago"},{"title":"Microsoft Teams to get AI-powered, context-aware phishing detection","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/","source":"Bleeping Computer","date_rel":"23 Oct"},{"title":"Microsoft: Windows Server 2016 reaches end of support in January","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january/","source":"Bleeping Computer","date_rel":"23 Oct"}]},{"title":"Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)","link":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/","reason":"CVE-2026-109618","category":"Threat Intel","sources":["Bleeping Computer","CCCS Alerts & Advisories","Cisco Security Advisories","Palo Alto Unit 42"],"coverage":4,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.","source":"Palo Alto Unit 42","date_rel":"23 Oct","thumbnail":"https://unit42.paloaltonetworks.com/wp-content/uploads/2026/10/03_Vulnerabilities_1920x900.jpg","description":"","related":[{"title":"PHP2Shell security flaws now sucessfully exploited in the wild","link":"https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/","source":"Bleeping Computer","date_rel":"3h ago"},{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"23 Oct"},{"title":"AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619","source":"CCCS Alerts & Advisories","date_rel":"23 Oct"}]},{"title":"HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow","link":"https://cybersecuritynews.com/http2shell-vulnerability/","reason":"CVE-2026-111497","category":"News","sources":["Cyber Security News","Microsoft Security","Wiz Research"],"coverage":3,"cve_ids":["CVE-2026-111497"],"summary":"The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and\u2026","source":"Cyber Security News","date_rel":"6h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/HTTP2Shell-Vulnerability-Extends-Beyond-HTTP-Affecting-.NET-FFmpeg-ClickHouse-and-Apache-Arrow.webp","description":"The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan traced CVE-2026-111497 through several software stacks. Their findings describe crashes, memory corruption, and an endless decoding loop, depending on how\u2026","related":[{"title":"Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability","link":"https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js","source":"Wiz Research","date_rel":"22h ago"},{"title":"CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497","source":"Microsoft Security","date_rel":"22h ago"}]},{"title":"Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs","link":"https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html","reason":"Github","category":"News","sources":["SecurityWeek","The Hacker News","Wiz Research"],"coverage":3,"cve_ids":[],"summary":"An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have\u2026","source":"The Hacker News","date_rel":"5h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipCbP2hnS9ddXqMz9cNIAMEQZWy2qX45MZnYfIuO_Zszamhl_FS7ViRp4CZcjHS6uu6A4jR_S4vBzHzoMNtAb0CbaGxHxj2F07wuKWHfSbsFUov-4dsQWUNJZwfGbnfThW1sAQZ61y5ibqyhlW1iBmbWeSwE1gKHsigRRXaql9P96aFANb3al6vno7fuA/s1600/github-secrets.jpg","description":"An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses","related":[{"title":"Mythos 5 Ignored Real-World Harm in July Attack","link":"https://www.securityweek.com/mythos-5-ignored-real-world-harm-in-july-attack/","source":"SecurityWeek","date_rel":"3h ago"},{"title":"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles","link":"https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","source":"Wiz Research","date_rel":"19h ago"},{"title":"Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline","link":"https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html","source":"The Hacker News","date_rel":"24 Oct"}]},{"title":"Patient records exposed in Quest breach: What you need to know","link":"https://www.malwarebytes.com/blog/data-breaches/2026/10/patient-records-exposed-in-quest-breach-what-you-need-to-know","reason":"Patient Records Exposed","category":"Threat Intel","sources":["Bleeping Computer","Malwarebytes Labs"],"coverage":2,"cve_ids":[],"summary":"Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US\u2026","source":"Malwarebytes Labs","date_rel":"1h ago","thumbnail":"","description":"Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records. Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in areas such as cancer, infectious diseases, and neurology. What happened and what was stolen? The company learned of unauthorized access to its Quanum Lab Services Manager, or LSM, on\u2026","related":[{"title":"Quest Diagnostics confirms data breach exposed patient records","link":"https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/","source":"Bleeping Computer","date_rel":"23 Oct"}]},{"title":"Kali Linux 2026.3 Released With 6 New Penetration Testing Tools and Linux Kernel 7.1","link":"https://cybersecuritynews.com/kali-linux-2026-3-released/","reason":"Linux","category":"News","sources":["Bleeping Computer","Cyber Security News"],"coverage":2,"cve_ids":[],"summary":"Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Kali-Linux-2026.3-Released.webp","description":"Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter changes. The release arrived on October 26 with 126 package updates and moves the kernel from version 6.19 to 7.1.5. The update follows June\u2019s Kali Linux 2026.2 release , which added nine tools, changed Kali\u2019s APT source format, and improved virtual machine boot times. It also continues the tool and mobile testing work seen in Kali Linux 2026.1 , the first major Kali update of\u2026","related":[{"title":"Kali Linux 2026.3 released with 6 new tools, desktop updates","link":"https://www.bleepingcomputer.com/news/linux/kali-linux-20263-released-with-6-new-tools-desktop-updates/","source":"Bleeping Computer","date_rel":"2h ago"}]},{"title":"Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software","link":"https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html","reason":"Google","category":"News","sources":["SecurityWeek","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to\u2026","source":"The Hacker News","date_rel":"24 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxIIerJT3LOMCGn3nXAnmhaHzJlJnVJCso1COluq8t3WuF4IpNARa_Asl5nEhRUDTEcR89kwzo5vGmP5IyNbj1ncdaCpkhqcHUODHAd3khanaE-7N8Vb0NyEJkmPmNkhSpJtLCLgi9srDRhZLtM5n8UDI58F797ZJaVzC7JzjPLfca4NpxZr_7tCX8RIk/s1600/br-nodejs.jpg","description":"A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory,","related":[{"title":"Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages","link":"https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/","source":"SecurityWeek","date_rel":"2h ago"},{"title":"Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads","link":"https://thehackernews.com/2026/10/google-says-gmail-and-photos-data.html","source":"The Hacker News","date_rel":"24 Oct"}]},{"title":"uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts","link":"https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html","reason":"Android","category":"News","sources":["Cyber Security News","The Hacker News"],"coverage":2,"cve_ids":["CVE-2026-80097"],"summary":"A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these\u2026","source":"The Hacker News","date_rel":"3h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdBBtFdo2KmBzapUDlLWoS0hh17lYfWUw0kOLWTfbgeNOTP5F5pEJPmWSzBHkjSv4HR-vwfJ-Ba38Tg_su11Zi4CDKXJ29BnlQdCrU-oU84jl7TAET_aPyWV2fRazSLy0hBz8sBP3EhFubGETPdPwpnAFAX0CSbEQfsA65JqQMob9R_4cPbbJRi91KAkY/s1600/telegram-wechat.jpg","description":"A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor","related":[{"title":"Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions","link":"https://cybersecuritynews.com/microsoft-authenticator-flaw/","source":"Cyber Security News","date_rel":"6h ago"}]},{"title":"BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations","link":"https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html","reason":"Windows","category":"News","sources":["Microsoft Security","The Hacker News"],"coverage":2,"cve_ids":["CVE-2026-102208","CVE-2026-83862"],"summary":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan\u2026","source":"The Hacker News","date_rel":"23 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0cTK7D5hQFR-3qGTicTlfi6_CbnMIgCJWIojDeXmZr91hrIPqhhxZ72mAsnB6kBOcCdscZOL_VN8RhAdYIxq3d128rkaDweIApSaV5w3IzB1YGN3XNnlarG0IKN5VuDJy_RnPBxXZoKQ1Yh950YFNz-b_pbvEY_QlQa5Tr-BP4366UgkGIg968J-QEN1M/s1600/uefi.jpg","description":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report","related":[{"title":"CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83862","source":"Microsoft Security","date_rel":"23 Oct"},{"title":"CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102208","source":"Microsoft Security","date_rel":"23 Oct"}]},{"title":"Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","link":"https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html","reason":"Fortinet","category":"News","sources":["CCCS Alerts & Advisories","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this\u2026","source":"The Hacker News","date_rel":"23 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSk-Q06Dd5YyYmXWMt9b860DzGRKbTae_QwvoZDKNICaEznAj2AUurJmv6vPnpcH7qqDjauFZWWx7GX1RN93BLaU9Rqgiqe9j1iQRg2Vqcz3HpSqgesA6oS-GrMTyx4CTzwOD7C_z205k57ZpT70Gv4RXi-65X-nyI04wpA3raJ5nh46pN5ox42cyLnHjv/s1600/1000117358.jpg","description":"Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,","related":[{"title":"Fortinet security advisory (AV26-1081)","link":"https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1081","source":"CCCS Alerts & Advisories","date_rel":"23 Oct"},{"title":"Fortinet security advisory (AV26-1037) - Update 1","link":"https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-1037","source":"CCCS Alerts & Advisories","date_rel":"23 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-116207","vendor":"Oracle","product":"yeswiki","severity":"CRITICAL","score":9.1,"description":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar ent\u2026","cwe":"CWE-89","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","fix":false,"fix_url":"","refs":["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh","https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877","https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116207"},{"id":"CVE-2026-116068","vendor":"Dokploy","product":"dokploy","severity":"HIGH","score":8.8,"description":"Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like sav\u2026","cwe":"CWE-639","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/Dokploy/dokploy","https://github.com/Dokploy/dokploy/blob/073713f0b863eca4285ad24db00550af1b39397a/apps/dokploy/server/api/routers/application.ts#L490-L501","https://github.com/Dokploy/dokploy/blob/073713f0b863eca4285ad24db00550af1b39397a/packages/server/src/services/permission.ts#L244-L261"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116068"},{"id":"CVE-2026-116201","vendor":"grokability","product":"snipe-it","severity":"HIGH","score":8.8,"description":"Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs\u2026","cwe":"CWE-294","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/grokability/snipe-it/security/advisories/GHSA-w49g-f2jc-qxhg","https://www.vulncheck.com/advisories/snipe-it-before-8.5.0-saml-assertion-replay-via-race-condition"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116201"},{"id":"CVE-2026-116067","vendor":"ananthakumaran","product":"paisa","severity":"HIGH","score":8.2,"description":"Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attac\u2026","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","fix":false,"fix_url":"","refs":["https://github.com/ananthakumaran/paisa","https://github.com/ananthakumaran/paisa/blob/v0.7.7/internal/server/editor.go#L49-L70","https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116067"},{"id":"CVE-2026-116176","vendor":"vllm-project","product":"vllm","severity":"HIGH","score":8.2,"description":"vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill\u2026","cwe":"CWE-918","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","fix":false,"fix_url":"","refs":["https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6","https://www.vulncheck.com/advisories/vllm-0.9.2-before-0.24.0-ssrf-via-x-request-id-in-p2pncclconnector"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116176"},{"id":"CVE-2026-116211","vendor":"YesWiki","product":"yeswiki","severity":"HIGH","score":8.2,"description":"YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on def\u2026","cwe":"CWE-89","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","fix":false,"fix_url":"","refs":["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx","https://www.vulncheck.com/advisories/yeswiki-4.5.0-before-4.7.0-sql-injection-via-date-maj-fiche-in-bazar-entry-create"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116211"},{"id":"CVE-2026-116116","vendor":"Yoosee","product":"GM8135S Camera","severity":"HIGH","score":8.2,"description":"A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be a\u2026","cwe":"CWE-345","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://akosibrylle.me/writeups/yoosee-cve","https://vuldb.com/cve/CVE-2026-116116","https://vuldb.com/submit/1004712"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116116"},{"id":"CVE-2026-116149","vendor":"ImageMagick","product":"ImageMagick","severity":"HIGH","score":8.1,"description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, \u2026","cwe":"CWE-121","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj","https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116149"},{"id":"CVE-2026-116199","vendor":"grokability","product":"snipe-it","severity":"HIGH","score":8.1,"description":"Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email\u2026","cwe":"CWE-285","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/grokability/snipe-it/security/advisories/GHSA-xf36-wx48-5rqp","https://www.vulncheck.com/advisories/snipe-it-before-8.6.3-authentication-bypass-via-google-sso-callback"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116199"},{"id":"CVE-2026-116204","vendor":"YesWiki","product":"yeswiki","severity":"HIGH","score":8.1,"description":"YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can \u2026","cwe":"CWE-352","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72","https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-csrf-via-despam-admin-action"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116204"}],"vendor_spikes":[{"vendor":"ImageMagick","count":21,"critical_count":0},{"vendor":"Unknown","count":16,"critical_count":0},{"vendor":"vllm-project","count":10,"critical_count":0},{"vendor":"rclone","count":10,"critical_count":0},{"vendor":"YesWiki","count":7,"critical_count":0},{"vendor":"parse-community","count":5,"critical_count":0},{"vendor":"siyuan-note","count":5,"critical_count":0},{"vendor":"Microsoft","count":5,"critical_count":0},{"vendor":"grokability","count":4,"critical_count":0},{"vendor":"SourceCodester","count":4,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":10,"new_cve_count":135,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-109618":{"anchor":"#dev-2","rank":2,"coverage":4},"CVE-2026-109619":{"anchor":"#dev-2","rank":2,"coverage":4},"CVE-2026-111497":{"anchor":"#dev-3","rank":3,"coverage":3},"CVE-2026-80097":{"anchor":"#dev-8","rank":8,"coverage":2},"CVE-2026-102208":{"anchor":"#dev-9","rank":9,"coverage":2},"CVE-2026-83862":{"anchor":"#dev-9","rank":9,"coverage":2}}}