{"date_iso":"2026-10-27","date_human":"Tuesday, October 27, 2026","generated_utc":"2026-10-27 12:56 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Microsoft releases out-of-band Windows fixes with certificate updates","link":"https://www.theregister.com/security/2026/10/27/microsoft-releases-out-of-band-windows-fixes-with-certificate-updates/5305637","reason":"Microsoft","category":"News","sources":["Bleeping Computer","CyberScoop","Elastic Security Labs","Huntress","Infosecurity Magazine","Proofpoint Threat Insight","The Hacker News","The Register Security"],"coverage":8,"cve_ids":[],"summary":"Microsoft has released another out-of-band update for Windows, but this one isn't an emergency fix for the latest breakages. This time, it's all about certificates. The non-security out-of-band release applies to\u2026","source":"The Register Security","date_rel":"26m ago","thumbnail":"https://image.theregister.com/?imageId=5302230&width=800","description":"Microsoft has released another out-of-band update for Windows, but this one isn't an emergency fix for the latest breakages. This time, it's all about certificates. The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10. It's all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft's certificate-update service, or where automatic CTL updates are disabled. It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break\u2026","related":[{"title":"Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens","link":"https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html","source":"The Hacker News","date_rel":"46m ago"},{"title":"What happens when security tools go dark before the ransomware","link":"https://cyberscoop.com/warlock-ransomware-storm-2603-sharepoint-attacks-op-ed/","source":"CyberScoop","date_rel":"2h ago"},{"title":"AI, Scripts, Operator: Inside the ConnectWise Attack","link":"https://www.huntress.com/blog/connectwise-attack-ai","source":"Huntress","date_rel":"17h ago"},{"title":"Proofpoint Joins Microsoft Integrated Cloud Email Security (ICES) Ecosystem","link":"https://www.proofpoint.com/us/newsroom/press-releases/proofpoint-joins-microsoft-integrated-cloud-email-security-ices-ecosystem","source":"Proofpoint Threat Insight","date_rel":"20h ago"},{"title":"Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware","link":"https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html","source":"The Hacker News","date_rel":"21h ago"},{"title":"Microsoft releases emergency .NET patches for critical Brotli flaw","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw/","source":"Bleeping Computer","date_rel":"21h ago"}]},{"title":"PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw","link":"https://thehackernews.com/2026/10/php-issues-second-windows-security.html","reason":"CVE-2026-111497","category":"News","sources":["CyberScoop","Microsoft Security","Rapid7 Blog","Tenable Blog","The Hacker News","Wiz Research"],"coverage":6,"cve_ids":["CVE-2026-111497"],"summary":"PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and\u2026","source":"The Hacker News","date_rel":"19h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWGYEqFaRxRywsWzBt-2T2G_Jpdp4zy3iV7qI1alNGRaBf_8TMdzRQQb335GhASkVoXD3q9mGkiLjAog4ez9d7DHhl88lkNVvuhI74KiKZP0zZpb2O8yyqyDw12WoYTiGaq1AVfG9TfGcdNhP-DmRwuKJ4Pj4mr9rEo-TVLYxYSpmUogJUSFZFL_VaduQ/s1600/php-windows.jpg","description":"PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but","related":[{"title":"Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)","link":"https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497","source":"Tenable Blog","date_rel":"11h ago"},{"title":"Experts temper emergency-level alarms over critical Brotli defect","link":"https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell/","source":"CyberScoop","date_rel":"12h ago"},{"title":"CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder","link":"https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder","source":"Rapid7 Blog","date_rel":"19h ago"},{"title":"Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability","link":"https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js","source":"Wiz Research","date_rel":"25 Oct"},{"title":"CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497","source":"Microsoft Security","date_rel":"25 Oct"}]},{"title":"Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE","link":"https://cybersecuritynews.com/apple-ios-27-2-released/","reason":"Apple","category":"News","sources":["404 Media","Bleeping Computer","Cyber Security News","SANS Internet Storm Center","SecurityWeek"],"coverage":5,"cve_ids":[],"summary":"Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of iPad models. The most serious issues sit in WebKit, the engine\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Apple-iOS-27.2-Released.webp","description":"Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of iPad models. The most serious issues sit in WebKit, the engine behind Safari and most in-app browsers on Apple devices. Apple says malicious web content could run code on a device. That is a remote code execution risk, and it is the reason this update should not wait. Apple published the full list in its security content document for iOS 27.2 and iPadOS 27.2 . The company does not report active use of these flaws in real attacks. That does not\u2026","related":[{"title":"iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18","link":"https://www.securityweek.com/ios-macos-27-2-patch-286-bugs-fix-for-exploited-flaw-backported-to-ios-18/","source":"SecurityWeek","date_rel":"1h ago"},{"title":"Apple backports CoreGraphics zero-day patches to older iPhones","link":"https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones/","source":"Bleeping Computer","date_rel":"2h ago"},{"title":"Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones","link":"https://cybersecuritynews.com/apple-fix-for-coregraphics-0-day-flaw/","source":"Cyber Security News","date_rel":"3h ago"},{"title":"Apple Patches for October 2026, (Mon, Oct 26th)","link":"https://isc.sans.edu/diary/rss/33458","source":"SANS Internet Storm Center","date_rel":"10h ago"},{"title":"iPhone Duo Users Are Already Seeing a Big Old Crease in the Middle of Their $2,000 Foldable iPhone","link":"https://www.404media.co/iphone-duo-crackgate-crease-folding-phone/","source":"404 Media","date_rel":"20h ago"}]},{"title":"PHP2Shell: No login, no app code, no warning. What next?","link":"https://www.theregister.com/security/2026/10/26/partner-content-no-login-no-app-code-no-warning-what-next/5305336","reason":"CVE-2026-109618","category":"News","sources":["Bleeping Computer","CISA Alerts & Advisories","Cisco Security Advisories","ESET WeLiveSecurity","Tenable Blog","The Register Security"],"coverage":6,"cve_ids":["CVE-2026-109618","CVE-2026-109619"],"summary":"If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed last week, CVE-2026-109618 and CVE-2026-109619 (nicknamed \"PHP2Shell\"), let an unauthenticated\u2026","source":"The Register Security","date_rel":"26 Oct","thumbnail":"https://image.theregister.com/?imageId=5305339&width=800","description":"If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed last week, CVE-2026-109618 and CVE-2026-109619 (nicknamed \"PHP2Shell\"), let an unauthenticated attacker run code on a server with nothing more than a crafted web request. Both carry a CVSS v4.0 score of 9.2, every earlier release is affected, and exploitation in the wild has been reported. The patch is the easy part. The hard part is finding every copy of PHP you own, because PHP rarely shows up where you expect it. This post covers what the flaws are, how far\u2026","related":[{"title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco Security Advisories","date_rel":"16h ago"},{"title":"Discover and remediate PHP2Shell exposure with Tenable","link":"https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable","source":"Tenable Blog","date_rel":"17h ago"},{"title":"PHP2Shell: What to know about two critical PHP flaws","link":"https://www.welivesecurity.com/en/videos/php2shell-what-know-two-critical-php-flaws/","source":"ESET WeLiveSecurity","date_rel":"23h ago"},{"title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA Alerts & Advisories","date_rel":"26 Oct"},{"title":"PHP2Shell security flaws now sucessfully exploited in the wild","link":"https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/","source":"Bleeping Computer","date_rel":"26 Oct"}]},{"title":"Worm armed 42 GitHub repos by hiding a payload too big to fail","link":"https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570","reason":"Github","category":"News","sources":["Dark Reading","Infosecurity Magazine","The Hacker News","The Register Security","Wiz Research"],"coverage":5,"cve_ids":[],"summary":"A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to\u2026","source":"The Register Security","date_rel":"14h ago","thumbnail":"https://image.theregister.com/?imageId=5242669&width=800","description":"A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers. Threat hunters at SafeDep, an open source supply chain security firm, first spotted the \u201ctestmetest\u201d npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the\u2026","related":[{"title":"LiteLLM supply chain attack started with an exposed master key","link":"https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544","source":"The Register Security","date_rel":"16h ago"},{"title":"'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets","link":"https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets","source":"Dark Reading","date_rel":"18h ago"},{"title":"Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens","link":"https://www.infosecurity-magazine.com/news/gheist-attackers-abuse-stolen/","source":"Infosecurity Magazine","date_rel":"21h ago"},{"title":"The Pwn Request Reckoning: What Still Works Against GitHub Actions","link":"https://www.wiz.io/blog/github-actions-security-pwn-request-reckoning","source":"Wiz Research","date_rel":"23h ago"},{"title":"Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs","link":"https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html","source":"The Hacker News","date_rel":"26 Oct"},{"title":"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles","link":"https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles","source":"Wiz Research","date_rel":"25 Oct"}]},{"title":"Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys","link":"https://cybersecuritynews.com/ai-pentesting-agents/","reason":"Teams","category":"News","sources":["Cyber Security News","Infosecurity Magazine"],"coverage":2,"cve_ids":[],"summary":"Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents\u2026","source":"Cyber Security News","date_rel":"1h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Hackers-Hijack-AI-Pentesting-Agents-to-Install-Backdoors-and-Steal-API-Keys.webp","description":"Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents goals and lets them work on their own. Once inside, the attackers push new tasks into those agents. These tasks install unauthorized SSH keys, download a remote access trojan, and search for stored API keys. The activity started on October 20, 2026, although some signs point to earlier probing. Cairn is built to make AI agents easy to run. A user defines a goal and a starting\u2026","related":[{"title":"Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes","link":"https://www.infosecurity-magazine.com/news/exploit-teams-chat-breach/","source":"Infosecurity Magazine","date_rel":"26m ago"}]},{"title":"DreamHost Forces Email and FTP Password Resets Following Unexplained Security Incident","link":"https://cybersecuritynews.com/dreamhost-forces-email-and-ftp-password-resets/","reason":"Unexplained Dreamhost Incident","category":"News","sources":["Cyber Security News","SecurityWeek"],"coverage":2,"cve_ids":[],"summary":"DreamHost forced password resets for affected email and FTP/SFTP accounts after an unexplained incident disrupted webmail and File Manager, preventing sign-ins until new credentials are set. DreamHost said the password\u2026","source":"Cyber Security News","date_rel":"4h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/DreamHost-Forces-Email-and-FTP-Password-Resets-Following-Unexplained-Security-Incident-1.webp","description":"DreamHost forced password resets for affected email and FTP/SFTP accounts after an unexplained incident disrupted webmail and File Manager, preventing sign-ins until new credentials are set. DreamHost said the password resets were precautionary but has not disclosed the cause or confirmed data theft. The incident began on October 23, 2026, with File Manager connectivity issues. Later updates reported webmail errors and expanded the password resets to FTP/SFTP users. By October 26 at 3:35 p.m. PDT, engineers had restored the File Manager. They monitored the fix, but password changes remained\u2026","related":[{"title":"Unexplained DreamHost Incident Prompts Email, FTP Password Resets","link":"https://www.securityweek.com/unexplained-dreamhost-incident-prompts-email-ftp-password-resets/","source":"SecurityWeek","date_rel":"54m ago"}]},{"title":"University of Copenhagen data breach exposes data of 525,000 people","link":"https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people/","reason":"Copenhagen University Breach","category":"News","sources":["Bleeping Computer","Infosecurity Magazine"],"coverage":2,"cve_ids":[],"summary":"The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.","source":"Bleeping Computer","date_rel":"14h ago","thumbnail":"","description":"","related":[{"title":"Copenhagen University Breach Compromises Data on Half a Million People","link":"https://www.infosecurity-magazine.com/news/copenhagen-university-data-breach/","source":"Infosecurity Magazine","date_rel":"1h ago"}]},{"title":"Microsoft releases emergency .NET security fixes for Google Brotli bug","link":"https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515","reason":"Google","category":"News","sources":["CCCS Alerts & Advisories","The Register Security"],"coverage":2,"cve_ids":[],"summary":"To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update \"as soon as possible\" after releasing an out-of-band\u2026","source":"The Register Security","date_rel":"18h ago","thumbnail":"https://image.theregister.com/?imageId=244699&width=800","description":"To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update \"as soon as possible\" after releasing an out-of-band (OOB) security update. It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from Node.js, Python, and other projects. Senior program manager Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft's advisory\u2026","related":[{"title":"Google security advisory (AV26-1085)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1085","source":"CCCS Alerts & Advisories","date_rel":"22h ago"}]},{"title":"Industrial Vendors Check Products for PHP2Shell Vulnerabilities","link":"https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/","reason":"Siemens","category":"News","sources":["CCCS Alerts & Advisories","SecurityWeek"],"coverage":2,"cve_ids":[],"summary":"Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities.","source":"SecurityWeek","date_rel":"22h ago","thumbnail":"","description":"","related":[{"title":"[Control Systems] Siemens security advisory (AV26-1083)","link":"https://cyber.gc.ca/en/alerts-advisories/control-systems-siemens-security-advisory-av26-1083","source":"CCCS Alerts & Advisories","date_rel":"23h ago"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-116508","vendor":"TOTOLINK","product":"A950RG","severity":"CRITICAL","score":10.0,"description":"A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CON\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/H3rmesk1t/ad72def4ccc232757d4cbabf45da72cb","https://vuldb.com/cve/CVE-2026-116508","https://vuldb.com/submit/1022557"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116508"},{"id":"CVE-2026-116231","vendor":"Oray","product":"Pugongying X5 Pro","severity":"CRITICAL","score":9.9,"description":"A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiat\u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0044,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-A-Serial-Banner-Newline-Lets-ser2net-Overwrite-Existing-Files-3ea797159f158019b687eadcc7d6a85b","https://vuldb.com/cve/CVE-2026-116231","https://vuldb.com/submit/1005078"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116231"},{"id":"CVE-2026-116232","vendor":"Oray","product":"Pugongying X5 Pro","severity":"CRITICAL","score":9.9,"description":"A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch t\u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":0.0044,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-A-Community-Newline-Makes-snmpd-Run-Commands-as-Root-3ea797159f1580f3bae8c6e7d8b91d1f","https://vuldb.com/cve/CVE-2026-116232","https://vuldb.com/submit/1005079"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116232"},{"id":"CVE-2026-115188","vendor":"Unknown","product":"","severity":"CRITICAL","score":9.9,"description":"An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without res\u2026","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-115188"},{"id":"CVE-2026-102649","vendor":"GitLab","product":"burrito","severity":"CRITICAL","score":9.9,"description":"Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it t\u2026","cwe":"CWE-306","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","fix":false,"fix_url":"","refs":["https://github.com/padok-team/burrito/commit/1d48432a4a0126429c99f5fa42567bf3711d1ca1","https://github.com/padok-team/burrito/releases/tag/v0.13.0","https://github.com/padok-team/burrito/security/advisories/GHSA-7m68-72r6-3jx8"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-102649"},{"id":"CVE-2026-110720","vendor":"HashiCorp","product":"Tooling","severity":"CRITICAL","score":9.9,"description":"Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in c\u2026","cwe":"CWE-863","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://discuss.hashicorp.com/t/hcsec-2026-50-consul-k8s-vulnerable-to-a-cross-namespace-authorization-bypass-in-component-acl-binding-rules/77915"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110720"},{"id":"CVE-2026-116504","vendor":"TOTOLINK","product":"A950RG","severity":"CRITICAL","score":9.9,"description":"A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to\u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948","https://vuldb.com/cve/CVE-2026-116504","https://vuldb.com/submit/1022553"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116504"},{"id":"CVE-2026-116506","vendor":"TOTOLINK","product":"A950RG","severity":"CRITICAL","score":9.9,"description":"A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been pub\u2026","cwe":"CWE-74","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://gist.github.com/H3rmesk1t/1046036a8601e93f375754e11307bfc8","https://vuldb.com/cve/CVE-2026-116506","https://vuldb.com/submit/1022555"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116506"},{"id":"CVE-2026-107092","vendor":"Unknown","product":"","severity":"CRITICAL","score":9.8,"description":"NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.","cwe":"","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["http://nexopos.com","https://github.com/raivenLockdown/CVE-2026-107092"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-107092"},{"id":"CVE-2026-107656","vendor":"Fortinet","product":"FortiSandbox","severity":"CRITICAL","score":9.8,"description":"An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox Paa\u2026","cwe":"CWE-288","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://fortiguard.fortinet.com/psirt/FG-IR-26-185"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-107656"}],"vendor_spikes":[{"vendor":"Apple","count":326,"critical_count":0},{"vendor":"Unknown","count":62,"critical_count":2},{"vendor":"WordPress","count":17,"critical_count":0},{"vendor":"Microsoft","count":17,"critical_count":1},{"vendor":"Openpanel-dev","count":14,"critical_count":0},{"vendor":"Apache","count":12,"critical_count":0},{"vendor":"boneIO","count":11,"critical_count":0},{"vendor":"mtrudel","count":10,"critical_count":0},{"vendor":"HashiCorp","count":9,"critical_count":1},{"vendor":"Linux","count":9,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":11,"new_cve_count":792,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-111497":{"anchor":"#dev-2","rank":2,"coverage":6},"CVE-2026-109618":{"anchor":"#dev-4","rank":4,"coverage":6},"CVE-2026-109619":{"anchor":"#dev-4","rank":4,"coverage":6}}}