{"date_iso":"2026-10-31","date_human":"Saturday, October 31, 2026","generated_utc":"2026-10-31 12:57 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Apple Warns iPhone Users in 99 Countries of Sophisticated Mercenary Spyware Attacks","link":"https://cybersecuritynews.com/apple-warns-iphone-users/","reason":"Apple","category":"News","sources":["404 Media","Bleeping Computer","CCCS Alerts & Advisories","Cyber Security News","CyberScoop","Malwarebytes Labs"],"coverage":6,"cve_ids":[],"summary":"Apple has issued a fresh round of threat notifications to selected iPhone users in 99 countries, warning that they have been targeted by sophisticated mercenary spyware attacks. Security researcher Costin Raiu reported\u2026","source":"Cyber Security News","date_rel":"9h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Apple-Warns-iPhone-Users.webp","description":"Apple has issued a fresh round of threat notifications to selected iPhone users in 99 countries, warning that they have been targeted by sophisticated mercenary spyware attacks. Security researcher Costin Raiu reported the new wave on October 30, 2026, saying it was separate from August\u2019s alerts and linked to new attacks. \u201cToday\u2019s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,\u201d Apple said in the notice shared by Raiu. The company did not name the attackers or connect the warnings to any specific region\u2026","related":[{"title":"Apple notifications alert victims in 99 countries about mercenary spyware infections","link":"https://cyberscoop.com/apple-spyware-notifications-pall-mall-process/","source":"CyberScoop","date_rel":"19h ago"},{"title":"Apple Is Entering Its Slop Era","link":"https://www.404media.co/apple-is-entering-its-slop-era/","source":"404 Media","date_rel":"30 Oct"},{"title":"Fake crypto app on Apple App Store linked to $23K wallet theft","link":"https://www.bleepingcomputer.com/news/security/fake-crypto-app-on-apple-app-store-linked-to-23k-wallet-theft/","source":"Bleeping Computer","date_rel":"29 Oct"},{"title":"Have an older iPhone or iPad? Apple has a security update for you","link":"https://www.malwarebytes.com/blog/bugs/2026/10/have-an-older-iphone-or-ipad-apple-has-a-security-update-for-you","source":"Malwarebytes Labs","date_rel":"29 Oct"},{"title":"Apple security advisory (AV26-1099)","link":"https://cyber.gc.ca/en/alerts-advisories/apple-security-advisory-av26-1099","source":"CCCS Alerts & Advisories","date_rel":"28 Oct"}]},{"title":"Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers","link":"https://www.theregister.com/security/2026/10/29/suspected-chinese-attackers-built-a-custom-php2shell-exploit-and-rooted-25-servers/5306456","reason":"Linux","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Tenable Security Advisories","The Hacker News","The Register Security","Zero Day Initiative"],"coverage":6,"cve_ids":["CVE-2026-98432"],"summary":"Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to\u2026","source":"The Register Security","date_rel":"29 Oct","thumbnail":"https://image.theregister.com/?imageId=5304691&width=800","description":"Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to Dream researchers. The snoops began exploiting these servers on October 23, targeting organizations across the US, Japan, Taiwan, and South Korea. The attackers also honed in on US government-affiliated firewalls. \u201cWithin hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell\u2026","related":[{"title":"Linux security advisory (AV26-1108)","link":"https://cyber.gc.ca/en/alerts-advisories/linux-security-advisory-av26-1108","source":"CCCS Alerts & Advisories","date_rel":"15h ago"},{"title":"Critical Linux kernel flaw allows remote root attacks on MPTCP servers","link":"https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/","source":"Bleeping Computer","date_rel":"15h ago"},{"title":"Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions","link":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html","source":"The Hacker News","date_rel":"29 Oct"},{"title":"ZDI-26-837: Linux Kernel XFRM Subsystem Use-After-Free Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-837/","source":"Zero Day Initiative","date_rel":"29 Oct"},{"title":"ZDI-26-836: Linux Kernel CIFS File System Use-After-Free Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-836/","source":"Zero Day Initiative","date_rel":"29 Oct"},{"title":"ZDI-26-835: Linux Kernel Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-835/","source":"Zero Day Initiative","date_rel":"29 Oct"}]},{"title":"Cursor Confirms Malicious Claude Code Extension With SSH Backdoor Was Available for 11 Hours","link":"https://cybersecuritynews.com/malicious-claude-code-extension-with-cursor/","reason":"Windows","category":"News","sources":["Cisco Talos","Cyber Security News","Microsoft Security"],"coverage":3,"cve_ids":["CVE-2026-62740","CVE-2026-62877"],"summary":"Cursor has confirmed that malicious Claude Code extension packages were available through its VS Code Extension Marketplace for roughly 11 hours on October 29, 2026. The altered packages targeted Windows and macOS users\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Cursor-Confirms-Malicious-Claude-Code-Extension.webp","description":"Cursor has confirmed that malicious Claude Code extension packages were available through its VS Code Extension Marketplace for roughly 11 hours on October 29, 2026. The altered packages targeted Windows and macOS users and attempted to install an SSH backdoor for lasting remote access. According to Cursor\u2019s security notice, the affected versions were Anthropic.claude-code 2.1.312 and 2.1.313. They were available between approximately 2:27 a.m. and 1:35 p.m. Pacific Time, a window of 11 hours and eight minutes. Cursor said Anthropic did not develop these malicious versions. The confirmation\u2026","related":[{"title":"APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments","link":"https://cybersecuritynews.com/netamloader-malware/","source":"Cyber Security News","date_rel":"21h ago"},{"title":"NIK C2: The new AI-enabled command-and-control framework","link":"https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/","source":"Cisco Talos","date_rel":"29 Oct"},{"title":"CVE-2026-62740 Windows Imaging Component Information Disclosure Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62740","source":"Microsoft Security","date_rel":"28 Oct"},{"title":"CVE-2026-62877 Windows Win32k Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62877","source":"Microsoft Security","date_rel":"28 Oct"}]},{"title":"Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access","link":"https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html","reason":"Ivanti","category":"News","sources":["CCCS Alerts & Advisories","CISA Alerts & Advisories","The Hacker News"],"coverage":3,"cve_ids":["CVE-2026-111357"],"summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active\u2026","source":"The Hacker News","date_rel":"4h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeqP4vPt6j2lLPFj77A_1OthmSKb8mItfBrX_q8sQCAUVgTry1FxKizDI2SCLS4CglfjgbVkaMDN8ainqoOZm2pdaF6xw7sU4STZhwIFPCLSz84YXQTVx2tquPo7YJsZhgOWcD3V_w5td9BA_vVuOu1cFcrgL3SXyLF4E24IyGotrzDcbJ-M1mA85biDuW/s1600/1000120841.jpg","description":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a","related":[{"title":"Ivanti security advisory (AV26-1035) - Update 2","link":"https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035","source":"CCCS Alerts & Advisories","date_rel":"18h ago"},{"title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA Alerts & Advisories","date_rel":"30 Oct"}]},{"title":"Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw","link":"https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html","reason":"Drupal","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","SecurityWeek","The Hacker News"],"coverage":4,"cve_ids":["CVE-2026-118539"],"summary":"Drupal has warned that threat actors are exploiting a \"highly critical\" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization\u2026","source":"The Hacker News","date_rel":"30 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitgPkf4uToEgXwcfmDEKipEveRL2l0PEz6WIegAc2uWyf5_khO7Scgu6MpWHRovED7S-4sKJb4o88JsJT8NI8zB8WCBo04Q9TrEVNJa-08EbxP_zdPkaA7wsBEPIjXbApW1StdY8JunSewAi9TNrAcMwYZjqSsVktddqQ0uIi8-rUzXq1LMMLBHBdccapz/s1600/drupal-rce.jpg","description":"Drupal has warned that threat actors are exploiting a \"highly critical\" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. \"This module enables you to sell goods and services to customers through an included shopping cart","related":[{"title":"Drupal security advisory (AV26-1105)","link":"https://cyber.gc.ca/en/alerts-advisories/drupal-security-advisory-av26-1105","source":"CCCS Alerts & Advisories","date_rel":"21h ago"},{"title":"Drupal Commerce Core Vulnerability Exploited Against Online Stores","link":"https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/","source":"SecurityWeek","date_rel":"30 Oct"},{"title":"Drupal warns of critical Commerce Core flaw exploited in attacks","link":"https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/","source":"Bleeping Computer","date_rel":"30 Oct"}]},{"title":"Google Launches Gemini 4 Carbon With State-Of-The-Art Cybersecurity Capabilities","link":"https://cybersecuritynews.com/google-launches-gemini-4-carbon/","reason":"Google","category":"News","sources":["CrowdStrike Blog","Cyber Security News","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"Google has announced Gemini 4 Carbon, its latest AI model built to find software flaws , test whether attackers could exploit them, and produce fixes. Unveiled on October 28, 2026, Carbon builds on Gemini 4 Argon and\u2026","source":"Cyber Security News","date_rel":"8h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/Google-launches-Gemini-4-Carbon-With-state-of-the-art-cybersecurity-Capabilities.webp","description":"Google has announced Gemini 4 Carbon, its latest AI model built to find software flaws , test whether attackers could exploit them, and produce fixes. Unveiled on October 28, 2026, Carbon builds on Gemini 4 Argon and targets complex security and coding work that can take days. Access will begin with selected cyber defenders, not a public launch. According to Google\u2019s announcement , Carbon combines stronger cybersecurity skills with improved handling of long tasks. Google says internal teams have seen it work through dead ends while tracing subtle bugs across large codebases and low-level\u2026","related":[{"title":"CrowdStrike Expands Falcon Adversary OverWatch Threat Hunting Across AI and Google Cloud","link":"https://www.crowdstrike.com/en-us/blog/crowdstrike-expands-threat-hunting-across-ai-and-google-cloud/","source":"CrowdStrike Blog","date_rel":"30 Oct"},{"title":"Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities","link":"https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html","source":"The Hacker News","date_rel":"29 Oct"}]},{"title":"Hackers steal $6.3 billion from Binance in record crypto heist","link":"https://arstechnica.com/security/2026/10/hackers-steal-6-3-billion-from-binance-in-record-crypto-heist/","reason":"Exchange","category":"Media","sources":["Ars Technica Security","Bleeping Computer","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"Binance has suspended all withdrawals after the world\u2019s largest cryptocurrency exchange fell victim to what appears to be the biggest heist in history. The exchange put the \u201cestimated total impact\u201d of the hack at about\u2026","source":"Ars Technica Security","date_rel":"23h ago","thumbnail":"https://cdn.arstechnica.net/wp-content/uploads/2026/10/binance-500x500.jpg","description":"Binance has suspended all withdrawals after the world\u2019s largest cryptocurrency exchange fell victim to what appears to be the biggest heist in history. The exchange put the \u201cestimated total impact\u201d of the hack at about $6.3 billion and said around $3 billion of affected assets, mainly stablecoins that act as cash for the crypto market, had been frozen. But analysts at Elliptic said the attacker had changed about $3.3 billion into digital assets that could not be frozen and was working to cash those out as traditional currency. Read full article Comments","related":[{"title":"Binance links $6.3 billion crypto theft to compromised DevOps laptop","link":"https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/","source":"Bleeping Computer","date_rel":"30 Oct"},{"title":"In the year AI re-wrote the infosec rulebook, it\u2019s comforting to know crypto exchanges still have bad security","link":"https://www.theregister.com/security/2026/10/30/in-the-year-ai-re-wrote-the-infosec-rulebook-its-comforting-to-know-crypto-exchanges-still-have-bad-security/5306539","source":"The Register Security","date_rel":"30 Oct"},{"title":"Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen","link":"https://thehackernews.com/2026/10/binance-suffers-security-breach.html","source":"The Hacker News","date_rel":"30 Oct"},{"title":"Binance probes potential $5.8 billion crypto-theft hack","link":"https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/","source":"Bleeping Computer","date_rel":"29 Oct"}]},{"title":"Over 60,000 Attacks Target WordPress RCE Vulnerability Within 24 Hours","link":"https://cybersecuritynews.com/60000-attacks-targeting-wordpress/","reason":"Wordpress","category":"News","sources":["Cyber Security News","SecurityWeek","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24\u2026","source":"Cyber Security News","date_rel":"6h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/60000-Attacks-Targeting-WordPress.webp","description":"Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24 hours. These are attack attempts, not confirmed website compromises, and the figure does not establish how many individual sites were targeted. WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The update closes the code execution weakness alongside stored cross-site scripting, information disclosure, and permission issues. The official\u2026","related":[{"title":"PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress","link":"https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/","source":"SecurityWeek","date_rel":"21h ago"},{"title":"WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours","link":"https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html","source":"The Hacker News","date_rel":"22h ago"},{"title":"Fresh WordPress Vulnerability in Attackers\u2019 Crosshairs","link":"https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/","source":"SecurityWeek","date_rel":"30 Oct"}]},{"title":"North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages","link":"https://cybersecuritynews.com/north-korean-hackers-2/","reason":"Github","category":"News","sources":["Cyber Security News","Dark Reading","The Hacker News","The Register Security"],"coverage":4,"cve_ids":[],"summary":"A North Korea-aligned hacking group has moved beyond fake job interviews and now steals developer credentials to plant malware in trusted software projects. The group, tracked as DeceptiveDevelopment, used the stolen\u2026","source":"Cyber Security News","date_rel":"21h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/10/North-Korean-Hackers-Steal-Developer-Credentials-to-Inject-Malware-Into-GitHub-and-Software-Packages.webp","description":"A North Korea-aligned hacking group has moved beyond fake job interviews and now steals developer credentials to plant malware in trusted software projects. The group, tracked as DeceptiveDevelopment, used the stolen access to change code in public and private repositories between April and September 2026. Every poisoned project then became a new way into the systems of the people who use it. The group has been known for years for tricking developers with fake recruiters and coding tests. In earlier campaigns, it mainly wanted to steal cryptocurrency wallets and browser logins. The new\u2026","related":[{"title":"Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour","link":"https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153","source":"The Register Security","date_rel":"29 Oct"},{"title":"GitHub Launches npm Firewall to Block Malicious Packages Before Installation","link":"https://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.html","source":"The Hacker News","date_rel":"29 Oct"},{"title":"GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub","link":"https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github","source":"Dark Reading","date_rel":"28 Oct"}]},{"title":"Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving","link":"https://thehackernews.com/2026/10/why-urgent-security-fixes-arent-fixed.html","reason":"Teams","category":"News","sources":["Microsoft Security Blog","Recorded Future Intelligence","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won\u2019t break anything. Their\u2026","source":"The Hacker News","date_rel":"30 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitJWSYL167QzDoyvN2y9DAuXmFFe0en34dEHp-I2sSVLEPIfljdlRfeIthyMQUgSvf9AfwW4p-solbE5zH3cKpfeLKWg-IqPnVdHbKQ99Bw91fDAoqHx3E9mlpNmXYA5i3RnaTYxZYkZcwbeY31O4CljtFQYp2JPLTmJo1BI09Al9Kh-CDtzFubVly7hM/s1600/cp.jpg","description":"The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won\u2019t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application","related":[{"title":"From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths","link":"https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/","source":"Microsoft Security Blog","date_rel":"20h ago"},{"title":"Prediction Markets Emerge as a New Vertical for Traffer Teams","link":"https://www.recordedfuture.com/research/prediction-markets-traffer-teams","source":"Recorded Future Intelligence","date_rel":"29 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-61738","vendor":"socfortress","product":"CoPilot","severity":"CRITICAL","score":10.0,"description":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin a\u2026","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/socfortress/CoPilot/commit/1881ef8d28bc7f45ffa88d7ba4fcca7302355508","https://github.com/socfortress/CoPilot/commit/bfa630b65d554670c7462a32ce6fd4e3cbd0254c","https://github.com/socfortress/CoPilot/pull/940"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-61738"},{"id":"CVE-2026-61826","vendor":"morpheus65535","product":"bazarr","severity":"CRITICAL","score":10.0,"description":"Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global aut\u2026","cwe":"CWE-352","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/morpheus65535/bazarr/commit/4bd29252feebd0803e84cc3ce1bdd24c3a076ed4","https://github.com/morpheus65535/bazarr/commit/f9a8a9514944be0e7b826e67cde042cebfe9c97e","https://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-61826"},{"id":"CVE-2026-61728","vendor":"socfortress","product":"CoPilot","severity":"CRITICAL","score":9.9,"description":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit store\u2026","cwe":"CWE-79","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/socfortress/CoPilot/commit/461e8f84794aee8ada588de3bad79430dc9f4f3d","https://github.com/socfortress/CoPilot/commit/ab9078bdee5d1c737f37f481103984665a670bdd","https://github.com/socfortress/CoPilot/pull/904"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-61728"},{"id":"CVE-2026-116241","vendor":"pgadmin.org","product":"pgAdmin 4","severity":"CRITICAL","score":9.9,"description":"pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \\copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quo\u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812","https://github.com/pgadmin-org/pgadmin4/issues/10663"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-116241"},{"id":"CVE-2026-62853","vendor":"mqttsnet","product":"thinglinks","severity":"CRITICAL","score":9.9,"description":"ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated at\u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3","https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0","https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-62853"},{"id":"CVE-2025-31704","vendor":"Dahua","product":"Intelligent Connection Center","severity":"CRITICAL","score":9.8,"description":"A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execut\u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.cnvd.org.cn/flaw/show/CNVD-2025-00420"],"url":"https://cve.blackmesa.ca/?q=CVE-2025-31704"},{"id":"CVE-2026-119597","vendor":"AIDotNet","product":"OpenDeepWiki","severity":"CRITICAL","score":9.8,"description":"OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer t\u2026","cwe":"CWE-321","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/AIDotNet/OpenDeepWiki","https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92","https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-119597"},{"id":"CVE-2026-110799","vendor":"givanz","product":"Vvveb","severity":"CRITICAL","score":9.8,"description":"Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of t\u2026","cwe":"CWE-287","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj","https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-110799"},{"id":"CVE-2026-119660","vendor":"yincongcyincong","product":"MuseBot","severity":"CRITICAL","score":9.8,"description":"MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cook\u2026","cwe":"CWE-1394","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/yincongcyincong/MuseBot","https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28","https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-119660"},{"id":"CVE-2026-61737","vendor":"huajian123","product":"ng-antd-admin","severity":"CRITICAL","score":9.8,"description":"ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can b\u2026","cwe":"CWE-321","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/huajian123/ng-antd-admin/commit/23e92ff9176074ee534af3ea3700b3652a9726a9","https://github.com/huajian123/ng-antd-admin/releases/tag/v22.0","https://github.com/huajian123/ng-antd-admin/security/advisories/GHSA-qphq-m2hv-wj5h"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-61737"}],"vendor_spikes":[{"vendor":"WordPress","count":77,"critical_count":3},{"vendor":"Unknown","count":35,"critical_count":0},{"vendor":"Microsoft","count":23,"critical_count":2},{"vendor":"Dell","count":17,"critical_count":0},{"vendor":"HashiCorp","count":16,"critical_count":0},{"vendor":"Red Hat","count":12,"critical_count":0},{"vendor":"pgadmin.org","count":12,"critical_count":1},{"vendor":"SQLite","count":11,"critical_count":0},{"vendor":"Liquid Web / StellarWP","count":7,"critical_count":0},{"vendor":"Scribus","count":7,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":20,"new_cve_count":558,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-98432":{"anchor":"#dev-2","rank":2,"coverage":6},"CVE-2026-62740":{"anchor":"#dev-3","rank":3,"coverage":3},"CVE-2026-62877":{"anchor":"#dev-3","rank":3,"coverage":3},"CVE-2026-111357":{"anchor":"#dev-4","rank":4,"coverage":3},"CVE-2026-118539":{"anchor":"#dev-5","rank":5,"coverage":4}}}