{"fetchedAt":"2026-11-02T15:36:07.436Z","items":[{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-73697","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-73697 - Control Web Panel (CWP) < 1.16 File Write and Command Injection","link":"https://cvefeed.io/vuln/detail/CVE-2026-73697","published":"2026-11-02T14:53:27.000Z","summary":"CVE ID : CVE-2026-73697 Published : Nov. 2, 2026, 2:53 p.m. | 10 minutes ago Description : Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_conte","cves":["CVE-2026-73697"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-73696","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-73696 - Control Web Panel (CWP) < 1.12 Authentication Bypass via Execution After Redirect","link":"https://cvefeed.io/vuln/detail/CVE-2026-73696","published":"2026-11-02T14:52:29.000Z","summary":"CVE ID : CVE-2026-73696 Published : Nov. 2, 2026, 2:52 p.m. | 11 minutes ago Description : Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowi","cves":["CVE-2026-73696"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-73695","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-73695 - Control Web Panel (CWP) < 1.16 Path Traversal LFI via module Parameter","link":"https://cvefeed.io/vuln/detail/CVE-2026-73695","published":"2026-11-02T14:51:47.000Z","summary":"CVE ID : CVE-2026-73695 Published : Nov. 2, 2026, 2:51 p.m. | 11 minutes ago Description : Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An a","cves":["CVE-2026-73695"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120492","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120492 - Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls","link":"https://cvefeed.io/vuln/detail/CVE-2026-120492","published":"2026-11-02T14:29:20.000Z","summary":"CVE ID : CVE-2026-120492 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segment","cves":["CVE-2026-120492"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120491","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120491 - Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page","link":"https://cvefeed.io/vuln/detail/CVE-2026-120491","published":"2026-11-02T14:29:20.000Z","summary":"CVE ID : CVE-2026-120491 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in ","cves":["CVE-2026-120491"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120489","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120489 - Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft","link":"https://cvefeed.io/vuln/detail/CVE-2026-120489","published":"2026-11-02T14:29:19.000Z","summary":"CVE ID : CVE-2026-120489 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, r","cves":["CVE-2026-120489"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120488","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120488 - LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content","link":"https://cvefeed.io/vuln/detail/CVE-2026-120488","published":"2026-11-02T14:29:18.000Z","summary":"CVE ID : CVE-2026-120488 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text","cves":["CVE-2026-120488"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120487","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120487 - LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades","link":"https://cvefeed.io/vuln/detail/CVE-2026-120487","published":"2026-11-02T14:29:17.000Z","summary":"CVE ID : CVE-2026-120487 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/co","cves":["CVE-2026-120487"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120461","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120461 - Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch","link":"https://cvefeed.io/vuln/detail/CVE-2026-120461","published":"2026-11-02T14:29:17.000Z","summary":"CVE ID : CVE-2026-120461 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply fo","cves":["CVE-2026-120461"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120460","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120460 - Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers","link":"https://cvefeed.io/vuln/detail/CVE-2026-120460","published":"2026-11-02T14:29:16.000Z","summary":"CVE ID : CVE-2026-120460 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers,","cves":["CVE-2026-120460"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120459","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120459 - python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key","link":"https://cvefeed.io/vuln/detail/CVE-2026-120459","published":"2026-11-02T14:29:15.000Z","summary":"CVE ID : CVE-2026-120459 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to ","cves":["CVE-2026-120459"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120458","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120458 - Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser","link":"https://cvefeed.io/vuln/detail/CVE-2026-120458","published":"2026-11-02T14:29:15.000Z","summary":"CVE ID : CVE-2026-120458 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing","cves":["CVE-2026-120458"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120457","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120457 - libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder","link":"https://cvefeed.io/vuln/detail/CVE-2026-120457","published":"2026-11-02T14:29:13.000Z","summary":"CVE ID : CVE-2026-120457 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero","cves":["CVE-2026-120457"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120456","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120456 - L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes","link":"https://cvefeed.io/vuln/detail/CVE-2026-120456","published":"2026-11-02T14:29:13.000Z","summary":"CVE ID : CVE-2026-120456 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining","cves":["CVE-2026-120456"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120455","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120455 - rapidyaml through 0.16.0 Out-of-Bounds Write via ParseEngine::_add_annotation()","link":"https://cvefeed.io/vuln/detail/CVE-2026-120455","published":"2026-11-02T14:29:12.000Z","summary":"CVE ID : CVE-2026-120455 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the f","cves":["CVE-2026-120455"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120454","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120454 - The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression","link":"https://cvefeed.io/vuln/detail/CVE-2026-120454","published":"2026-11-02T14:29:11.000Z","summary":"CVE ID : CVE-2026-120454 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs ","cves":["CVE-2026-120454"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120453","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120453 - The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header","link":"https://cvefeed.io/vuln/detail/CVE-2026-120453","published":"2026-11-02T14:29:10.000Z","summary":"CVE ID : CVE-2026-120453 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of","cves":["CVE-2026-120453"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120452","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120452 - libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion","link":"https://cvefeed.io/vuln/detail/CVE-2026-120452","published":"2026-11-02T14:29:10.000Z","summary":"CVE ID : CVE-2026-120452 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbna","cves":["CVE-2026-120452"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120451","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120451 - libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver","link":"https://cvefeed.io/vuln/detail/CVE-2026-120451","published":"2026-11-02T14:29:09.000Z","summary":"CVE ID : CVE-2026-120451 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/","cves":["CVE-2026-120451"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120450","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120450 - LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool","link":"https://cvefeed.io/vuln/detail/CVE-2026-120450","published":"2026-11-02T14:29:08.000Z","summary":"CVE ID : CVE-2026-120450 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email wi","cves":["CVE-2026-120450"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120449","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120449 - Outline before 1.12.0 Improper Access Control via Public Document Shares","link":"https://cvefeed.io/vuln/detail/CVE-2026-120449","published":"2026-11-02T14:29:08.000Z","summary":"CVE ID : CVE-2026-120449 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info,","cves":["CVE-2026-120449"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120448","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120448 - DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint","link":"https://cvefeed.io/vuln/detail/CVE-2026-120448","published":"2026-11-02T14:29:07.000Z","summary":"CVE ID : CVE-2026-120448 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a vict","cves":["CVE-2026-120448"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120447","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120447 - HotGo through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code","link":"https://cvefeed.io/vuln/detail/CVE-2026-120447","published":"2026-11-02T14:29:06.000Z","summary":"CVE ID : CVE-2026-120447 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign","cves":["CVE-2026-120447"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120446","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120446 - madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API","link":"https://cvefeed.io/vuln/detail/CVE-2026-120446","published":"2026-11-02T14:29:06.000Z","summary":"CVE ID : CVE-2026-120446 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/accou","cves":["CVE-2026-120446"]},{"key":"cvefeed:https://cvefeed.io/vuln/detail/CVE-2026-120445","source":"cvefeed.io","sourceId":"cvefeed","kind":"cve","title":"CVE-2026-120445 - madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware","link":"https://cvefeed.io/vuln/detail/CVE-2026-120445","published":"2026-11-02T14:29:05.000Z","summary":"CVE ID : CVE-2026-120445 Published : Nov. 2, 2026, 2:29 p.m. | 34 minutes ago Description : madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi co","cves":["CVE-2026-120445"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118304","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118304 Improper input validation in SVG","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118304","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118304"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118313","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118313 Use after free in Video","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118313","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118313"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118311","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118311 Memory corruption in Media","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118311","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118311"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118317","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118317 Memory corruption in HTML","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118317","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118317"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118315","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118315 Improper input validation in SVG","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118315","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118315"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118312","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118312 Memory corruption in Paint","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118312","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118312"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118316","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118316 Improper input validation in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118316","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118316"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118318","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118318 Improper access control in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118318","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118318"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118308","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118308 Use after free in SVG","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118308","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118308"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118310","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118310 Improper input validation in Views","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118310","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118310"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118305","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118305 Memory corruption in Turbolev","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118305","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118305"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118307","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118307 Use after free in Paint","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118307","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118307"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118306","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118306 Memory corruption in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118306","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118306"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118319","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118319 Memory corruption in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118319","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118319"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118322","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118322 Memory corruption in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118322","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118322"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118328","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118328 Improper input validation in WebRTC","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118328","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118328"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118327","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118327 Memory corruption in Media","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118327","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118327"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118332","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118332 Improper input validation in Compositing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118332","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118332"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118320","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118320 Memory corruption in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118320","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118320"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118334","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118334 Use after free in ImageCapture","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118334","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118334"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118331","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118331 Improper input validation in FileAPI","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118331","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118331"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118330","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118330 Use after free in Browser","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118330","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118330"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118333","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118333 Missing authorization in Video","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118333","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118333"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118335","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118335 Improper input validation in Metrics","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118335","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118335"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118329","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118329 Improper input validation in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118329","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118329"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118336","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118336 Improper input validation in Headless","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118336","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118336"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118337","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118337 Improper access control in Forms","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118337","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118337"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118338","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118338 Use after free in Animation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118338","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118338"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118339","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118339 Use after free in Animation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118339","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118339"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118340","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118340 Memory corruption in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118340","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118340"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118341","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118341 Use after free in Modularization","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118341","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118341"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118342","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118342 Out of bounds write in Editing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118342","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118342"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118343","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118343 Improper input validation in ReadingList","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118343","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118343"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118344","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118344 Use after free in Layout","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118344","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118344"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118345","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118345 Use after free in PDFium","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118345","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118345"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118346","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118346 Use after free in Compositing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118346","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118346"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118347","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118347 Use after free in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118347","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118347"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118348","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118348 Improper input validation in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118348","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118348"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118349","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118349 Memory corruption in Payments","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118349","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118349"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118350","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118350 Use after free in Turbolev","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118350","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118350"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118351","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118351 Memory corruption in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118351","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118351"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118352","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118352 Memory corruption in Cache","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118352","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118352"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118353","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118353 Use after free in Paint","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118353","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118353"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118354","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118354 Improper input validation in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118354","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118354"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118355","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118355 Improper input validation in Command","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118355","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118355"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118356","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118356 Use after free in WTF","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118356","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118356"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118357","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118357 Use after free in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118357","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118357"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118358","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118358 Memory corruption in WebAudio","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118358","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118358"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118359","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-118359 Memory corruption in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118359","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-118359"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-91732","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium CVE-2026-91732: Missing authorization","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-91732","published":"2026-10-31T14:00:00.000Z","summary":"This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.","cves":["CVE-2026-91732"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497","published":"2026-10-31T08:13:53.000Z","summary":"Information published.","cves":["CVE-2026-111497"]},{"key":"paloalto:https://security.paloaltonetworks.com/CVE-2026-111497","source":"Palo Alto Networks","sourceId":"paloalto","kind":"editeur","title":"CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)","link":"https://security.paloaltonetworks.com/CVE-2026-111497","published":"2026-10-31T03:15:00.000Z","summary":"","cves":["CVE-2026-111497"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Informational%20for%20Emergency%20Distrust%20of%20eMudhra%20Root%20and%20Intermediate%20Certificate%20Authorities%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Informational%20for%20Emergency%20Distrust%20of%20eMudhra%20Root%20and%20Intermediate%20Certificate%20Authorities%26vs_k=1","published":"2026-10-30T21:52:08.000Z","summary":"Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. ","cves":[]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20Node.js%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Vulnerabilities in Node.js Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20Node.js%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","published":"2026-10-30T19:55:59.000Z","summary":"On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic inte","cves":["CVE-2026-111497","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Vulnerabilities in PHP Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20PHP%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","published":"2026-10-30T19:24:31.000Z","summary":"On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp . These vulnerabilities are b","cves":["CVE-2026-109618","CVE-2026-109619"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125","published":"2026-10-30T14:00:00.000Z","summary":"Updated one or more CVSS scores for the affected products. This is an informational change only.","cves":["CVE-2026-70125"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-118147 Visual Studio Spoofing Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147","published":"2026-10-30T14:00:00.000Z","summary":"Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.","cves":["CVE-2026-118147"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69446","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-69446 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69446","published":"2026-10-30T14:00:00.000Z","summary":"Corrected CVE by adding the assigning CNA. This is an informational change only.","cves":["CVE-2026-69446"]},{"key":"cisa:https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA","sourceId":"cisa","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-30T12:00:00.000Z","summary":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability These types of vulnerabili","cves":["CVE-2026-111357","CVE-2026-118527"]},{"key":"paloalto:https://security.paloaltonetworks.com/CVE-2026-109618","source":"Palo Alto Networks","sourceId":"paloalto","kind":"editeur","title":"CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)","link":"https://security.paloaltonetworks.com/CVE-2026-109618","published":"2026-10-29T23:54:00.000Z","summary":"","cves":["CVE-2026-109618","CVE-2026-109619"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Finesse%20Server-Side%20Request%20Forgery%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Finesse Server-Side Request Forgery Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Finesse%20Server-Side%20Request%20Forgery%20Vulnerability%26vs_k=1","published":"2026-10-29T21:22:28.000Z","summary":"A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP reque","cves":["CVE-2026-20362"]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8958-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8958-1: .NET vulnerabilities","link":"https://ubuntu.com/security/notices/USN-8958-1","published":"2026-10-29T17:02:55.000Z","summary":"It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected dotnet10 and dotnet11. (CVE-2026-102870) It was discovered that the","cves":["CVE-2026-102870","CVE-2026-111497","CVE-2026-114148"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88078","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88078","published":"2026-10-29T14:00:00.000Z","summary":"CWE added. Informational change only.","cves":["CVE-2026-88078"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Hitachi Energy CoreTec Product","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03","published":"2026-10-29T12:00:00.000Z","summary":"View CSAF Summary Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information ","cves":["CVE-2026-13162","CVE-2026-43284"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-02","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Hitachi Energy TRO600 series products","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-02","published":"2026-10-29T12:00:00.000Z","summary":"View CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information. Please refer to the Recommended Immediate Actions section for information abo","cves":["CVE-2026-10756","CVE-2026-106087"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-01","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens Mendix SAML Module","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-01","published":"2026-10-29T12:00:00.000Z","summary":"View CSAF Summary Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions. The followi","cves":["CVE-2026-89209"]},{"key":"cisa:https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA","sourceId":"cisa","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-29T12:00:00.000Z","summary":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Point","cves":["CVE-2026-97229","CVE-2026-76418"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-847/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-847: MLflow AI Gateway Server-Side Request Forgery Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-847/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.7. The following CVEs are assigned: CVE-2026-71211.","cves":["CVE-2026-71211"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-846/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-846: MLflow Webhook Server-Side Request Forgery Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-846/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-64849.","cves":["CVE-2026-64849"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-845/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-845/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-37052.","cves":["CVE-2024-37052"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-844/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-844: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-844/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2026-118628.","cves":["CVE-2026-118628"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-843/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-843/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118627.","cves":["CVE-2026-118627"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-842/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-842/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118626.","cves":["CVE-2026-118626"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-841/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-841/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118625.","cves":["CVE-2026-118625"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-840/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-840: MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-840/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118624.","cves":["CVE-2026-118624"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-839/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-839/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118623.","cves":["CVE-2026-118623"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-838/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-838: FreeBSD Kernel TTY Race Condition Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-838/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-58093.","cves":["CVE-2026-58093"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-837/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-837: Linux Kernel XFRM Subsystem Use-After-Free Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-837/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-98231.","cves":["CVE-2026-98231"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-836/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-836: Linux Kernel CIFS File System Use-After-Free Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-836/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-72315.","cves":["CVE-2026-72315"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-835/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-835: Linux Kernel Logitech HIDPP Protocol Use-After-Free Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-835/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-93826.","cves":["CVE-2026-93826"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-834/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-834: Linux Kernel IPv6 AH Routing Header Integer Underflow Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-834/","published":"2026-10-29T05:00:00.000Z","summary":"This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-80844.","cves":["CVE-2026-80844"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-19175","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-19175 Use after free in Payments","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-19175","published":"2026-10-29T00:06:22.000Z","summary":"Information published.","cves":["CVE-2026-19175"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Controller%20Authentication%20Bypass%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Catalyst%20SD-WAN%20Controller%20Authentication%20Bypass%20Vulnerability%26vs_k=1","published":"2026-10-28T21:54:35.000Z","summary":"A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This","cves":["CVE-2026-20127"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20Remote%20Access%20SSL%20VPN%20Tunnel%20Denial%20of%20Service%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20Remote%20Access%20SSL%20VPN%20Tunnel%20Denial%20of%20Service%20Vulnerability%26vs_k=1","published":"2026-10-28T19:15:00.000Z","summary":"A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors","cves":["CVE-2026-76418"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-I8z3n6lK?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Advance%20Notification%20for%20Publication%20of%20November%204,%202026,%20Security%20Advisories%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Advance Notification for Publication of November 4, 2026, Security Advisories","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-I8z3n6lK?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Advance%20Notification%20for%20Publication%20of%20November%204,%202026,%20Security%20Advisories%26vs_k=1","published":"2026-10-28T16:00:00.000Z","summary":"On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4","cves":[]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62740","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-62740 Windows Imaging Component Information Disclosure Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62740","published":"2026-10-28T14:00:00.000Z","summary":"Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerability.","cves":["CVE-2026-62740"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62877","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-62877 Windows Win32k Elevation of Privilege Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62877","published":"2026-10-28T14:00:00.000Z","summary":"Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerability.","cves":["CVE-2026-62877"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57083","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-57083 Windows Media Photo Codec Information Disclosure Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57083","published":"2026-10-28T14:00:00.000Z","summary":"Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerability.","cves":["CVE-2026-57083"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57084","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"CVE-2026-57084 Windows File Explorer Information Disclosure Vulnerability","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57084","published":"2026-10-28T14:00:00.000Z","summary":"Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerability.","cves":["CVE-2026-57084"]},{"key":"cisa:https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA","sourceId":"cisa","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-28T12:00:00.000Z","summary":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability These types of vulnerabilities are a frequent attack vector for malicious c","cves":["CVE-2026-41709","CVE-2026-46300"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79293","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79293 Information leak in Animation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79293","published":"2026-10-28T08:54:44.000Z","summary":"Information published.","cves":["CVE-2026-79293"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79292","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79292 Integer overflow in Chromecast","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79292","published":"2026-10-28T08:54:39.000Z","summary":"Information published.","cves":["CVE-2026-79292"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79291","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79291 Information leak in CSS","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79291","published":"2026-10-28T08:54:34.000Z","summary":"Information published.","cves":["CVE-2026-79291"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79290","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79290 Use after free in Aura","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79290","published":"2026-10-28T08:54:29.000Z","summary":"Information published.","cves":["CVE-2026-79290"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79289","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79289 Improper control of a resource through its lifetime in Workers","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79289","published":"2026-10-28T08:54:23.000Z","summary":"Information published.","cves":["CVE-2026-79289"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79287","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79287 Observable discrepancy in Forms","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79287","published":"2026-10-28T08:54:19.000Z","summary":"Information published.","cves":["CVE-2026-79287"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79285","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79285 Uninitialized resource in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79285","published":"2026-10-28T08:54:14.000Z","summary":"Information published.","cves":["CVE-2026-79285"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79284","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79284 UI misrepresentation in Core","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79284","published":"2026-10-28T08:54:09.000Z","summary":"Information published.","cves":["CVE-2026-79284"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79283","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79283 UI misrepresentation in Geometry","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79283","published":"2026-10-28T08:54:02.000Z","summary":"Information published.","cves":["CVE-2026-79283"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79276","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79276 Improper privilege management in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79276","published":"2026-10-28T08:53:57.000Z","summary":"Information published.","cves":["CVE-2026-79276"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79275","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79275 Use after free in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79275","published":"2026-10-28T08:53:53.000Z","summary":"Information published.","cves":["CVE-2026-79275"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79274","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79274 Information leak in GPU","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79274","published":"2026-10-28T08:53:48.000Z","summary":"Information published.","cves":["CVE-2026-79274"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79272","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79272 Improper input validation in FindInPage","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79272","published":"2026-10-28T08:53:43.000Z","summary":"Information published.","cves":["CVE-2026-79272"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79271","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79271 Information leak in DOM","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79271","published":"2026-10-28T08:53:39.000Z","summary":"Information published.","cves":["CVE-2026-79271"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79179","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79179 Incorrect authorization in DOM","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79179","published":"2026-10-28T08:53:36.000Z","summary":"Information published.","cves":["CVE-2026-79179"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79270","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79270 Uninitialized resource in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79270","published":"2026-10-28T08:53:34.000Z","summary":"Information published.","cves":["CVE-2026-79270"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79178","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79178 Incorrect authorization in Web Authentication (Passkeys & Security Keys)","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79178","published":"2026-10-28T08:53:30.000Z","summary":"Information published.","cves":["CVE-2026-79178"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79269","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79269 Uninitialized resource in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79269","published":"2026-10-28T08:53:30.000Z","summary":"Information published.","cves":["CVE-2026-79269"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79177","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79177 Incorrect authorization in Media","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79177","published":"2026-10-28T08:53:26.000Z","summary":"Information published.","cves":["CVE-2026-79177"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79267","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79267 Race condition in Workers","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79267","published":"2026-10-28T08:53:25.000Z","summary":"Information published.","cves":["CVE-2026-79267"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79176","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79176 UI misrepresentation in Extensions","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79176","published":"2026-10-28T08:53:21.000Z","summary":"Information published.","cves":["CVE-2026-79176"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79266","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79266 Use after free in DevTools","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79266","published":"2026-10-28T08:53:20.000Z","summary":"Information published.","cves":["CVE-2026-79266"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79175","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79175 Type confusion in Accessibility","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79175","published":"2026-10-28T08:53:17.000Z","summary":"Information published.","cves":["CVE-2026-79175"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79265","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79265 Incomplete cleanup in GetUserMedia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79265","published":"2026-10-28T08:53:15.000Z","summary":"Information published.","cves":["CVE-2026-79265"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79174","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79174 Incorrect authorization in Extensions","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79174","published":"2026-10-28T08:53:13.000Z","summary":"Information published.","cves":["CVE-2026-79174"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79264","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79264 Incorrect reference resolution in Preload","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79264","published":"2026-10-28T08:53:11.000Z","summary":"Information published.","cves":["CVE-2026-79264"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79173","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79173 UI misrepresentation in WebAppInstalls","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79173","published":"2026-10-28T08:53:08.000Z","summary":"Information published.","cves":["CVE-2026-79173"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79263","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79263 Race condition in Extensions","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79263","published":"2026-10-28T08:53:05.000Z","summary":"Information published.","cves":["CVE-2026-79263"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79155","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79155 Race condition in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79155","published":"2026-10-28T08:53:04.000Z","summary":"Information published.","cves":["CVE-2026-79155"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79262","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79262 Incorrect authorization in Network","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79262","published":"2026-10-28T08:53:01.000Z","summary":"Information published.","cves":["CVE-2026-79262"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79154","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79154 Missing authorization in DevTools","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79154","published":"2026-10-28T08:52:59.000Z","summary":"Information published.","cves":["CVE-2026-79154"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79261","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79261 Incorrect authorization in Controls","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79261","published":"2026-10-28T08:52:56.000Z","summary":"Information published.","cves":["CVE-2026-79261"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79151","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79151 Improper input validation in Safebrowsing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79151","published":"2026-10-28T08:52:55.000Z","summary":"Information published.","cves":["CVE-2026-79151"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79260","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79260 Improper input validation in Cookies","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79260","published":"2026-10-28T08:52:52.000Z","summary":"Information published.","cves":["CVE-2026-79260"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79150","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79150 Use after free in Views","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79150","published":"2026-10-28T08:52:50.000Z","summary":"Information published.","cves":["CVE-2026-79150"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79259","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79259 Improper input validation in Safebrowsing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79259","published":"2026-10-28T08:52:47.000Z","summary":"Information published.","cves":["CVE-2026-79259"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79149","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79149 Use after free in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79149","published":"2026-10-28T08:52:46.000Z","summary":"Information published.","cves":["CVE-2026-79149"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79258","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79258 Incorrect authorization in WebXR","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79258","published":"2026-10-28T08:52:42.000Z","summary":"Information published.","cves":["CVE-2026-79258"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79148","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79148 Off-by-one error in DevTools","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79148","published":"2026-10-28T08:52:41.000Z","summary":"Information published.","cves":["CVE-2026-79148"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79147","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79147 Information leak in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79147","published":"2026-10-28T08:52:37.000Z","summary":"Information published.","cves":["CVE-2026-79147"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79257","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79257 Use after free in Views","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79257","published":"2026-10-28T08:52:37.000Z","summary":"Information published.","cves":["CVE-2026-79257"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79144","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79144 Information leak in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79144","published":"2026-10-28T08:52:32.000Z","summary":"Information published.","cves":["CVE-2026-79144"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79255","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79255 Improper input validation in WebRTC","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79255","published":"2026-10-28T08:52:32.000Z","summary":"Information published.","cves":["CVE-2026-79255"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79143","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79143 Incorrect authorization in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79143","published":"2026-10-28T08:52:28.000Z","summary":"Information published.","cves":["CVE-2026-79143"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79253","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79253 Improper input validation in Network","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79253","published":"2026-10-28T08:52:27.000Z","summary":"Information published.","cves":["CVE-2026-79253"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79142","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79142 Buffer overflow in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79142","published":"2026-10-28T08:52:23.000Z","summary":"Information published.","cves":["CVE-2026-79142"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79252","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79252 Information leak in ServiceWorker","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79252","published":"2026-10-28T08:52:22.000Z","summary":"Information published.","cves":["CVE-2026-79252"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79141","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79141 Incorrect authorization in Browser","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79141","published":"2026-10-28T08:52:18.000Z","summary":"Information published.","cves":["CVE-2026-79141"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79251","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79251 Improper input validation in Network","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79251","published":"2026-10-28T08:52:15.000Z","summary":"Information published.","cves":["CVE-2026-79251"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79140","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79140 Use after free in Views","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79140","published":"2026-10-28T08:52:11.000Z","summary":"Information published.","cves":["CVE-2026-79140"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79250","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79250 UI misrepresentation in Navigation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79250","published":"2026-10-28T08:52:10.000Z","summary":"Information published.","cves":["CVE-2026-79250"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79139","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79139 Improper input validation in Media","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79139","published":"2026-10-28T08:52:06.000Z","summary":"Information published.","cves":["CVE-2026-79139"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79249","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79249 Code injection in Bisection","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79249","published":"2026-10-28T08:52:05.000Z","summary":"Information published.","cves":["CVE-2026-79249"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79138","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79138 Out of bounds write in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79138","published":"2026-10-28T08:52:01.000Z","summary":"Information published.","cves":["CVE-2026-79138"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79248","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79248 Incorrect authorization in Input","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79248","published":"2026-10-28T08:52:00.000Z","summary":"Information published.","cves":["CVE-2026-79248"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79137","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79137 Incorrect authorization in Extensions","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79137","published":"2026-10-28T08:51:57.000Z","summary":"Information published.","cves":["CVE-2026-79137"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79247","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79247 Use after free in Chromoting","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79247","published":"2026-10-28T08:51:55.000Z","summary":"Information published.","cves":["CVE-2026-79247"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79136","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79136 Incorrect authorization in ServiceWorker","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79136","published":"2026-10-28T08:51:53.000Z","summary":"Information published.","cves":["CVE-2026-79136"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79246","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79246 Information leak in DataTransfer","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79246","published":"2026-10-28T08:51:50.000Z","summary":"Information published.","cves":["CVE-2026-79246"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79134","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79134 Incorrect authorization in GetUserMedia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79134","published":"2026-10-28T08:51:48.000Z","summary":"Information published.","cves":["CVE-2026-79134"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79245","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79245 Use after free in UI","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79245","published":"2026-10-28T08:51:45.000Z","summary":"Information published.","cves":["CVE-2026-79245"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79133","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79133 Incorrect authorization in Forms","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79133","published":"2026-10-28T08:51:43.000Z","summary":"Information published.","cves":["CVE-2026-79133"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79244","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79244 Use after free in Animation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79244","published":"2026-10-28T08:51:38.000Z","summary":"Information published.","cves":["CVE-2026-79244"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79131","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79131 Out of bounds write in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79131","published":"2026-10-28T08:51:35.000Z","summary":"Information published.","cves":["CVE-2026-79131"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79243","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79243 Improper input validation in ReadingList","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79243","published":"2026-10-28T08:51:33.000Z","summary":"Information published.","cves":["CVE-2026-79243"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79030","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79030 Observable discrepancy in Autofill","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79030","published":"2026-10-28T08:51:32.000Z","summary":"Information published.","cves":["CVE-2026-79030"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79130","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79130 Buffer overflow in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79130","published":"2026-10-28T08:51:30.000Z","summary":"Information published.","cves":["CVE-2026-79130"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79028","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79028 Observable discrepancy in Network","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79028","published":"2026-10-28T08:51:24.000Z","summary":"Information published.","cves":["CVE-2026-79028"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79242","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79242 Observable discrepancy in HTML","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79242","published":"2026-10-28T08:51:24.000Z","summary":"Information published.","cves":["CVE-2026-79242"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79128","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79128 Use after free in Views","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79128","published":"2026-10-28T08:51:21.000Z","summary":"Information published.","cves":["CVE-2026-79128"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79027","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79027 Use after free in WebRTC","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79027","published":"2026-10-28T08:51:19.000Z","summary":"Information published.","cves":["CVE-2026-79027"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79240","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79240 Out of bounds write in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79240","published":"2026-10-28T08:51:19.000Z","summary":"Information published.","cves":["CVE-2026-79240"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79127","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79127 Out of bounds write in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79127","published":"2026-10-28T08:51:17.000Z","summary":"Information published.","cves":["CVE-2026-79127"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79026","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79026 Use after free in Extensions","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79026","published":"2026-10-28T08:51:13.000Z","summary":"Information published.","cves":["CVE-2026-79026"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79239","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79239 Out of bounds read in Tint","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79239","published":"2026-10-28T08:51:13.000Z","summary":"Information published.","cves":["CVE-2026-79239"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79126","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79126 Incorrect provision of specified functionality in Proxy","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79126","published":"2026-10-28T08:51:10.000Z","summary":"Information published.","cves":["CVE-2026-79126"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79025","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79025 Improper input validation in Workers","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79025","published":"2026-10-28T08:51:08.000Z","summary":"Information published.","cves":["CVE-2026-79025"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79238","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79238 Incorrect authorization in ServiceWorker","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79238","published":"2026-10-28T08:51:07.000Z","summary":"Information published.","cves":["CVE-2026-79238"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79237","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79237 Incorrect authorization in Navigation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79237","published":"2026-10-28T08:51:02.000Z","summary":"Information published.","cves":["CVE-2026-79237"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79236","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79236 Type confusion in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79236","published":"2026-10-28T08:50:35.000Z","summary":"Information published.","cves":["CVE-2026-79236"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79024","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79024 Information leak in ServiceWorker","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79024","published":"2026-10-28T08:50:32.000Z","summary":"Information published.","cves":["CVE-2026-79024"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79125","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79125 Information leak in XR","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79125","published":"2026-10-28T08:50:30.000Z","summary":"Information published.","cves":["CVE-2026-79125"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79235","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79235 Use after free in WebGL","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79235","published":"2026-10-28T08:50:29.000Z","summary":"Information published.","cves":["CVE-2026-79235"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79023","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79023 Incorrect authorization in Editing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79023","published":"2026-10-28T08:50:27.000Z","summary":"Information published.","cves":["CVE-2026-79023"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79124","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79124 Information leak in Intents","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79124","published":"2026-10-28T08:50:26.000Z","summary":"Information published.","cves":["CVE-2026-79124"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79234","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79234 Injection in CSS","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79234","published":"2026-10-28T08:50:25.000Z","summary":"Information published.","cves":["CVE-2026-79234"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79022","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79022 UI misrepresentation in Transactions Platform","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79022","published":"2026-10-28T08:50:23.000Z","summary":"Information published.","cves":["CVE-2026-79022"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79123","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79123 Improper input validation in NTP Footer","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79123","published":"2026-10-28T08:50:21.000Z","summary":"Information published.","cves":["CVE-2026-79123"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79232","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79232 Use after free in Aura","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79232","published":"2026-10-28T08:50:20.000Z","summary":"Information published.","cves":["CVE-2026-79232"]},{"key":"msrc:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79021","source":"Microsoft","sourceId":"msrc","kind":"editeur","title":"Chromium: CVE-2026-79021 Missing authorization in InterestGroups","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-79021","published":"2026-10-28T08:50:18.000Z","summary":"Information published.","cves":["CVE-2026-79021"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-833/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-833/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Valkey. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-832/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-832: AVG Internet Security avgToolsSvc Link Following Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-832/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows local attackers to escalate privileges on affected installations of AVG Internet Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-6064.","cves":["CVE-2026-6064"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-831/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-831/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-112656.","cves":["CVE-2026-112656"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-830/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-830/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-86974.","cves":["CVE-2026-86974"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-829/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-829: (0Day) (Pwn2Own) Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-829/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118611.","cves":["CVE-2026-118611"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-828/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-828/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118610.","cves":["CVE-2026-118610"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-827/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-827: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-827/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118609.","cves":["CVE-2026-118609"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-826/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-826: (0Day) (Pwn2Own) Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-826/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.5. The following CVEs are assigned: C","cves":["CVE-2026-118608"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-825/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-825: (0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-825/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118607.","cves":["CVE-2026-118607"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-824/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-824: (0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-824/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118606.","cves":["CVE-2026-118606"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-823/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-823: (0Day) (Pwn2Own) Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-823/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-","cves":["CVE-2026-118605"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-822/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-822: (0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-822/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118604.","cves":["CVE-2026-118604"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-821/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-821: (0Day) (Pwn2Own) Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-821/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-118603.","cves":["CVE-2026-118603"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-820/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-820: (0Day) (Pwn2Own) Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-820/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118602.","cves":["CVE-2026-118602"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-819/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-819: (0Day) (Pwn2Own) Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-819/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118601.","cves":["CVE-2026-118601"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-818/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-818: (0Day) Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-818/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118619.","cves":["CVE-2026-118619"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-817/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-817: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-817/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118618.","cves":["CVE-2026-118618"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-816/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-816: (0Day) Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-816/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118617.","cves":["CVE-2026-118617"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-815/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-815: (0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-815/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118616.","cves":["CVE-2026-118616"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-814/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-814: (0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-814/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118615.","cves":["CVE-2026-118615"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-813/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-813: (0Day) Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-813/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118614.","cves":["CVE-2026-118614"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-812/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-812: (0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-812/","published":"2026-10-28T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118613.","cves":["CVE-2026-118613"]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8956-2","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8956-2: Brotli vulnerability","link":"https://ubuntu.com/security/notices/USN-8956-2","published":"2026-10-27T21:14:45.000Z","summary":"USN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.","cves":[]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8957-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8957-1: authd vulnerability","link":"https://ubuntu.com/security/notices/USN-8957-1","published":"2026-10-27T16:23:37.000Z","summary":"Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.","cves":[]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Unified Communications Products Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Products%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","published":"2026-10-27T14:46:44.000Z","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition","cves":["CVE-2026-76473","CVE-2026-76474","CVE-2026-76475","CVE-2026-76476","CVE-2026-76477","CVE-2026-76478","CVE-2026-76479","CVE-2026-76481"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Expressway Series Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","published":"2026-10-27T14:45:16.000Z","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These vulnerabilities were found during internal test","cves":["CVE-2026-76490","CVE-2026-76491","CVE-2026-76492","CVE-2026-76493","CVE-2026-76494","CVE-2026-76495","CVE-2026-76496","CVE-2026-76497"]},{"key":"cisa:https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA","sourceId":"cisa","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-27T12:00:00.000Z","summary":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability These types of vulnerabilities are a frequent attack ","cves":["CVE-2026-48356","CVE-2026-111497"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01","source":"CISA","sourceId":"cisa","kind":"gouv","title":"EPICS Base","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01","published":"2026-10-27T12:00:00.000Z","summary":"View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are affected: EPICS Base release <=7.0.10 (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-11","cves":["CVE-2026-114595","CVE-2026-114596","CVE-2026-114597","CVE-2026-114598"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02","published":"2026-10-27T12:00:00.000Z","summary":"View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service","cves":["CVE-2023-4863","CVE-2026-16436","CVE-2026-16437","CVE-2026-16438"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-811/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-811/","published":"2026-10-27T05:00:00.000Z","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-114552.","cves":["CVE-2026-114552"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-810/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-810/","published":"2026-10-27T05:00:00.000Z","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-114551.","cves":["CVE-2026-114551"]},{"key":"certcc:https://kb.cert.org/vuls/id/701544","source":"CERT/CC","sourceId":"certcc","kind":"cert","title":"VU#701544: Retraction of mpc-lib hardened derivation fails to protect ancestor isolation","link":"https://kb.cert.org/vuls/id/701544","published":"2026-10-26T22:45:54.629Z","summary":"Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived","cves":[]},{"key":"certcc:https://kb.cert.org/vuls/id/128947","source":"CERT/CC","sourceId":"certcc","kind":"cert","title":"VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling","link":"https://kb.cert.org/vuls/id/128947","published":"2026-10-26T19:07:02.688Z","summary":"Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received","cves":["CVE-2026-91141"]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8956-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8956-1: Brotli vulnerability","link":"https://ubuntu.com/security/notices/USN-8956-1","published":"2026-10-26T15:54:30.000Z","summary":"It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.","cves":[]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8955-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8955-1: nginx vulnerabilities","link":"https://ubuntu.com/security/notices/USN-8955-1","published":"2026-10-26T15:34:05.000Z","summary":"It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matchi","cves":["CVE-2026-15176","CVE-2026-93479","CVE-2026-95101","CVE-2026-97205","CVE-2026-97629"]},{"key":"cisa:https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog","source":"CISA","sourceId":"cisa","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-26T12:00:00.000Z","summary":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector f","cves":["CVE-2026-109618","CVE-2026-109619"]},{"key":"fortinet:https://fortiguard.fortinet.com/psirt/FG-IR-26-187","source":"Fortinet","sourceId":"fortinet","kind":"editeur","title":"Node2Shell CVEs","link":"https://fortiguard.fortinet.com/psirt/FG-IR-26-187","published":"2026-10-26T07:00:00.000Z","summary":"CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote","cves":["CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-111497","CVE-2026-105481","CVE-2026-106072","CVE-2026-106074","CVE-2026-106070","CVE-2026-106071","CVE-2026-106073"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-809/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-809: Meta FAIRChem dense_eval dft-targets Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-809/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-808/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-808: Meta FAIRChem run_validation Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-808/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-807/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-807: Meta FAIRChem get_computational_df_to_predict Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-807/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-806/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-806: Meta FAIRChem write_top_k_vasp Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-806/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-805/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-805: Meta FAIRChem Adsorbate Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-805/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-804/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-804: Meta FAIRChem Bulk Class Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-804/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-803/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-803: Meta FAIRChem AdsorbMLRunner Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-803/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-802/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-802: Meta FAIRChem process_mlrs Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-802/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-801/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-801: Meta FAIRChem Slab Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-801/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-800/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-800: Meta FAIRChem OMolRunner Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-800/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-799/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-799: Meta FAIRChem Solvent Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-799/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-798/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-798: Meta FAIRChem dense_eval results-file Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-798/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-797/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-797: Meta FAIRChem dense_eval dft-compute Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-797/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-796/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-796: Meta FAIRChem reaction adsorbate_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-796/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-795/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-795: Meta FAIRChem reaction_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-795/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-794/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-794: Meta FAIRChem ion_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-794/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-793/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-793: Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-793/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.","cves":[]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-792/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-792/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.","cves":["CVE-2026-114550"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-791/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-791/","published":"2026-10-26T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92211.","cves":["CVE-2026-92211"]},{"key":"cisa:https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0","source":"CISA","sourceId":"cisa","kind":"gouv","title":"CISA Adds One Known Exploited Vulnerability to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog-0","published":"2026-10-23T12:00:00.000Z","summary":"CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise","cves":["CVE-2026-110447"]},{"key":"cisa:https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog","source":"CISA","sourceId":"cisa","kind":"gouv","title":"CISA Adds One Known Exploited Vulnerability to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/23/cisa-adds-one-known-exploited-vulnerability-catalog","published":"2026-10-23T12:00:00.000Z","summary":"CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operati","cves":["CVE-2026-114625"]},{"key":"certcc:https://kb.cert.org/vuls/id/763488","source":"CERT/CC","sourceId":"certcc","kind":"cert","title":"VU#763488: Memory corruption vulnerabilities in PHP","link":"https://kb.cert.org/vuls/id/763488","published":"2026-10-22T22:23:51.159Z","summary":"Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve arbitrary code execution. Description PHP is a widely used open-so","cves":["CVE-2026-109618","CVE-2026-109619"]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8954-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8954-1: zlib vulnerability","link":"https://ubuntu.com/security/notices/USN-8954-1","published":"2026-10-22T19:54:53.000Z","summary":"Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution.","cves":[]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20SMTP%20MIME%20Denial%20of%20Service%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20SMTP%20MIME%20Denial%20of%20Service%20Vulnerability%26vs_k=1","published":"2026-10-22T19:03:31.000Z","summary":"Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of error checking when the MIME fields of the SMTP header are parsed. An attacker could exploit this vulnerability by sending crafte","cves":["CVE-2026-20011"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Multiple Cisco Products Snort 3 Security Hardening Release: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Security%20Hardening%20Release:%20October%202026%26vs_k=1","published":"2026-10-22T19:03:30.000Z","summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20043 ar","cves":["CVE-2026-20043","CVE-2026-20236","CVE-2026-20291","CVE-2026-20356"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Denial%20of%20Service%20Vulnerabilities%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Denial%20of%20Service%20Vulnerabilities%26vs_k=1","published":"2026-10-22T19:03:28.000Z","summary":"Multiple Cisco products are affected by vulnerabilities in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has rele","cves":["CVE-2026-20019","CVE-2026-20179","CVE-2026-20197","CVE-2026-76489"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Generic%20Routing%20Encapsulation%20Denial%20of%20Service%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Generic%20Routing%20Encapsulation%20Denial%20of%20Service%20Vulnerability%26vs_k=1","published":"2026-10-22T19:03:27.000Z","summary":"Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker c","cves":["CVE-2026-20221"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Denial%20of%20Service%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Multiple Cisco Products Snort 3 Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Denial%20of%20Service%20Vulnerability%26vs_k=1","published":"2026-10-22T19:03:26.000Z","summary":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (","cves":["CVE-2026-76445"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Visual%20Basic%20for%20Applications%20Buffer%20Overflow%20Denial%20of%20Service%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Multiple%20Cisco%20Products%20Snort%203%20Visual%20Basic%20for%20Applications%20Buffer%20Overflow%20Denial%20of%20Service%20Vulnerability%26vs_k=1","published":"2026-10-22T19:03:25.000Z","summary":"A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper range checking when Snort 3 decompresses VBA d","cves":["CVE-2026-20218"]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8953-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8953-1: OpenVPN vulnerability","link":"https://ubuntu.com/security/notices/USN-8953-1","published":"2026-10-22T15:38:41.000Z","summary":"It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.","cves":[]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8952-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8952-1: Tornado vulnerabilities","link":"https://ubuntu.com/security/notices/USN-8952-1","published":"2026-10-22T12:07:23.000Z","summary":"It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)","cves":["CVE-2023-54397","CVE-2024-14029","CVE-2026-91990","CVE-2026-91992","CVE-2026-103262","CVE-2026-103263"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens RUGGEDCOM CROSSBOW","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-12","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations or causing a denial of service. Siemens has released a","cves":["CVE-2026-89196","CVE-2026-89197","CVE-2026-89198","CVE-2026-89199","CVE-2026-89200","CVE-2026-89201","CVE-2026-89202","CVE-2026-89203","CVE-2026-89204","CVE-2026-89205","CVE-2026-89206"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens RUGGEDCOM APE1808 Devices","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-18","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and update information. The following versions of Siemens RUGGEDCOM APE1808 Devices are affected: ","cves":["CVE-2026-33387","CVE-2026-33388","CVE-2026-33389","CVE-2026-33391","CVE-2026-33920"]},{"key":"cisa:https://www.cisa.gov/resources-tools/resources/managing-ai-token-consumption-operational-resilience","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Managing AI Token Consumption for Operational Resilience","link":"https://www.cisa.gov/resources-tools/resources/managing-ai-token-consumption-operational-resilience","published":"2026-10-22T12:00:00.000Z","summary":"CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, Managing AI Token Consumption for Operational Resilience , to help organizations understand and manage token usage in support of operations. As organizations adopt third-party super intelligence (SI) services, token-based usage models can affect cost, perf","cves":[]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-11","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIM","cves":["CVE-2021-41617","CVE-2023-28531","CVE-2023-51384","CVE-2023-52927","CVE-2023-53292","CVE-2024-26783","CVE-2024-27056","CVE-2024-28956","CVE-2024-36903","CVE-2024-36927","CVE-2024-42079","CVE-2024-46786","CVE-2024-47736","CVE-2024-47809","CVE-2024-49968","CVE-2024-49994","CVE-2024-49998","CVE-2024-50014","CVE-2024-50063","CVE-2024-50164","CVE-2024-50298","CVE-2024-53124","CVE-2024-53170","CVE-2024-54458","CVE-2024-56631","CVE-2024-56703","CVE-2024-56719","CVE-2024-57917","CVE-2024-57924","CVE-2024-57973","CVE-2024-57977","CVE-2024-57979","CVE-2024-58011","CVE-2024-58016","CVE-2024-58020","CVE-2024-58056","CVE-2024-58058","CVE-2024-58061","CVE-2024-58086","CVE-2025-21645","CVE-2025-21648","CVE-2025-21655","CVE-2025-21676","CVE-2025-21682","CVE-2025-21702","CVE-2025-21705","CVE-2025-21706","CVE-2025-21707","CVE-2025-21718","CVE-2025-21731","CVE-2025-21745","CVE-2025-21758","CVE-2025-21760","CVE-2025-21764","CVE-2025-21765","CVE-2025-21780","CVE-2025-21795","CVE-2025-21796","CVE-2025-21802","CVE-2025-21814"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens WinCC","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-13","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is prepar","cves":["CVE-2026-59241"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens Industrial Edge Device Kit","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal informa","cves":["CVE-2026-44414","CVE-2026-44415"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens APOGEE, TALON and Desigo PXC/PXM Products","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-08","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary The products listed below contain multiple vulnerabilities that could allow an attacker to cause a denial of service and potentially impact the availability of the affected device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific mitigations for prod","cves":["CVE-2026-102073","CVE-2026-102074","CVE-2026-102075","CVE-2026-102076","CVE-2026-89208"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens PSS(R)SINCAL","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-06","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates ","cves":["CVE-2026-84854"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens Capital Embedded AR Classic","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-04","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recom","cves":["CVE-2026-89208"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01","source":"CISA","sourceId":"cisa","kind":"gouv","title":"InterSystems Corporation InterSystems IRIS for Health","link":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions of InterSystems Corporation InterSystems IRIS for Health are affected: InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (CVE-2026-111594, CVE-2026-111594, CVE-20","cves":["CVE-2026-111594"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens SIMATIC IPCs","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-07","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions. The fo","cves":["CVE-2026-72895"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens Software Center","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-03","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version","cves":["CVE-2026-110936"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens RUGGEDCOM CROSSBOW Station Access Controller","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-15","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends t","cves":["CVE-2025-6965","CVE-2025-70873","CVE-2025-71316","CVE-2026-11822","CVE-2026-11824"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens SIMATIC S7 PLCs Web Server","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-14","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or","cves":["CVE-2026-63350","CVE-2026-63351","CVE-2026-63352","CVE-2026-63353","CVE-2026-63354","CVE-2026-63355","CVE-2026-63356","CVE-2026-63357"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens SENTRON 3NA COM Fuse","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-05","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation. The following versions of Siemens SENTRON 3NA CO","cves":["CVE-2024-7322"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Kiloview E3 NDI Encoder","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Successful exploitation of this these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Kiloview E3 NDI Encoder are affected: E3 Firmware <1.30 (CVE-2026-109122, CVE-2026-111100, CVE-2026-96616, CVE-2026-105265, CVE-2026-110491, CVE-2026-107861, CVE-2026-110243, CVE-2026-92450, CVE-2026-110825","cves":["CVE-2026-109122","CVE-2026-111100","CVE-2026-96616","CVE-2026-105265","CVE-2026-110491","CVE-2026-107861","CVE-2026-110243","CVE-2026-92450","CVE-2026-110825"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens SIMATIC S7-1500 TM MFP","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-16","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens SIMATIC S7-1500 TM MFP are affected: SIMATIC S7-1500 TM MFP - GNU/Li","cves":["CVE-2023-52927","CVE-2023-53292","CVE-2023-54271","CVE-2024-26982","CVE-2024-36922","CVE-2024-40945","CVE-2024-47809","CVE-2024-49998","CVE-2024-53166","CVE-2024-56647","CVE-2024-56657","CVE-2024-56719","CVE-2024-57977","CVE-2024-57979","CVE-2024-57980","CVE-2024-57981","CVE-2024-57986","CVE-2024-57993","CVE-2024-57996","CVE-2024-58002","CVE-2024-58005","CVE-2024-58009","CVE-2024-58013","CVE-2024-58014","CVE-2024-58017","CVE-2024-58020","CVE-2024-58058","CVE-2024-58061","CVE-2024-58063","CVE-2024-58068","CVE-2024-58071","CVE-2024-58072","CVE-2024-58077","CVE-2024-58079","CVE-2024-58083","CVE-2025-21682","CVE-2025-21700","CVE-2025-21702","CVE-2025-21703","CVE-2025-21704","CVE-2025-21705","CVE-2025-21706","CVE-2025-21707","CVE-2025-21708","CVE-2025-21716","CVE-2025-21719","CVE-2025-21724","CVE-2025-21725","CVE-2025-21726","CVE-2025-21727","CVE-2025-21728","CVE-2025-21731","CVE-2025-21735","CVE-2025-21738","CVE-2025-21744","CVE-2025-21745","CVE-2025-21753","CVE-2025-21756","CVE-2025-21758","CVE-2025-21760"]},{"key":"cisa:https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17","source":"CISA","sourceId":"cisa","kind":"gouv","title":"Siemens Industrial Edge Devices","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-17","published":"2026-10-22T12:00:00.000Z","summary":"View CSAF Summary Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends sp","cves":["CVE-2026-44414","CVE-2026-44415"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-790/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-790/","published":"2026-10-22T05:00:00.000Z","summary":"This vulnerability allows network-adjacent attackers to tamper with CMS AuthEnvelopedData messages on affected installations of OpenSSL. An attacker must first obtain the ability to modify CMS AuthEnvelopedData messages in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.1. The following CVEs are assigned: CVE-2026-34182.","cves":["CVE-2026-34182"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-789/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-789/","published":"2026-10-22T05:00:00.000Z","summary":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-63073.","cves":["CVE-2026-63073"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-788/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-788/","published":"2026-10-22T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-20218.","cves":["CVE-2026-20218"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-787/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-787: NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-787/","published":"2026-10-22T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-24250.","cves":["CVE-2026-24250"]},{"key":"zdi:http://www.zerodayinitiative.com/advisories/ZDI-26-786/","source":"Zero Day Initiative","sourceId":"zdi","kind":"cert","title":"ZDI-26-786: NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-786/","published":"2026-10-22T05:00:00.000Z","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-114549.","cves":["CVE-2026-114549"]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8890-2","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8890-2: libsoup vulnerabilities","link":"https://ubuntu.com/security/notices/USN-8890-2","published":"2026-10-21T21:36:06.000Z","summary":"USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.0","cves":["CVE-2026-4271","CVE-2026-5119","CVE-2026-6324","CVE-2026-66339","CVE-2026-77014","CVE-2026-77680","CVE-2026-85197","CVE-2026-85534"]},{"key":"ubuntu:https://ubuntu.com/security/notices/USN-8951-1","source":"Ubuntu","sourceId":"ubuntu","kind":"editeur","title":"USN-8951-1: c-ares vulnerabilities","link":"https://ubuntu.com/security/notices/USN-8951-1","published":"2026-10-21T18:20:42.000Z","summary":"It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could p","cves":["CVE-2020-22217","CVE-2022-4904","CVE-2026-69184","CVE-2026-69186"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-QGwHnJ6k?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Advance%20Notification%20for%20Publication%20of%20October%2021,%202026,%20Security%20Advisories%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Advance Notification for Publication of October 21, 2026, Security Advisories","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-QGwHnJ6k?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Advance%20Notification%20for%20Publication%20of%20October%2021,%202026,%20Security%20Advisories%26vs_k=1","published":"2026-10-21T16:09:19.000Z","summary":"On October 21, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories. To remediate the vulnerabilities that were disclosed on October 21, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability","cves":["CVE-2026-20043","CVE-2026-20236","CVE-2026-20291","CVE-2026-20356","CVE-2026-76524","CVE-2026-76489","CVE-2026-20019","CVE-2026-20179","CVE-2026-20197","CVE-2026-20221","CVE-2026-20011","CVE-2026-20218","CVE-2026-76445"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Information%20Disclosure%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Expressway Series Information Disclosure Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Information%20Disclosure%20Vulnerability%26vs_k=1","published":"2026-10-21T16:00:00.000Z","summary":"A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request","cves":["CVE-2026-76435"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XR%20Software%20for%20ASR%209000%20Series%20Routers%20IPv4%20Unicast%20Packets%20Denial%20of%20Service%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20IOS%20XR%20Software%20for%20ASR%209000%20Series%20Routers%20IPv4%20Unicast%20Packets%20Denial%20of%20Service%20Vulnerability%26vs_k=1","published":"2026-10-21T16:00:00.000Z","summary":"A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and","cves":["CVE-2026-76505"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Manager%20Improper%20Access%20Control%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Unified Communications Manager Improper Access Control Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Communications%20Manager%20Improper%20Access%20Control%20Vulnerability%26vs_k=1","published":"2026-10-21T16:00:00.000Z","summary":"A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker","cves":["CVE-2026-76487"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Expressway Series Remote Code Execution Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Expressway%20Series%20Remote%20Code%20Execution%20Vulnerability%26vs_k=1","published":"2026-10-21T16:00:00.000Z","summary":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root . This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates w","cves":["CVE-2026-76466"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Open%20Source%20Snort%203%20Control%20Channel%20Socket%20Arbitrary%20Command%20Execution%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Open%20Source%20Snort%203%20Control%20Channel%20Socket%20Arbitrary%20Command%20Execution%20Vulnerability%26vs_k=1","published":"2026-10-21T16:00:00.000Z","summary":"A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket. An attacker could exploit this vul","cves":["CVE-2026-76524"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Client%20Secure%20Firewall%20Posture%20Module%20Privilege%20Escalation%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Client%20Secure%20Firewall%20Posture%20Module%20Privilege%20Escalation%20Vulnerability%26vs_k=1","published":"2026-10-21T16:00:00.000Z","summary":"A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a series of ","cves":["CVE-2026-76462"]},{"key":"fortinet:https://fortiguard.fortinet.com/psirt/FG-IR-26-186","source":"Fortinet","sourceId":"fortinet","kind":"editeur","title":"PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)","link":"https://fortiguard.fortinet.com/psirt/FG-IR-26-186","published":"2026-10-21T07:00:00.000Z","summary":"CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memor","cves":["CVE-2026-109618","CVE-2026-109619"]},{"key":"certcc:https://kb.cert.org/vuls/id/645818","source":"CERT/CC","sourceId":"certcc","kind":"cert","title":"VU#645818: Xerj Console API authentication bypass leads to unauthorized credential minting","link":"https://kb.cert.org/vuls/id/645818","published":"2026-10-20T18:09:44.460Z","summary":"Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API. This allows the attacker to maintain access and potent","cves":["CVE-2026-97406"]},{"key":"cisco:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Intelligence%20Center%20SQL%20Injection%20Vulnerability%26vs_k=1","source":"Cisco","sourceId":"cisco","kind":"editeur","title":"Cisco Unified Intelligence Center SQL Injection Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Unified%20Intelligence%20Center%20SQL%20Injection%20Vulnerability%26vs_k=1","published":"2026-10-20T12:53:16.000Z","summary":"A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to th","cves":["CVE-2026-20327"]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-018/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-018: Critical Vulnerabilities in PHP","link":"https://cert.europa.eu/publications/security-advisories/2026-018/","published":"","summary":"On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP. Public reports indicated that these vulnerabilities could lead to remote code execution (RCE). The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities c","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-019/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions","link":"https://cert.europa.eu/publications/security-advisories/2026-019/","published":"","summary":"On 21 October 2026, GitLab published a security advisory addressing several vulnerabilities among which a critical flaw that could allow an unauthenticated user to execute arbitrary code on a GitLab server. CERT-EU recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-017/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-017: Critical Vulnerability in Cisco Secure Email Gateway","link":"https://cert.europa.eu/publications/security-advisories/2026-017/","published":"","summary":"On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an unauthenticated, remote attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. The Cisco P","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-016/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-016: Critical Vulnerability in GitLab CE and EE","link":"https://cert.europa.eu/publications/security-advisories/2026-016/","published":"","summary":"On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server. CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-015/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-015: Critical Vulnerability in Multiple Atlassian Products","link":"https://cert.europa.eu/publications/security-advisories/2026-015/","published":"","summary":"On 5 October 2026, Atlassian published a security advisory addressing a critical arbitrary file access vulnerability. It affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. CERT-EU strongly recommends upgrading all affected installa","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-014/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway","link":"https://cert.europa.eu/publications/security-advisories/2026-014/","published":"","summary":"On 27 September 2026, Citrix published a security bulletin addressing 8 vulnerabilities affecting customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway, among which 2 critical unauthenticated Remote Code Execution (RCE) vulnerabilities. Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild. CERT-EU recommends u","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-013/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-013: Critical Vulnerability in F5 BIG-IP APM","link":"https://cert.europa.eu/publications/security-advisories/2026-013/","published":"","summary":"On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild. CERT-EU recommends taking appropriate actions as soon as possible.","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-012/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-012: Critical Vulnerabilities in Check Point Products","link":"https://cert.europa.eu/publications/security-advisories/2026-012/","published":"","summary":"On 9 September 2026, Check Point released emergency security updates addressing two critical vulnerabilities affecting Check Point Security Gateway, Security Management Server, and Spark Firewall deployments configured to use Remote Access VPN or Site-to-Site VPN. Both vulnerabilities carry a CVSS score of 9.8 and could allow an unauthenticated, remote attac","cves":[]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-011/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server","link":"https://cert.europa.eu/publications/security-advisories/2026-011/","published":"","summary":"On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products[3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed \"OVERPASS\" by the Onapsis Research Labs (ORL), ","cves":["CVE-2026-44756","CVE-2026-58240"]},{"key":"certeu:https://cert.europa.eu/publications/security-advisories/2026-010/","source":"CERT-EU","sourceId":"certeu","kind":"cert","title":"2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway","link":"https://cert.europa.eu/publications/security-advisories/2026-010/","published":"","summary":"On 19 August 2026, Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). CERT-EU recommends updating affected devices as soon as possible.","cves":[]}],"sources":[{"name":"CERT-FR","ok":false,"detail":"fetch failed"},{"name":"CERT-EU","ok":true,"detail":"10 éléments"},{"name":"CISA","ok":true,"detail":"30 éléments"},{"name":"CERT/CC","ok":true,"detail":"12 éléments"},{"name":"Zero Day Initiative","ok":true,"detail":"96 éléments"},{"name":"Microsoft","ok":true,"detail":"150 éléments"},{"name":"Cisco","ok":true,"detail":"40 éléments"},{"name":"Fortinet","ok":true,"detail":"12 éléments"},{"name":"Palo Alto Networks","ok":true,"detail":"16 éléments"},{"name":"Ubuntu","ok":true,"detail":"10 éléments"},{"name":"Exploit-DB","ok":false,"detail":"HTTP 502"},{"name":"cvefeed.io","ok":true,"detail":"25 éléments"}]}