Classification: Low, Solution: Not Defined, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.9, CVEs: CVE-2026-48360, CVE-2026-104349, CVE-2026-104351, CVE-2026-104353, CVE-2026-105780, CVE-2026-105489, CVE-2026-105781, CVE-2026-104350, CVE-2026-104354, CVE-2026-105779, CVE-2026-48379, CVE-2026-48380, Summary: Adobe has released a priority 2 security update for Adobe Connect. This update resolves a vulnerability rated critical that could result in arbitrary code execution. Adobe has released a…
Classification: Critical, Solution: Not Defined, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.5, CVEs: CVE-2026-97631, Summary: The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called EDK2 the “preeminent solution / implementation of the UEFI specifications.” Virtually all…
De multiples vulnérabilités ont été découvertes dans WordPress. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans Elastic Cloud Enterprise. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
De multiples vulnérabilités ont été découvertes dans Foxit Online Services. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une falsification de requêtes côté serveur (SSRF).
De multiples vulnérabilités ont été découvertes dans Apache Kafka. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
De multiples vulnérabilités ont été découvertes dans PostgreSQL Anonymizer. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans Veeam Backup for Microsoft 365. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Serial number: AV26-1101 Date: October 28, 2026 As of October 28, 2026, Juniper Networks is affected by vulnerabilities in the following products: Session Smart Conductor Prior to 7.0.5 Prior to 7.1.7 Prior to 7.2.3 Session Smart Router Prior to 7.0.5 Prior to 7.1.7 Prior to 7.2.3 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. 2026-10 On-Demand Security Bulletin: Session Smart Router and Session…
Serial number: AV26-1100 Date: October 28, 2026 As of October 27, 2026, Mozilla is affected by vulnerabilities in the following products: Firefox Prior to 159 Firefox ESR Prior to 115.44 Prior to 153.6 Thunderbird Prior to 159 Prior to 153.6 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Mozilla Foundation Security Advisory 2026-118 Mozilla Foundation Security Advisory 2026-119 Mozilla Foundation…
Serial number: AV26-1099 Date: October 28, 2026 As of October 26, 2026, Apple is affected by vulnerabilities in the following products: iOS and iPadOS Prior to 18.7.11 Prior to 26.7.2 Prior to 27.2 MacOS (Golden Gate/Tahoe/Sequoia) Prior to 27.2 Prior to 26.7.2 Prior to 15.8.2 visionOS Prior to 27.2 tvOS Prior to 27.2 watchOS Prior to 27.2 Safari Prior to 27.2 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become…
Serial number: AV26-028 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The…
Serial number: AV26-1098 Date: October 28, 2026 As of October 28, 2026, Progress is affected by a vulnerability in the following product: Telerik Document Processing Libraries Prior to 2026.3.1027 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Document Processing Libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing (CVE-2026-118035) Progress Trust…
On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories. Important: The Cisco PSIRT does…
Serial number: AV26-1097 Date: October 28, 2026 As of October 27, 2026, Tanium is affected by vulnerabilities in the following products: Certificate Manager Prior to 1.17.417 Prior to 1.18.368 Prior to 1.22.119 Endpoint Configuration Toolset Solution Prior to 1.51.60 Prior to 1.59.50 Prior to 1.71.25 Enforce Prior to 2.10.778 Prior to 2.9.736 Prior to 3.0.373 Provision Prior to 1.17.150 Prior to 1.23.161 Prior to 1.24.199 Threat Response Prior to 4.12.349 Prior to 4.17.327 Prior to 4.9.476 end…
Serial number: AV26-1096 Date: October 28, 2026 As of October 27, 2026, Veeam is affected by vulnerabilities in the following products: Veeam Agent for Linux Prior to 13.1.2 Veeam Backup and Replication Prior to 13.0.3 Prior to 13.1.2 Veeam Backup for Microsoft 365 Prior to or equal to 8.5.0.1014 Prior to or equal to 8.6.0.1102 Veeam ONE Prior to or equal to 13.1.0.7233 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they…
Serial number: AV26-1095 Date: October 28, 2026 As of October 27, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 156.0.8078.73/.74 (Windows/Mac), and 156.0.8078.73 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Google Chrome Security Advisory
Serial number: AV26-1094 Date: October 28, 2026 As of October 27, 2026, WatchGuard is affected by vulnerabilities in the following products: Fireware OS Multiple versions Mobile VPN with SSL Client Prior to 2026.4 Prior to 12.0 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. WatchGuard Security Advisories
Serial number: AV26-1093 Date: October 28, 2026 As of October 27, 2026, TeamViewer is affected by vulnerabilities in the following products: TeamViewer Full Client & Host (Windows) Prior to 15.83 TeamViewer Full Client & Host (Linux) Prior to 15.83 TeamViewer Full Client & Host (macOS) Prior to 15.83 TeamViewer Host (Windows, Linux, macOS) Prior to 15.83 TeamViewer Portable (Windows) Prior to 15.83 TeamViewer Remote Control App (Android) Prior to 15.8.3 The Cyber Centre encourages users and…
Aggiornamenti di sicurezza Dell Technologies sanano molteplici vulnerabilità, di cui 7 con gravità "critica" e 18 con gravità "alta" che interessano i prodotti PowerProtect Data Domain, Data Domain Virtual Edition e Dell APEX Protection Storage, soluzioni di storage per backup e protezione dei dati basate sulla tecnologia Data Domain.
Serial number: AV26-1092 Date: October 28, 2026 As of October 27, 2026, Adobe is affected by vulnerabilities in the following products: Adobe Substance 3D Painter Prior to or equal to 12.1.5 Creative Cloud Desktop Application Prior to or equal to 6.10 Adobe Campaign Classic Prior to or equal to 7.4.4 build 9402 Adobe Connect Android Mobile App Prior to or equal to 4.4 Adobe Connect Desktop App Prior to or equal to 2026.8.51 (Win), 2026.08.45 (Mac Silicon), 2026.01.39 (Mac Intel) The Cyber…
Arista heeft een kritieke kwetsbaarheid verholpen in VeloCloud Orchestrator (VCO) On-Prem. De kwetsbaarheid met kenmerk CVE-2026-114625 heeft een CVSS-score van 9.9 en betreft SQL-injectie. Een geauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken om verhoogde rechten te verkrijgen en zich voor te doen als een lokale 'superuser operator'. Hierdoor kan de kwaadwillende toegang krijgen tot interne beheerfunctionaliteiten en mogelijk de vertrouwelijkheid, integriteit en…
Rilevate 11 vulnerabilità, di cui 3 con gravità “alta”, nei prodotti Acronis Cyber Protect 17 e Cyber Protect Cloud Agent. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di accedere ad informazioni sensibili e manipolarle, nonché di elevare i propri privilegi sui sistemi interessati.
On October 27, Google issued a new Stable channel update for Chrome. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. The update includes 52 security fixes, including four rated Critical. On the same day, Mozilla issued Security Advisory 2026-118, which fixes 167 vulnerabilities. Firefox 159 also introduces several new features. Both updates will roll out over the coming days and weeks. How…
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 52 nuove vulnerabilità di sicurezza, di cui 4 con gravità “critica” e 46 con gravità “alta”.
Cisco heeft kwetsbaarheden verholpen in Secure Firewall ASA, Threat Defense en Management Center softwareproducten. Cisco heeft de kwetsbaarheden gegroepeerd naar acht verschillende kwetsbaarheidsklassen (CWE's) en aan iedere groep één CVE-kenmerk toegekend. De kwetsbaarheden betreffen verschillende beveiligingsproblemen, waaronder onvoldoende toegangscontrole, onjuiste verwerking van invoergegevens, fouten in beveiligingsmechanismen en onjuiste afhandeling van uitzonderingssituaties. Vier van…
Background Network-connected surveillance cameras are now widespread in both home and enterprise environments, so securing them is essential to safeguarding physical spaces and sensitive assets. As these devices continue to gain new features and network connectivity capabilities, vulnerabilities in their implementation can have significant security implications. During our research, we discovered a denial-of-service vulnerability that affects Intelbras IP cameras systems. The flaw resides in a…
Veeam ha rilasciato aggiornamenti di sicurezza per risolvere 9 vulnerabilità, di cui 2 con gravità “critica” e 3 con gravità “alta”, nei prodotti Backup and Replication, ONE, Agent per Linux e Backup per Microsoft 365.
TeamViewer ha rilasciato aggiornamenti di sicurezza per sanare 9 vulnerabilità con gravità “alta” in vari prodotti. Tali vulnerabilità potrebbero consentire a un attaccante, in alcuni casi non autenticato, di elevare i propri privilegi o di eseguire codice arbitrario sui sistemi interessati.
Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise. In Splunk Enterprise zijn verschillende kwetsbaarheden aanwezig in versies eerder dan 10.4.4 (en enkele andere specifieke versies). Deze omvatten onder andere: - onjuiste verificatie in de Data Management REST API waardoor gebruikers met bepaalde rollen toegang kunnen krijgen tot of verwijderen van SPL2 preview jobs en resultaten die zij niet bezitten - onvoldoende limieten in request-header parsing in de JavaScript logger…
Aggiornamenti di sicurezza sanano una vulnerabilità con gravità "alta" in OAuthLib, libreria open source per Python ampiamente utilizzata per l'implementazione dei protocolli di autorizzazione OAuth 1.0 e OAuth 2.0. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di eludere i meccanismi di autenticazione sui sistemi interessati.
SQL injection (SQLi) in the user authentication module of Futurum Software Wed, 10/28/2026 - 09:52 Aviso Affected Resources User authentication module for the business management platform. Description INCIBE has coordinated the disclosure of a critical severity vulnerability affecting the user authentication module of Futurum Software, a cloud-based business management platform designed to create and manage multi-level marketing businesses. The vulnerability was discovered by Diego González…
Multiple Vulnerabilities in Tactis' NoviGest Desktop App Wed, 10/28/2026 - 09:47 Aviso Affected Resources NoviGest Desktop App, version 7.4.4-292: Java RMI service and XML file import from the SAFT module. Description INCIBE has coordinated the disclosure of two vulnerabilities—one critical and one high severity—that affect NoviGest Desktop App by Tactis Serviços Informáticos, LDA, a clinical management software application. The vulnerabilities were discovered by Pablo Jordán Lucia and Marina…
WatchGuard ha rilasciato aggiornamenti di sicurezza per sanare molteplici vulnerabilità, di cui 7 con gravità “critica” e 7 con gravità “alta”, in Fireware OS, sistema operativo utilizzato nei dispositivi di sicurezza perimetrale e di protezione delle reti. Tali vulnerabilità potrebbero consentire a un utente malintenzionato, in determinate condizioni, di eseguire codice arbitrario, di eludere i meccanismi di autenticazione, di accedere a informazioni sensibili o di compromettere la disponibilit
Adobe ha rilasciato aggiornamenti di sicurezza per risolvere 12 vulnerabilità, di cui 9 con gravità “critica” e 2 con gravità “alta”, nei prodotti Substance 3D Painter, Connect Desktop, Connect Mobile, Campaign Classic, Creative Cloud Desktop Application.
Aggiornamenti di sicurezza sanano 180 vulnerabilità di sicurezza, di cui 3 con gravità “critica” e 113 con gravità “alta”, nei prodotti Firefox, Firefox ESR, Thunderbird.
Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the meantime, interim mitigations from the Qualys Threat Research Unit narrow the Brotli, DNS, TLS, and keep-alive attack paths, and WAF, IPS, and EDR…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-86974.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2026-112656.
This vulnerability allows local attackers to escalate privileges on affected installations of AVG Internet Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-6064.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Valkey. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118613.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118614.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118615.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118616.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118617.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118618.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118619.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118601.
This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-118602.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2026-118603.