Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku. Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl jen odkazovat, třeba jako na starší kauzu.
De multiples vulnérabilités ont été découvertes dans GLPI. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, une injection SQL (SQLi) et une injection de code indirecte à distance (XSS).
GLPI FR
Une vulnérabilité a été découverte dans Mattermost Server. Elle permet à un attaquant de provoquer un déni de service à distance.
EPSS 0.00 CVE-2026-116516 Mattermost FR
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update. Noteworthy Issue: CVE-2026-86950: This is an already exploited vulnerability in CoreGraphics, and was patched originally a month ago. This month's update delivers the corresponding patches for iOS 18. No new vulnerability is marked as already exploited. Other Interesting issues: CVE-2026-86990: A malicious app may access the camera…
Apple US
Serial Number: AV26-1087 Date: October 26, 2026 As of October 26, 2026, HashiCorp is affected by a vulnerability in the following products: Consul Prior to 2.1.0 Consul Enterprise Prior to 1.21.19 Prior to 2.1.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API Security - HashiCorp Discuss
HashiCorp CA
Serial number: AV26-1086 Date: October 26, 2026 As of October 23, 2026, Craft CMS is affected by vulnerabilities in the following products: CMS Prior to 4.18.9 Prior to 5.11.2 Commerce-mollie Prior to 4.4.3 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. craftcms/cms 5.11.2 craftcms/commerce-mollie 4.4.3 Craft CMS Seccurity Advisories
Craft CMS CA
Serial number: AV26-1085 Date: October 26, 2026 As of October 22, 2026, Google is affected by a vulnerability in the following product: Brotli Versions 1.0.3 to versions prior to v1.0.10 Versions 1.1.0 to versions prior to v1.1.1 Versions 1.2.0 to versions prior to v1.2.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Brotli Releases
CERT Polska has received a report about 11 vulnerabilities (from CVE-2026-77052 to CVE-2026-77062) found in boneIO products.
EPSS 0.01 CVE-2026-77052 CVE-2026-77062 boneIO PL
Serial number: AV26-1084 Date: October 26, 2026 As of October 20, 2026, Red Hat is affected by vulnerabilities in the following products: Red Hat Enterprise Linux 10 All versions Red Hat Enterprise Linux 6 All versions Red Hat Enterprise Linux 7 All versions Red Hat Enterprise Linux 8 All versions Red Hat Enterprise Linux 9 All versions StreamsHub Console for Apache Kafka Prior to 0.12.10 Prior to 0.14.2 Streams for Apache Kafka 2 All versions Streams for Apache Kafka 3 All versions The Cyber…
Red Hat CA
You may have forgotten about Popcorn Time. Unfortunately, its updater didn’t forget about your device. Security researchers have intervened to disable an abandoned update mechanism in Time4Popcorn, a version of the once-popular streaming app. If left running in the background, the updater could have allowed attackers to take control of Windows and Mac computers, even if their owners hadn’t opened the app in years. Eye Security estimates that the vulnerable updater was present on millions of…
EPSS 0.00 CVE-2026-30612 Time4Popcorn Popcorn Time US
HPE heeft 72 kwetsbaarheden verholpen in HPE Networking AOS-8 en AOS-10, waaronder Mobility Conductors, Mobility Controllers, Mobility Gateways en Access Points. De kwetsbaarheden betreffen verschillende beveiligingsproblemen, waaronder authenticatieomzeiling, command- en SQL-injectie, buffer-overflows en onvoldoende toegangscontrole. Van de in totaal 72 kwetsbaarheden zijn 33 als kritiek aangemerkt. Hiervan kunnen 19 volgens HPE Networking zonder authenticatie op afstand via het netwerk worden…
EPSS 0.02 CVE-2026-79844 CVE-2026-79845 CVE-2026-79846 CVE-2026-79847 CVE-2026-79848 CVE-2026-79849 CVE-2026-79850 CVE-2026-79851 CVE-2026-79857 CVE-2026-79860 HPE NL
Serial number: AV26-1083 Date: October 26, 2026 As of October 26, 2026, Siemens is affected by a vulnerability in the following products: Mendix SAML (Mendix 10 compatible) Prior to V4.2.4 Mendix SAML (Mendix 11 compatible) Prior to V4.2.4 Mendix SAML (Mendix 9 compatible) Prior to V3.6.29 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. SSA-137528: Authentication Bypass Vulnerability in Mendix SAML…
Siemens CA
Serial number: AV26-1082 Date: October 26, 2026 As of October 20, 2026, IBM is affected by vulnerabilities in the following products: IBM App Connect Enterprise Versions 13.0.1.0 to 13.0.8.2 IBM Guardium Data Protection Version 12.1 Version 12.2 Planning Analytics Version 2.0 Version 2.1 IBM QRadar Versions 7.5.0 to 7.5.0 Update Package 16 Interim Fix 001 Versions 7.6.0.0 to 7.6.0.4 IBM QRadar Security Information and Event Management Versions 7.4-20210823144546 to 7.5-20260930064858 Versions 7…
IBM CA
Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio Mon, 10/26/2026 - 13:03 Aviso Affected Resources Gym Management Software, versions prior to v6.0.85. Description INCIBE has coordinated the publication of a medium severity vulnerability affecting Gym Management Software IsMyGym by Zuinq Studio, software for managing sports centers, gyms, and trainers. The vulnerability was discovered by Gonzalo Aguilar García (6h4ack). This vulnerability has been assigned the following code,…
EPSS 0.00 CVSS 5.1 CVE-2026-4316 Zuinq Studio ES
Disponibili Proof of Concept per diverse vulnerabilità, già sanate dal vendor, presenti in Rclone, software open source per la sincronizzazione e il trasferimento di file verso servizi di archiviazione remota e cloud.
EPSS 0.00 CVE-2026-116187 CVE-2026-116188 CVE-2026-116189 CVE-2026-116190 CVE-2026-116191 CVE-2026-116192 CVE-2026-116193 CVE-2026-116194 CVE-2026-116195 CVE-2026-116196 rclone IT
Aggiornamenti di sicurezza sanano 2 vulnerabilità con gravità “alta”, in Craft CMS, noto strumento per la gestione di siti web e-commerce. Tali vulnerabilità potrebbero consentire a un attaccante remoto autenticato di eseguire codice arbitrario sui sistemi interessati.
EPSS 0.00 CVE-2026-115935 CVE-2026-115938 Craft CMS IT
Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha Mon, 10/26/2026 - 09:38 Aviso Affected Resources Web application for the video library of the Regional Parliament of Castile-La Mancha, available at http://videoteca.cortesclm.es/. Description INCIBE has coordinated the disclosure of a medium severity vulnerability affecting the web application for the Castile-La Mancha Regional Parliament’s video library. The vulnerability was discovered by…
EPSS 0.00 CVSS 5.1 CVE-2026-103377 Cortes de Castilla-La Mancha veřejná správa ES
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92211.
CVSS 7.8 CVE-2026-92211 Pixar US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.
CVSS 8.1 CVE-2026-114550 libwebsockets US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
CVSS 7.8 Meta US
Classification: Important, Solution: Workaround, Exploit Maturity: Proof-of-Concept, CVSSv3.1: None, CVEs: , Summary: A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The…
Tailscale FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1, CVEs: CVE-2026-114820, Summary: This Security Alert addresses CVE-2026-114820 by providing Java updates which removes the set of impacted root CA certificates related to eMudhra. To address this CVE, update to the latest Java version or apply the recommended mitigations. Affected Products and Versions: - Oracle GraalVM Enterprise Edition, version 21.3.20.0.2 - Oracle GraalVM for JDK, versions 17.0.21…
EPSS 0.00 CVSS 9.1 CVE-2026-114820 Oracle FI
CISA added CVE-2026-109619 to the Known Exploited Vulnerabilities catalog. Affected product: PHP Group PHP. Remediation due date: 2026-10-29.
KEV ✓ EPSS 1.00 CVE-2026-109619 PHP Group US
CISA added CVE-2026-109618 to the Known Exploited Vulnerabilities catalog. Affected product: PHP Group PHP. Remediation due date: 2026-10-29.
KEV ✓ EPSS 1.00 CVE-2026-109618 PHP Group PHP US HU
De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
EPSS 0.00 CVE-2026-114643 CVE-2026-114644 CVE-2026-114645 CVE-2026-114646 CVE-2026-114647 CVE-2026-114648 CVE-2026-114649 CVE-2026-114650 CVE-2026-114651 CVE-2026-114652 CVE-2026-114653 CVE-2026-114654 CVE-2026-114655 CVE-2026-115929 MongoDB FR
De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
VMware FR
Une vulnérabilité a été découverte dans Citrix XenServer. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
EPSS 0.00 CVE-2026-114406 Citrix FR
De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Elles permettent à un attaquant de provoquer une élévation de privilèges.
KEV ✓ EPSS 0.83 CVE-2026-111497 CVE-2026-114148 Microsoft FR
Une vulnérabilité a été découverte dans Mattermost Server. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Mattermost FR
De multiples vulnérabilités ont été découvertes dans CPython. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.
EPSS 0.01 CVE-2026-114583 CVE-2026-115557 CPython FR
Dalle attività di monitoraggio del CSIRT Italia e dall'analisi dell'esposizione nazionale emerge che l'81,9% dei servizi PHP con versione identificata risulta potenzialmente vulnerabile a PHP2Shell. Si sollecita l'aggiornamento immediato e la disabilitazione di session.upload_progress.enabled per la CVE-2026-115560, ancora priva di patch. Ove disponibili regole specifiche, configurare i WAF in modalità blocco; in assenza di mitigazioni efficaci, valutare di porre offline i servizi.
CVE-2026-115560 PHP IT FR
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-114148 US
Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected intermediates have been revoked and blocked by major platform vendors, including Chrome, Mozilla, Apple, and Microsoft. The issue is tracked as CVE-2026-111943 and CVE-2026-111944. The eMudhra Certificate…
EPSS 0.00 CVE-2026-111943 CVE-2026-111944 eMudhra Qualys US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0, CVEs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851, CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, CVE-2026-79861, CVE-2026-79862, CVE-2026-79863 (+52 other associated CVEs), Summary: Summary HPE Networking has released…
CVSS 10.0 FI
Classification: Severe, Solution: Workaround, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-115560, Summary: Informational advisory: Session upload progress We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further…
KEV ✓ EPSS 1.00 CVE-2026-109619 CVE-2026-115560 PHP FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: , Summary: Fortinet has released a coordinated set of security updates for FortiOS, FortiManager, and FortiAnalyzer following recent releases from FortiMail and FortiAuthenticator. They strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices. These releases include fixes to address vulnerabilities…
Fortinet FI
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise…
eMudhra US
Aggiornamenti di sicurezza sanano molteplici vulnerabilità di sicurezza, di cui 5 con gravità “alta”, in Firefox, Firefox ESR e Thunderbird.
EPSS 0.00 CVE-2026-113399 CVE-2026-113470 CVE-2026-113866 CVE-2026-113867 CVE-2026-113868 Mozilla IT
Serial number: AV26-1081 Date: October 23, 2026 As of October 21, 2026, Fortinet is affected by vulnerabilities in the following products: FortiAnalyzer 8.0 Versions prior to 8.0.2 FortiAnalyzer 7.6 Versions prior to 7.6.8 FortiAnalyzer 7.4 Versions prior to 7.4.12 FortiAnalyzer 7.2 Versions prior to 7.2.13 FortiAuthenticator 8.0 Versions prior to 8.0.4 FortiAuthenticator 6.6 Versions prior to 6.6.11 FortiMail 8.0 Versions prior to 8.0.2 FortiMail 7.6 Versions prior to 7.6.7 FortiMail 7.4…
Fortinet CA
Serial number: AV26-1079 Date: October 22, 2026 As of October 22, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following product: HPE Networking Wireless Operating Systems - AOS Versions prior to 10.8.1.2 Versions prior to 10.7.2.7 Versions prior to 10.4.1.14 Versions prior to 8.13.3.1 Versions prior to 8.10.0.24 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.…
HPE CA
Serial number: AV26-1078 Date: October 22, 2026 As of October 22, 2026, MongoDB is affected by vulnerabilities in the following product: C# Driver Prior to 3.13.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization Authentication bypass via issuer-and-serial-only certificate equality in shared cluster…
MongoDB CA
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]
CVE-2026-79844 * CVE-2026-79845 * CVE-2026-79846 * CVE-2026-79847 * CVE-2026-79848 * CVE-2026-79849 * CVE-2026-79850 * CVE-2026-79851 * Hewlett Packard Enterprise US
I veckans brev kan du läsa om de två kritiska sårbarheterna i programmeringsspråket PHP, som används av en mängd webbplatser över hela världen. Du hittar även en rapport från bland annat CISA om utpressningsaktören Safepay.
PHP SE
DESCRIERE În data de 21.10.2026, GitLab a publicat actualizările de securitate 19.5.1, 19.4....
GitLab RO
Disponibili Proof of Concept per diverse vulnerabilità, già sanate dal vendor, presenti nella componente C# Driver di MongoDB. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malevolo di accedere a informazioni sensibili, manipolare i dati, compromettere la disponibilità del servizio o impersonare entità legittime sui sistemi interessati.
EPSS 0.00 CVE-2026-114643 CVE-2026-114644 CVE-2026-114646 CVE-2026-114647 CVE-2026-114648 CVE-2026-114649 CVE-2026-114650 CVE-2026-114651 CVE-2026-114652 CVE-2026-114653 CVE-2026-114654 MongoDB IT