Attackers chained two vulnerabilities in the AhsayCBS backup server to bypass authentication and execute commands with root privileges, prompting the release of hotfixes.
Drupal released updates for a critical remote code execution flaw in the Field UI module affecting multiple major version branches.
Rapid7 found that a SOAP endpoint in Channel Software WebAlliance allows attackers to execute SQL commands on backend servers without credentials.
Microsoft released fixes for three BitLocker vulnerabilities in October 2026 updates that allow attackers to bypass security controls or elevate privileges.
An unauthenticated remote vulnerability in the Windows Search component allows attackers to gain elevated privileges, rated critical by the NVD.
A critical vulnerability in the Snazzy Social Media Feed plugin allows low-privilege users to upload executable files and run arbitrary code on WordPress sites.
Unauthenticated attackers can bypass access controls on gRPC methods in IBM WebSphere Liberty versions up to 26.0.0.10.
Cisco released updates for a high-severity flaw in UCS servers that allows memory writes to bypass UEFI Secure Boot checks and run unauthorized code.
Attackers used a zero-day flaw to run commands on Ivanti VPN gateways without credentials. Updates exist for most affected versions.
A critical flaw in Docker Hub allowed attackers to hijack personal access tokens during account conversions, posing supply chain risks until a patch was deployed.
A critical authorization flaw in Argo CD allows Git users to bypass project restrictions and create forbidden Kubernetes resources during application deletion events.
A critical flaw in the Metasploit Framework Web Service lets unauthenticated users delete or modify stored credentials, affecting versions through 6.5.4.
A critical CVE-2026-108917 allows remote attackers to execute arbitrary code on Edimax routers through a vulnerable upgrade endpoint.
Edimax BR-6208AC firmware 1.32 has a critical remote buffer overflow vulnerability with published exploits and no vendor response or fix available.
A critical bug in older MarkLogic versions allows users with forest management rights to create unauthorized administrator accounts remotely.
Self-managed GitLab users must upgrade to versions 19.4.2, 19.3.4 or 19.2.8 to fix a critical integer overflow flaw allowing remote code execution.
Researchers say AI-driven tools exploited a known flaw to seize full server control in under a day, signaling a shift in automated attack speed.
The U.S. Cybersecurity and Infrastructure Security Agency added five exploited vulnerabilities to its critical catalog, urging immediate remediation for affected systems.
Wordfence Intelligence published its weekly vulnerability report for late September 2026, urging site owners to review disclosures to protect their platforms.
A critical vulnerability in WineShop versions up to 3.20 allows unauthenticated attackers to inject PHP objects, posing a severe risk to e-commerce sites.
A critical flaw in Wukong_HRM allows unauthenticated access to all HR endpoints, exposing employee data and administrative controls to remote attackers.
Sites running ThemeREX Partiso versions up to 1.1.13 face a CVSS 9.8 risk from untrusted data deserialization attacks.
A critical object injection vulnerability in the Greeny WordPress theme affects versions through 2.10.0, posing severe risks to unpatched sites.
A CVSS 9.8 deserialization flaw in Hogwords versions up to 1.2.7 allows object injection, exposing sites to severe remote compromise risks.