Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM) ↗ (opens in a new tab)

  Palo Alto Security Advisories · Published 2026-10-17 · First collected 2026-10-24

• SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename ↗ (opens in a new tab)

  Chocapikk's Cybersecurity Blog · Published 2026-10-17 · First collected 2026-10-24

• CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability ↗ (opens in a new tab)

  Zscaler Research Blogs · Published 2026-10-16 · First collected 2026-10-24

• One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux ↗ (opens in a new tab)

  QTNKSR · Published 2026-10-16 · First collected 2026-10-24

• SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename ↗ (opens in a new tab)

  VulnCheck Blog · Published 2026-10-16 · First collected 2026-10-24

• The Q3 Vulnerability Pulse: Discovery ≠ Exploitation ↗ (opens in a new tab)

  Cisco Talos Blog · Published 2026-10-15 · First collected 2026-10-24

• TP-Link Archer AX73 and BE230: two command injection vulnerabilities ↗ (opens in a new tab)

  FuzzingLabs · Published 2026-10-15 · First collected 2026-10-24

• Open Source Security Signals | Q3 2026 ↗ (opens in a new tab)

  Red Hat Security · Published 2026-10-15 · First collected 2026-10-24

• Critical GitLab RCE Lets Unauthenticated Attackers Execute Code on Servers (CVE-2026-97229) ↗ (opens in a new tab)

  Orca Security Blog · Published 2026-10-14 · First collected 2026-10-24

• Newly Exploited Vulnerability in Ivanti Connect Secure ↗ (opens in a new tab)

  Security Magazine · Published 2026-10-14 · First collected 2026-10-24

• Micropatches released for Windows Power Dependency Coordinator Elevation of Privilege (CVE-2026-69459) ↗ (opens in a new tab)

  0patch Blog · Published 2026-10-14 · First collected 2026-10-24

• Sonar's new JS/TS engine: Tracing meaning, not syntax, to hunt down real vulnerabilities ↗ (opens in a new tab)

  Sonar Blog · Published 2026-10-14 · First collected 2026-10-24

• Microsoft Patch Tuesday – October 2026 ↗ (opens in a new tab)

  Outpost24 · Published 2026-10-14 · First collected 2026-10-24

• Passkeys Are Not a Trap ↗ (opens in a new tab)

  Scott Helme · Published 2026-10-14 · First collected 2026-10-24

• FreeBSD-EN-26:27.tcp ↗ (opens in a new tab)

  FreeBSD security · Published 2026-10-14 · First collected 2026-10-24

• Microsoft Patches More Than 1,400 Security Flaws ↗ (opens in a new tab)

  Krebs on Security · Published 2026-10-13 · First collected 2026-10-24

• October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities ↗ (opens in a new tab)

  CrowdStrike Blog · Published 2026-10-13 · First collected 2026-10-24

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer ↗ (opens in a new tab)

  Huntress Blog · Published 2026-10-08 · First collected 2026-10-24

• Frontier models found the vulnerabilities. Only the attacker found the chains. ↗ (opens in a new tab)

  Blog RSS Feed | Snyk · Published 2026-10-07 · First collected 2026-10-24

• You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) ↗ (opens in a new tab)

  watchTowr Labs · Published 2026-10-06 · First collected 2026-10-24

• Can Vulnerability Scanning Tell You What You’re Exposed to Right Now? ↗ (opens in a new tab)

  Aqua · Published 2026-10-06 · First collected 2026-10-24

• SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities ↗ (opens in a new tab)

  SonicWall PSIRT · Published 2026-10-06 · First collected 2026-10-24

• Zammad vulnerabilities: Find impacted installations ↗ (opens in a new tab)

  runZero Blog · Published 2026-10-02 · First collected 2026-10-24

• SequenceHash: multihashing for the rest of us ↗ (opens in a new tab)

  The Trail of Bits Blog · Published 2026-10-02 · First collected 2026-10-24

• Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization ↗ (opens in a new tab)

  Threat Intelligence Blog | Flashpoint · Published 2026-10-01 · First collected 2026-10-24

• Vulnerability & Patch Roundup — September 2026 ↗ (opens in a new tab)

  Sucuri Blog · Published 2026-10-01 · First collected 2026-10-24

• V12 found a critical bug in Better Auth ↗ (opens in a new tab)

  V12 · Published 2026-10-01 · First collected 2026-10-24

• Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators ↗ (opens in a new tab)

  LevelBlue (SpiderLabs Blog) · Published 2026-09-30 · First collected 2026-10-24

• Safe, but sailing nowhere. Can you stop a fleet of ships? ↗ (opens in a new tab)

  Pen Test Partners · Published 2026-09-30 · First collected 2026-10-24

• Initial access through embedded devices: a vulnerability in lwIP ↗ (opens in a new tab)

  ByteRay Blog · Published 2026-09-30 · First collected 2026-10-24