Exploited bugs, new critical vulnerabilities, and what defenders should check.
ExploitedCVE-2026-104935CVSS 8.62 min read
Ivanti updated its advisory on October 29 to add a privilege escalation bug and a file upload bug, both now fixed and both in CISA's KEV list. Volexity says the chain was used against an appliance from October 3.
Brief2 min read
Researchers at Parameter say a malicious share link could execute code in the session of anyone who opened it and expose private conversations. OpenAI fixed the flaw and rated it P1.
ExploitedCVE-2026-97229CVSS 10.02 min read
The critical GitLab CE/EE bug lets an unauthenticated user run code on the server through a crafted regular expression in a CI/CD configuration. Federal agencies face a November 1 remediation deadline.
CVE-2026-111585CVSS 8.82 min read
Security firm Remedio says an integer overflow in TeamViewer's screen processing can be triggered from inside an ordinary session, letting a hostile host crash or run code on the viewer's system. TeamViewer has patched it.
CVE-2026-98432CVSS 9.82 min read
Anthropic researchers built an exploit for a use-after-free in IPv4 TCP handling that reached root on a server with an MPTCP listener. Patches are landing, but several major distros were still listed as vulnerable on October 30.
ExploitedCVE-2026-102764CVSS 9.32 min read
Researchers chained an origin-validation gap in the appliance's internal message router to write a PHP file into the public web directory, running code as the site user. CISA added the flaw to its known exploited vulnerabilities catalog.
CVE-2026-118539CVSS 6.52 min read
Drupal says unauthenticated attackers are exploiting a missing authorization flaw in the Commerce Core module and is urging admins to upgrade and audit orders for inconsistencies.
ExploitedCVE-2026-109618CVSS 9.22 min read
A China-linked group chained the PHP flaws with a kernel privilege-escalation bug to get root on PAN-OS devices, while mass scanning against WordPress has yet to produce confirmed compromises.
Brief2 min read
Defiant says threat actors began hitting a race condition in WordPress's update process within hours of the fix, though the exploit window is narrow and no successful compromises are reported.
CVE-2026-118539CVSS 6.52 min read
Drupal says the highly critical flaw in its e-commerce module is under active attack and tells store owners to audit their orders.
ExploitedCVE-2026-97229CVSS 10.02 min read
A newly registered account sent crafted CI configurations to Alpine's GitLab instance on October 20 and 21. The attack failed, but the project rebuilt the server and reset all passwords.
ExploitedCVE-2026-46817CVSS 9.82 min read
Defused says its decoys logged exploratory exploitation attempts against a critical SQL injection flaw in Oracle E-Business Suite's Application Object Library, patched in Oracle's October CPU.
