BaselineWatch
9378 unread
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
Register Tracker canaries (EasyPrivacy) 202610271409: first version Tue 27 Oct·Ad canaries (EasyList) 202610271405: 2 changed Tue 27 Oct·NIST SP 800-171 Rev 3 (CUI; CMMC Level 2) OSCAL 1.1.0: first version 22 Oct·the register

News

All News Vendor advisories Known exploited Notable CVEs Releases Unread only
  • Zero Day Initiative: published advisories

    ZDI-26-794: Meta FAIRChem ion_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-795: Meta FAIRChem reaction_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-796: Meta FAIRChem reaction adsorbate_db_path Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-797: Meta FAIRChem dense_eval dft-compute Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-798: Meta FAIRChem dense_eval results-file Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-799: Meta FAIRChem Solvent Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-800: Meta FAIRChem OMolRunner Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-801: Meta FAIRChem Slab Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-802: Meta FAIRChem process_mlrs Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-803: Meta FAIRChem AdsorbMLRunner Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-804: Meta FAIRChem Bulk Class Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-805: Meta FAIRChem Adsorbate Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-806: Meta FAIRChem write_top_k_vasp Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-807: Meta FAIRChem get_computational_df_to_predict Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-808: Meta FAIRChem run_validation Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Zero Day Initiative: published advisories

    ZDI-26-809: Meta FAIRChem dense_eval dft-targets Deserialization of Untrusted Data Remote Code Execution Vulnerability

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.

  • Red Hat Security Blog

    Responsible disclosure in the age of Vulnpocalypse

    New tools can find potential flaws faster than teams can assess and fix them. When a serious flaw is discovered, the central challenge is ensuring maintainers, distributors, and operators receive the clear information and time necessary to defend their users.While AI-assisted research surfaces potential vulnerabilities at a scale that strains human defenders and empowers attackers, discovering flaws is merely the first step. Red Hat has described this ongoing Vulnpocalypse, starting with Mythos Preview in April 2026. Ultimately, dedicated experts must still validate these findings, evaluate th

  • AWS Security Bulletins

    CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles

    Bulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT Summary: AWS identified CVE-2026-111943, a key-generation flaw at external CA eMudhra/emSign that made intermediate CA private keys recoverable. Three roots are affected: AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3. They shipped in AWS-owned trust bundles, exposing soft-fail TLS clients to man-in-the-middle risk. AWS is removing the roots. Customers using CloudFront custom origins or ALB OIDC/JWT auth should check whether their certific…

    CVE-2026-111943
  • Debian Security Advisories

    DSA-6584-1 varnish - security update

    https://security-tracker.debian.org/tracker/DSA-6584-1

  • Debian Security Advisories

    DSA-6585-1 thunderbird - security update

    https://security-tracker.debian.org/tracker/DSA-6585-1

  • Debian Security Advisories

    DSA-6583-1 libheif - security update

    https://security-tracker.debian.org/tracker/DSA-6583-1

  • AWS Security Bulletins

    CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server

    Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT Description: AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment. We identified CVE-2026-115845, an issue in the Python code validator of the run_script tool in AWS MCP Server. An incomplete list of disallowed inputs might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a…

    CVE-2026-115845
  • AWS Security Bulletins

    CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server

    Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT Description: Amazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025. CVE-2026-115812: An issue in model archive extraction could allow a crafted model archive to write files outside the intended directory, potentially resulting in code execution with…

    CVE-2026-115812, CVE-2026-115813
  • AWS Security Bulletins

    CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

    Read this article

    CVE-2026-87912, CVE-2026-87913
  • AWS Security Bulletins

    CVE-2026-87911

    Read this article

    CVE-2026-87911
  • AWS Security Bulletins

    CVE-2026-85788 - Issue with awslabs mysql-mcp-server

    Read this article

    CVE-2026-85788
  • AWS Security Bulletins

    CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

    Read this article

    CVE-2026-84942
  • AWS Security Bulletins

    CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope

    Read this article

    CVE-2026-85787
  • Cisco Security Advisories

    Vulnerabilities in PHP Affecting Cisco Products: October 2026

    On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. For information about Splunk products and offerings, see Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026. Important: If a product is not listed within this advisory,…

    CVE-2026-109618, CVE-2026-109619
  • Apple security releases

    iOS 27.1

    This update has no published CVE entries.

  • Google Chrome stable releases

    Chrome Stable for iOS Update

    Hi everyone! We've just released Chrome Stable 156 (156.0.8078.54) for iOS; it'll become available on App Store in the next few hours. This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug. Chrome Release Team Google Chrome

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-33564: Adobe

    A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-32728: Siemens

    A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Berat.I' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-33565: Adobe

    A CVSS score 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-36541: NVIDIA

    A CVSS score 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Brandon Evans (@0x1nsomnia), Michael DePlante (@izobashi), and John Simpson (@Thracky) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-29632: Siemens

    A CVSS score 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'gardenchair' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-32726: Siemens

    A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Berat.\xc4\xb0' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-29891: Siemens

    A CVSS score 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N severity vulnerability discovered by 'Rocco Calvi (@TecR0c) with TecSecurity' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Zero Day Initiative: upcoming advisories

    ZDI-CAN-34171: Adobe

    A CVSS score 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-10-23, 9 days ago. The vendor is given until 2027-02-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

  • Debian Security Advisories

    DSA-6582-1 brotli - security update

    https://security-tracker.debian.org/tracker/DSA-6582-1

  • Debian Security Advisories

    DSA-6581-1 unbound - security update

    https://security-tracker.debian.org/tracker/DSA-6581-1

  • Debian Security Advisories

    DSA-6579-1 roundcube - security update

    https://security-tracker.debian.org/tracker/DSA-6579-1

  • Debian Security Advisories

    DSA-6580-1 erlang - security update

    https://security-tracker.debian.org/tracker/DSA-6580-1

  • CERT/CC Vulnerability Notes

    VU#763488: Memory corruption vulnerabilities in PHP

    Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve arbitrary code execution. Description PHP is a widely used open-source scripting language designed for web development and server-side applications. It powers millions of websites and web applications worldwide and can be deployed through a variety of server configurations, including PHP-FPM, Apache with…

  • AWS Security Bulletins

    CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt

    Bulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT Description: aws-c-mqtt is a C99 implementation of the MQTT 3.1.1 and MQTT5 specifications, distributed as part of the AWS Common Runtime (CRT) and bundled in the AWS IoT Device SDK for C++ v2. We identified CVE-2026-115417, a memory allocation with excessive size value (CWE-789) in the library's MQTT 3.1.1 compatibility adapter. Under certain conditions, a remote actor could cause a denial of service of the client process. Impacted versions: >= 0.9.1 AND < 0.16.2 Please…

    CVE-2026-115417
  • AWS Security Bulletins

    CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

    Bulletin ID: 2026-146-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:00 PM PDT Description: Strands Agents is an open-source SDK, available for Python and TypeScript, for building AI agents. The SDK includes an Agent2Agent (A2A) server component that exposes an agent over HTTP so other agents and clients can call it. We identified CVE-2026-115419, an issue where the A2A server did not properly isolate conversation state between callers. An authenticated remote user could access another caller's conversation history or influence model behavior for o…

    CVE-2026-115419
  • Ubuntu Security Notices

    USN-8954-1: zlib vulnerability

    Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution.

  • AWS Security Bulletins

    CVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform Hook

    Bulletin ID: 2026-145-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 11:30 AM PDT Description: AWS SAM CLI is an open-source framework for building serverless applications. We identified CVE-2026-115414, an OS command injection issue in the Terraform hook (sam build --hook-name terraform) in AWS SAM CLI. The Terraform hook generates a Makefile recipe that interpolates a Terraform resource address without fully neutralizing shell metacharacters, which could allow an actor who can influence the Terraform configuration or plan file consumed by a build to…

    CVE-2026-115414
  • AWS Security Bulletins

    CVE-2026-115416 - Incorrect authorization checks in Amazon Athena engine version 3 query processing

    Bulletin ID: 2026-144-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 09:30 AM PDT Description: Amazon Athena is an interactive query service that allows you to analyze data in Amazon S3 using standard SQL. We identified CVE-2026-115416, an issue in Amazon Athena engine version 3 query processing where incorrect authorization checks could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible…

    CVE-2026-115416
  • Ubuntu Security Notices

    USN-8953-1: OpenVPN vulnerability

    It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.

Older