News
-
Cisco Security Advisories
Cisco Advance Notification for Publication of November 4, 2026, Security Advisories
On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories. Important: The Cisco PSIRT does not plan to publish any more security hardening advisories to disclose security vulnerability infor…
-
Cisco Security Advisories
Vulnerabilities in node.js Affecting Cisco Products: October 2026
On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release. The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: CVE-2026-111497 - Brotli decoder out-of-bounds write; potential rem…
CVE-2026-111497 -
Ubuntu Security Notices
USN-8956-2: Brotli vulnerability
USN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
-
Google Chrome stable releases
Chrome for Android Update
Hi, everyone! We've just released Chrome 156 (156.0.8078.73) for Android. It'll become available on Google Play over the next few days. This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug. Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 156.0.8078.73/.74 Linux: 156.0.8078.73) unless otherwise noted. Krishna Govind Google Chrome
-
Google Chrome stable releases
Stable Channel Update for Desktop
The Stable channel has been updated to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. This update includes 52 security fixes. Please see the Chrome Security Page for more information. [N/A][5711…
-
Google Chrome stable releases
Chrome Stable for iOS Update
Hi everyone! We've just released Chrome Stable 157 (157.0.8103.24) for iOS; it'll become available on App Store in the next few hours. This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug. Chrome Release Team Google Chrome
-
Palo Alto Networks Security Advisories
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)
CVE-2026-109618, CVE-2026-109619 -
Ubuntu Security Notices
USN-8957-1: authd vulnerability
Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.
-
Mozilla Foundation Security Advisories
MFSA 2026-118: Security Vulnerabilities fixed in Firefox 159
Impact high. Firefox 159.
-
Mozilla Foundation Security Advisories
MFSA 2026-119: Security Vulnerabilities fixed in Firefox ESR 115.44
Impact high. Firefox ESR 115.44.
-
Mozilla Foundation Security Advisories
MFSA 2026-120: Security Vulnerabilities fixed in Firefox ESR 153.6
Impact high. Firefox ESR 153.6.
-
Mozilla Foundation Security Advisories
MFSA 2026-121: Security Vulnerabilities fixed in Thunderbird 159
Impact high. Thunderbird 159.
-
Mozilla Foundation Security Advisories
MFSA 2026-122: Security Vulnerabilities fixed in Thunderbird 153.6
Impact high. Thunderbird 153.6.
-
CISA ICS Advisories
EPICS Base
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are affected: EPICS Base release <=7.0.10 (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598) CVSS Vendor Equipment v3 9.8 The EPICS Community EPICS Base release 3 Vulnerabilities Integer Overflow or Wraparound, Improper Handling of Length Parameter Inconsistency, Access of Resource Using Incompatible Type ('Type Confusion')…
CVE-2026-114595, CVE-2026-114596, CVE-2026-114597 +1 -
CISA ICS Advisories
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system. The following versions of Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz are affected: Mitsubishi Electric GENESIS64 >=…
CVE-2023-4863, CVE-2026-16436, CVE-2026-16437 +1 -
Zero Day Initiative: published advisories
ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-114551.
CVE-2026-114551 -
Zero Day Initiative: published advisories
ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-114552.
CVE-2026-114552 -
Debian Security Advisories
DSA-6587-1 pdns - security update
https://security-tracker.debian.org/tracker/DSA-6587-1
-
Debian Security Advisories
DSA-6588-1 openjdk-21 - security update
https://security-tracker.debian.org/tracker/DSA-6588-1
-
Debian Security Advisories
DSA-6589-1 php-mongodb - security update
https://security-tracker.debian.org/tracker/DSA-6589-1
-
Debian Security Advisories
DSA-6585-2 thunderbird - regression update
https://security-tracker.debian.org/tracker/DSA-6585-2
-
Debian Security Advisories
DSA-6586-1 valkey - security update
https://security-tracker.debian.org/tracker/DSA-6586-1
-
CERT/CC Vulnerability Notes
VU#701544: mpc-lib hardened derivation fails to protect ancestor isolation
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from. Description Fireblocks is a digital-asset custody and wallet platform that secures the private keys behind cryptocurrency wallets for institutions and exchanges, using multi-party computation (MPC) so that no single machine ever hol…
-
CERT/CC Vulnerability Notes
VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received, allowing a remote, unauthenticated peer to exhaust host memory and deny service. The issue was reported publicly as COVESA/vsomeip issue #1009 and fixed in release 3.7.4 (2026-07-06). Description CVE-2026-91141 vsomeip is a middleware im…
CVE-2026-91141 -
Palo Alto Networks Security Advisories
CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)
CVE-2026-111497 -
HashiCorp security bulletins
HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Bulletin ID: HCSEC-2026-50 Affected Products / Versions: consul-k8s 0.42.0 up to 2.0.4; fixed in consul-k8s 1.8.18 and 2.1.0 Publication Date: October 26, 2026 Summary Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18. Background When system ACL management is enabled, consul-k8s configures Kubernetes authentication and Consul ACL binding rules so its components can obtain Consul…
CVE-2026-110720 -
HashiCorp security bulletins
HCSEC-2026-49 - Consul vulnerable to an authorization bypass in health check registration
Bulletin ID: HCSEC-2026-49 Affected Products / Versions: Consul and Consul Enterprise 0.7.2 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul health checks report the status…
CVE-2026-115804 -
HashiCorp security bulletins
HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs
Bulletin ID: HCSEC-2026-48 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul client and server agents expose an HTTP API for operations such as registering serv…
CVE-2026-105626 -
HashiCorp security bulletins
HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration
Bulletin ID: HCSEC-2026-47 Affected Products / Versions: Consul 2.0.4 and Consul Enterprise 2.0.4, 1.22.12 and 1.21.18; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19…
CVE-2026-105608 -
HashiCorp security bulletins
HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
Bulletin ID: HCSEC-2026-46 Affected Products / Versions: Consul and Consul Enterprise 1.17.0 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent’s service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19…
CVE-2026-105765 -
AWS Security Bulletins
CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)
Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT Description: The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, including granting access to all cluster users. Exploiting the issue requires the ability to influen…
CVE-2026-115418 -
Ubuntu Security Notices
USN-8956-1: Brotli vulnerability
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
-
Ubuntu Security Notices
USN-8955-1: nginx vulnerabilities
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479) It was discovered that nginx incorrectly handled HTTP/3…
CVE-2026-15176, CVE-2026-93479 -
Mozilla Foundation Security Advisories
MFSA 2026-117: Security Vulnerabilities fixed in Firefox for iOS 156.1
Impact moderate. Firefox for iOS 156.1.
-
Apple security releases
iOS 18.7.11 and iPadOS 18.7.11
For iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation.
-
Apple security releases
iOS 26.7.2 and iPadOS 26.7.2
For iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later.
-
Apple security releases
iOS 27.2 and iPadOS 27.2
For iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later.
-
Fortinet PSIRT Advisories
Node2Shell CVEs
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE…
CVE-2026-105482, CVE-2026-105483, CVE-2026-106069 +3 -
Zero Day Initiative: upcoming advisories
ZDI-CAN-34791: Open Asset Importer Library
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Mirae' was reported to the affected vendor on: 2026-10-26, 2 days ago. The vendor is given until 2027-02-23 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
-
Zero Day Initiative: published advisories
ZDI-26-791: Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-92211.
CVE-2026-92211 -
Zero Day Initiative: published advisories
ZDI-26-792: libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-114550.
CVE-2026-114550 -
Zero Day Initiative: published advisories
ZDI-26-793: Meta FAIRChem load_and_preprocess_data Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Meta FAIRChem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.