Sunday, October 25, 2026
Automatically Curated Security Digest
Collected
35 Articles
Across
3 Trusted Sources
Published
Last Updated 11:22 AM UTC
Coverage
Why it matters
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
35
Articles
3
Sources
27
CVEs
2
Alerts
0
Research
10m
Read Time
Feed Status
Automated Security Digest — This page is an automatically curated cybersecurity digest generated from publicly available security feeds. All articles remain the property of their respective publishers. Click any item to read the original article.
Last generated: Oct 25, 2026, 11:22 AM
Jump to Section
Critical alerts and advisories from official agencies.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability This type of vulnerability is a frequent attack vector…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious…
New and notable Common Vulnerabilities and Exposures.
CVE ID :CVE-2026-115995 Published : Oct. 24, 2026, 11:16 p.m. | 12 hours, 5 minutes ago Description :A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the…
CVE ID :CVE-2026-114820 Published : Oct. 24, 2026, 7:17 p.m. | 16 hours, 5 minutes ago Description :Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected…
CVE ID :CVE-2026-115933 Published : Oct. 24, 2026, 3:17 p.m. | 20 hours, 5 minutes ago Description :Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a…
CVE ID :CVE-2026-115557 Published : Oct. 24, 2026, 3:17 p.m. | 20 hours, 5 minutes ago Description :Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised…
CVE ID :CVE-2026-115932 Published : Oct. 24, 2026, 1:16 p.m. | 22 hours, 6 minutes ago Description :When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload…
CVE ID :CVE-2026-116019 Published : Oct. 24, 2026, 12:16 p.m. | 23 hours, 5 minutes ago Description :Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with…
CVE ID :CVE-2026-116014 Published : Oct. 24, 2026, 12:16 p.m. | 23 hours, 5 minutes ago Description :open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A…
CVE ID :CVE-2026-116011 Published : Oct. 24, 2026, 12:16 p.m. | 23 hours, 5 minutes ago Description :Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested…
CVE ID :CVE-2026-116009 Published : Oct. 24, 2026, 12:16 p.m. | 23 hours, 5 minutes ago Description :Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name…
CVE ID :CVE-2026-110018 Published : Oct. 24, 2026, 12:16 p.m. | 23 hours, 5 minutes ago Description :The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions…
CVE ID :CVE-2026-94075 Published : Oct. 24, 2026, 8:16 a.m. | 1 day, 3 hours ago Description :Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.…
CVE ID :CVE-2026-114196 Published : Oct. 24, 2026, 8:16 a.m. | 1 day, 3 hours ago Description :Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. Severity: 9.8 | CRITICAL…
CVE ID :CVE-2026-112866 Published : Oct. 24, 2026, 8:16 a.m. | 1 day, 3 hours ago Description :Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This…
CVE ID :CVE-2026-111402 Published : Oct. 24, 2026, 8:16 a.m. | 1 day, 3 hours ago Description :Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue…
CVE ID :CVE-2026-110956 Published : Oct. 24, 2026, 6:16 a.m. | 1 day, 5 hours ago Description :The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so…
CVE ID :CVE-2026-115806 Published : Oct. 24, 2026, 5:17 a.m. | 1 day, 6 hours ago Description :The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in…
CVE ID :CVE-2026-115931 Published : Oct. 23, 2026, 11:17 p.m. | 1 day, 12 hours ago Description :Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call…
CVE ID :CVE-2026-115938 Published : Oct. 23, 2026, 10:16 p.m. | 1 day, 13 hours ago Description :Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed…
CVE ID :CVE-2026-115937 Published : Oct. 23, 2026, 10:16 p.m. | 1 day, 13 hours ago Description :The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft…
CVE ID :CVE-2026-115935 Published : Oct. 23, 2026, 10:16 p.m. | 1 day, 13 hours ago Description :The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline…
CVE ID :CVE-2026-115895 Published : Oct. 23, 2026, 10:16 p.m. | 1 day, 13 hours ago Description :Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts…
CVE ID :CVE-2026-115893 Published : Oct. 23, 2026, 10:16 p.m. | 1 day, 13 hours ago Description :Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than…
CVE ID :CVE-2026-115889 Published : Oct. 23, 2026, 10:16 p.m. | 1 day, 13 hours ago Description :Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds…
CVE ID :CVE-2026-58202 Published : Oct. 23, 2026, 9:17 p.m. | 1 day, 14 hours ago Description :OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built…
CVE ID :CVE-2026-115775 Published : Oct. 23, 2026, 9:17 p.m. | 1 day, 14 hours ago Description :Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an…
Latest news from trusted cybersecurity publications.
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]
Read OriginalResearchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]
Read OriginalMicrosoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]
Read OriginalMicrosoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]
Read OriginalAmerican clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]
Read OriginalThe PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
Read OriginalAI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub helps protect agents through skill verification, secure…
Read OriginalHewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]
Read Original