Skip to content

Blog

CVE analysis, as it happens

Critical vulnerabilities and CISA KEV additions, explained: what is affected, which versions fix it, and what to check first.

  1. CVE-2026-46300 Linux Kernel in CISA KEV: Page Cache Writes, Chained With PHP2Shell All the Way to Root

    CVE-2026-46300 (7.8): Linux kernel flaw (skbuff, ESP) added to CISA KEV, chained with PHP2Shell to get root. Affected branches, fixes and detection steps.

    CVE-2026-46300 · 5 min

  2. Adobe October 2026: Magento CVE-2026-48356 Added to CISA KEV, Six Critical CVEs in Campaign Classic

    Adobe Commerce and Magento: CVE-2026-48356 (9.3) enters CISA KEV. Campaign Classic: six critical CVEs up to 10.0 (APSB26-162). Affected versions and actions.

    CVE-2026-48356 CVE-2026-105781 CVE-2026-105780 CVE-2026-105779 +3 · 5 min

  3. CVE-2026-111497 Brotli: Google's Decoder Added to CISA KEV, Node.js, .NET, Envoy and Bun Affected

    CVE-2026-111497 (9.8): buffer overflow in the Brotli decoder 1.0.3 to 1.2.0, now in CISA KEV. Node.js, .NET, Envoy, Istio and Bun affected: versions and fixes.

    CVE-2026-111497 · 5 min

  4. TOTOLINK A950RG, Oray X5 Pro, Unitree Go2: 8 Critical CVEs With Public Exploits in Embedded Devices

    CVE-2026-116508 and 7 more: command injection and a stack overflow in the TOTOLINK A950RG router, the Oray X5 Pro router and the Unitree Go2 robot dog.

    CVE-2026-116508 CVE-2026-116506 CVE-2026-116505 CVE-2026-116504 +4 · 5 min

  5. OpenHands, danmu_api, MacCMS: Three Critical Unauthenticated Flaws in Self-Hosted Open Source

    CVE-2026-112346, 116485, 116214: root RCE in the OpenHands agent SDK, takeover of danmu_api and MacCMS accounts. Fixed versions, detection and mitigation.

    CVE-2026-112346 CVE-2026-116485 CVE-2026-116214 · 5 min

  6. YesWiki: Unauthenticated SQL Injection in the Bazar Search API — CVE-2026-116207 (9.1)

    CVE-2026-116207 (9.1, VulnCheck): unauthenticated SQL injection in YesWiki's public Bazar search API lets anyone read password hashes. How it works, what to do.

    CVE-2026-116207 · 4 min

  7. Nextcloud: Built-in Collabora Server (CODE) Exploited, CVE-2026-110447 Added to CISA KEV

    CVE-2026-110447 (9.2): OS command injection in Nextcloud's Built-in Collabora CODE Server app, exploited in September and October. Added to CISA KEV Oct 23.

    CVE-2026-110447 · 4 min

  8. WordPress Prime Mover CVE-2026-115806: An Anonymous Comment, Triggered by the Next Backup (9.8)

    CVE-2026-115806 (9.8): an anonymous comment booby-traps Prime Mover and the admin's next backup deserializes it. The plugin ships its own gadget chain.

    CVE-2026-115806 · 4 min

  9. Arista VeloCloud Orchestrator CVE-2026-114625: 9.9 SQL Injection in CISA KEV, Third Time in Three Months

    CVE-2026-114625 (9.9): SQL injection in on-prem VeloCloud Orchestrator turns any account into superuser operator. Added to CISA KEV on Oct 23. Bounds, actions.

    CVE-2026-114625 · 5 min

  10. How to Upgrade a FortiGate to FortiOS 7.4.13 or 7.6.8: Builds, Upgrade Order and Known Issues

    FortiOS 7.4.13 (build 2933), 7.6.8 (build 3744), 8.0.2 and 7.2.14: upgrade order, upgrade path, HA clusters and the known issues to check before installing.

    6 min

  11. SOHO Routers, October 2026: 6 Critical CVEs With Public Exploits in TOTOLINK, Tenda and D-Link Gear

    TOTOLINK A950RG and EX200, Tenda BE3L Pro and AC19, D-Link DHP-W610AV: six CVEs rated 9.8 to 10 by VulDB, exploits published, no fixed version in NVD.

    CVE-2026-114575 CVE-2026-114383 CVE-2026-114382 CVE-2026-114268 +2 · 5 min

  12. DedeCMS, FineReport, YiShaAdmin, Bytebase: Four Old Flaws Finally Get CVE IDs (CVE-2021-48016, 48014, CVE-2022-51022, 51026)

    CVE-2021-48016, 48014, CVE-2022-51022 and 51026: four flaws known for years, three already exploited, finally get IDs. What to check in your environment.

    CVE-2021-48016 CVE-2021-48014 CVE-2022-51022 CVE-2022-51026 · 5 min

  13. Incus and Wasmtime: Three Isolation Escapes at 9.9 (CVE-2026-115377, 115375, 115384)

    CVE-2026-115377, 115375 and 115384: a rigged Incus migration, backup or Wasm component can write to the host. Fixed versions, detection and mitigation.

    CVE-2026-115377 CVE-2026-115375 CVE-2026-115384 · 4 min

  14. Oracle October 2026: 34 Critical CVEs, SOA Suite on Top, Plus an Out-of-Band Java Alert

    Oracle's October 2026 patch: 34 critical CVEs, six of them rated 10.0 and unauthenticated, in SOA Suite, E-Business Suite, JD Edwards and Access Manager.

    CVE-2026-91231 CVE-2026-91221 CVE-2026-91216 CVE-2026-91299 +30 · 9 min

  15. FortiOS 7.6.8, 7.4.13, 8.0.2 and 7.2.14: Fortinet's October 2026 Security Hardening Release, Ahead of the November 10 CVEs

    Fortinet fixes critical flaws in FortiOS, FortiManager and FortiAnalyzer without publishing CVEs until November 10. Which versions to install, in what order.

    6 min

  16. Cisco Unified CM and Snort 3: Four Critical CVEs From an Internal Review

    Cisco ships hardening releases for Unified CM, Unity Connection and Snort 3: four critical CVEs, two of them rated 9.8 with no authentication required at all.

    CVE-2026-76474 CVE-2026-76473 CVE-2026-76475 CVE-2026-20043 · 5 min

  17. Bp Premier: One SQL Server sysadmin Password Shared by Every Installation — CVE-2026-114119 (9.8)

    CVE-2026-114119 (9.8, VulnCheck): Bp Premier before 1.14.1.1128 ships a SQL Server sysadmin password shared across all installations. Impact and what to do.

    CVE-2026-114119 · 4 min

  18. AI Agents: Human Approval Bypassed in EvoScientist, OpenSRE and Vibe-Trading (CVE-2026-77930, 109444, 114108)

    CVE-2026-77930, 109444 and 114108: three AI agents run shell commands with no approval or no authentication. How it works, versions and mitigation.

    CVE-2026-77930 CVE-2026-109444 CVE-2026-114108 · 5 min

  19. TOTOLINK X2000R: 30 Talos CVEs in the boa Web Server, Unsigned Firmware Included

    Talos rated 30 CVEs 9.1 on the TOTOLINK X2000R router: OS command injection, stack overflows and a firmware update path that never checks a signature.

    CVE-2026-10141 CVE-2026-10131 CVE-2026-10132 CVE-2026-10133 +26 · 6 min

  20. SiteGuard Server Edition and Siemens Software Center in CISA KEV: Two Exploited Local Flaws

    CVE-2026-106931 (SiteGuard, OS command injection as root) and CVE-2026-110936 (Siemens Software Center, DLL search path): two local flaws in CISA KEV.

    CVE-2026-106931 CVE-2026-110936 · 5 min