Skip to content

Blog · page 2/7

CVE analysis, as it happens

Critical vulnerabilities and CISA KEV additions, explained: what is affected, which versions fix it, and what to check first.

  1. Netcore NR268 and Wavlink WL-WN530BE1-A Routers: CVE-2026-108929 and CVE-2026-109108 (9.9)

    Two 9.9 router CVEs: DDNS argument injection on Netcore NR268, VPN upload command injection on Wavlink. No NVD fix yet: isolate the devices, plan replacement.

    CVE-2026-108929 CVE-2026-109108 · 4 min

  2. Rapyd Admin CVE-2026-109566 and Grav Login OAuth CVE-2026-109321: Predictable Credentials

    Rapyd Admin (fixed in 9.20.0) re-creates a default super-admin, Grav Login OAuth (fixed in 1.4.3) derives its passwords. Two critical CVEs worth handling.

    CVE-2026-109566 CVE-2026-109321 · 4 min

  3. PHPNuxBill CVE-2026-108107 and Wukong HRM CVE-2026-108707: Two Unauthenticated 9.8s

    Unauthenticated SQL injection in PHPNuxBill, HR admin access in Wukong HRM: two 9.8 CVEs with no NVD fixed version yet. Exposure, detection and next steps.

    CVE-2026-108107 CVE-2026-108707 · 4 min

  4. CISA KEV: Five Old CVEs Added at Once (ProFTPD, Struts, BIND, ONLYOFFICE, Strapi)

    On October 8, CISA added five CVEs from 2015 to 2023 to KEV: ProFTPD, Struts, BIND, ONLYOFFICE, Strapi. An old CVE under attack points to a forgotten server.

    CVE-2015-3306 CVE-2021-3199 CVE-2023-22894 CVE-2016-3081 +1 · 5 min

  5. Brocade Fabric OS: CVE-2026-87659 and CVE-2026-87684 (9.8), Fixed From 10.0.1

    Two 9.8 CVEs in Brocade Fabric OS: admin takeover from a compromised switch in the fabric, and an SNMPv3 stack overflow. What SAN teams should check.

    CVE-2026-87659 CVE-2026-87684 · 4 min

  6. Apache Jackrabbit CVE-2026-92414 (9.1): Session Reuse in the WebDAV Server, Fixed in 2.23.6, 2.22.5 and 2.20.18

    Apache Jackrabbit CVE-2026-92414 (9.1): the WebDAV server reuses a cached authenticated session without checking credentials. Fixed in 2.23.6 and later.

    CVE-2026-92414 · 4 min

  7. wolfSSL CVE-2026-89134 and wolfSSH CVE-2026-81535: Two 9.1 Flaws in Embedded Libraries

    wolfSSL CVE-2026-89134 (9.1) bypasses an X.509 name constraint; wolfSSH CVE-2026-81535 (9.1) accepts unauthorized channels. Versions and what to do.

    CVE-2026-89134 CVE-2026-81535 · 4 min

  8. Splunk Enterprise CVE-2026-76285 (9.8): A Batch of Internal Flaws, Fixed in 10.4.3, 10.2.7, 10.0.10 and 9.4.15

    Splunk Enterprise CVE-2026-76285 (9.8) groups internally found flaws with no public detail. Fixed in 10.4.3, 10.2.7, 10.0.10 and 9.4.15: what to do now.

    CVE-2026-76285 · 4 min

  9. Cisco NX-OS CVE-2026-76459 (9.8) and Cisco License On-Prem CVE-2026-76454 (9.1): Two Critical October 7 Advisories

    Cisco: CVE-2026-76459 (9.8) groups out-of-bounds writes in NX-OS, and CVE-2026-76454 (9.1) exposes the License On-Prem API with no authentication.

    CVE-2026-76459 CVE-2026-76454 · 4 min

  10. Payload CMS CVE-2026-105848 and CVE-2026-105863: Stripe Proxy and Auth Token Flaws, Fixed in 3.90.0

    Payload CMS: CVE-2026-105848 (9.6) in the Stripe plugin's REST proxy and CVE-2026-105863 (9.4) in auth token claims. Both are fixed in version 3.90.0.

    CVE-2026-105848 CVE-2026-105863 · 4 min

  11. Google Chrome 155.0.8059.39: CVE-2026-106237 and CVE-2026-106195, Critical for NVD, Low for Chromium

    Chrome 155.0.8059.39 fixes CVE-2026-106237 (9.6, site isolation) and CVE-2026-106195 (9.1, Chromoting on Mac). NVD says critical, Chromium says Low.

    CVE-2026-106237 CVE-2026-106195 · 4 min

  12. Joomla Extensions, October 2026: OrdaSoft CCK (Fixed in 8.3.16) and TF Content, Two Unauthenticated 9.8 Flaws

    OrdaSoft Joomla CCK (CVE-2026-102428, SQL injection) and TF Content (CVE-2026-102780): two 9.8 flaws exploitable without an account. Versions and fixes.

    CVE-2026-102428 CVE-2026-102780 · 4 min

  13. Zammad CVE-2026-102489 and CVE-2026-102490 in CISA KEV: From Hijacked Session to Root

    Zammad: CVE-2026-102489 (9.8, RCE via session hijack) and CVE-2026-102490 (escalation to root), chainable, added to CISA KEV on October 2. What to do.

    CVE-2026-102489 CVE-2026-102490 · 4 min

  14. Citrix NetScaler CVE-2026-88779 in CISA KEV: Another Memory Buffer Flaw, a Week Later

    CVE-2026-88779: memory buffer flaw in NetScaler ADC and Gateway leading to denial of service, added to CISA KEV on October 4, due October 7. Patch again.

    CVE-2026-88779 · 3 min

  15. FortiMail CVE-2026-104286 in CISA KEV: Unauthenticated Arbitrary File Write

    CVE-2026-104286: path traversal in Fortinet FortiMail allows unauthenticated file writes, exploited. Added to CISA KEV on October 1, due October 4.

    CVE-2026-104286 · 3 min

  16. WatchGuard Fireware OS CVE-2026-86131: A Remote VPN Server Can Get Root on Your Firebox

    CVE-2026-86131 (9.8): code injection in Fireware OS BOVPN over TLS client config handling. A malicious or compromised VPN server gets root on the Firebox.

    CVE-2026-86131 · 3 min

  17. Joomla: 6 Critical CVEs in 5 Extensions in Late September — Balbooa Forms, OrdaSoft, JCTables

    Balbooa Forms, OrdaSoft CCK and Book Library, JCTables, YouTube Gallery: six CVEs rated 9.1 to 10.0, all unauthenticated, published in late September 2026.

    CVE-2026-102425 CVE-2026-101127 CVE-2026-102427 CVE-2026-76570 +2 · 5 min

  18. Cisco Catalyst SD-WAN Manager CVE-2026-76504: Unauthenticated Admin Access, in CISA KEV

    CVE-2026-76504 (9.8): API authentication bypass in Cisco Catalyst SD-WAN Manager, exploited and added to CISA KEV on September 30. What to do right now.

    CVE-2026-76504 · 3 min

  19. simple-git CVE-2026-102828: Command Injection Through Git Config, Fixed in 4.0.1

    CVE-2026-102828 (9.8) in simple-git: user-controlled Git config can run a shell command. Fixed in 4.0.1. How to check whether your code passes such values.

    CVE-2026-102828 · 3 min

  20. Apple CoreGraphics CVE-2026-86950 in CISA KEV: Out-of-Bounds Write on iOS, iPadOS and macOS

    CVE-2026-86950: an out-of-bounds write in CoreGraphics (iOS, iPadOS, macOS) that may lead to code execution. In CISA KEV since Sept 29, deadline October 13.

    CVE-2026-86950 · 3 min