Vulnerabilities
SQL Server Privilege Escalation Flaw Affects 2017, 2019, and 2022 Versions
Microsoft confirms a high-severity stack-based buffer overflow in SQL Server that allows authorized users to elevate privileges over a network connection.
Patch Observer CVE Desk
Vulnerabilities
PAN-OS Admins Can Now Patch Root Command Execution Flaw CVE-2026-0320
Admins can now patch a medium-severity flaw allowing root command execution on PAN-OS devices. Updates are available for most versions, with a fix ETA for others.
Vulnerabilities
KEDA 2.21.0 Patch Fixes Critical Privilege Escalation Flaw
A critical flaw in KEDA allows namespace admins to steal cluster-wide permissions. Version 2.21.0 provides the fix for affected Kubernetes environments.
Vulnerabilities
Juniper Junos OS Buffer Overflow Risks Root Code Execution for MSPs
A critical stack-based buffer overflow in Juniper routing daemons allows configured peers to execute root code or crash services, requiring immediate version checks.
Vulnerabilities
Juniper Junos J-Web Critical Flaw Exposes Root Access to Unauthenticated Attackers
A critical authentication bypass in Juniper Junos OS J-Web allows remote attackers to execute commands with root privileges on exposed interfaces.
Vulnerabilities
Organisations urged to patch Node.js office-converter CVE-2020-37282 critical remote command execution flaw immediately
A critical vulnerability in the Node.js office-converter library allows remote command execution, requiring immediate attention for versions up to 1.0.2.
Vulnerabilities
FortiOS GUI DoS flaw disrupts HTTPS management access for network admins
An unauthenticated denial of service vulnerability in FortiOS allows attackers to cause a denial of service on the HTTPS management interface using crafted HTTP requests.
Vulnerabilities
Managed Service Providers Urged to Patch Critical itthinx Affiliates Deserialization Vulnerability
A critical deserialization vulnerability in itthinx Affiliates versions up to 7.0.1 allows object injection, requiring immediate attention for managed service providers.
Vulnerabilities
Genesis World Users Face Code Execution Risk From Unpatched Directory Traversal Flaws
Zero Day Initiative disclosed three vulnerabilities in Genesis World, including a remote code execution flaw, with no fix available as of October 2026.
Vulnerabilities
Organisations Must Patch Metasploit 6.5.5 to Stop Unauthenticated Credential Deletion via Web Service API
Rapid7 patches a critical flaw in Metasploit Framework that allows unauthenticated users to delete stored credentials via the web service API.
Vulnerabilities
Infrastructure Teams Urged to Patch Windows DHCP Server After Critical Use-After-Free Flaw Rated CVSS 9.8
A use-after-free vulnerability in Microsoft Windows DHCP Server allows network-based remote code execution, demanding immediate attention from infrastructure teams.
Vulnerabilities
Critical Windows iSCSI RCE Threatens Orgs Using Network Storage Protocols
A use-after-free error in Windows iSCSI allows unauthorized remote code execution, posing a critical risk to organizations relying on network storage protocols.
Vulnerabilities
Microsoft Windows Media Foundation Critical Flaw Demands Immediate MSP Attention
A critical heap overflow in Windows Media Foundation allows remote code execution, forcing managed service providers to prioritize patching.
Vulnerabilities
WordPress AGE-GATE Plugin CVE-2026-104800 Lets Attackers Run Code Without Login
All versions of the WordPress AGE-GATE plugin through 1.0 contain a critical flaw that lets attackers run code on servers without logging in.
Vulnerabilities
Exposed TCP Channels in Xorbits Xoscar Let Attackers Run Root Code on GPU Nodes
Unauthenticated remote code execution in Xorbits Xoscar through 0.11.2 poses immediate risk to exposed TCP channels and privileged servers.
Vulnerabilities
Dev Workstations at Risk: Microsoft Patches High-Severity Blazor Debugger Code Injection Flaw
A code injection flaw in the Blazor WebAssembly debugger allows remote code execution on developer workstations when expressions are evaluated.
Vulnerabilities
Organisations at Risk: Critical ColdFusion Flaw Enables Remote Code Execution Without Interaction
A critical authorization flaw in Adobe ColdFusion allows low-privileged attackers to run arbitrary code without user interaction. The NVD record lists affected versions.
Vulnerabilities
Managed Service Providers Must Patch ColdFusion 2023/2025 Against Critical CVE-2026-75994 Auth Flaw
A critical authorization vulnerability in Adobe ColdFusion could result in arbitrary code execution without user interaction, demanding urgent attention from managed service providers.
Vulnerabilities
Organisations at Risk: Critical Unauthenticated RCE in Windows MQ Affects Win 10/11 Builds
A critical use-after-free flaw in Windows Message Queuing allows remote code execution without authentication across multiple Windows 10 and 11 builds.
Vulnerabilities
Dragonfly DB Double-Free Flaw Risks Remote Code Execution for Pre-1.40 Users
A critical memory corruption flaw in Dragonfly DB versions prior to 1.40 allows unauthenticated attackers to execute code, with no vendor patch currently available.
Vulnerabilities
Bricksforge Wild RCE Forces Orgs to Patch to 3.1.8.10 Amid Active CVE-2026-85097 Attacks
Patchstack confirms active wild exploitation of CVE-2026-85097 in Bricksforge versions up to 3.1.8.9, requiring immediate updates.
Vulnerabilities
Organisations at Risk: GPT-SoVITS UVR5 Flaw Enables Unauthenticated System Command Execution
A critical flaw in GPT-SoVITS allows attackers to run system commands via the UVR5 web interface without authentication, affecting versions up to 20250606v2pro.
Vulnerabilities
MSPs Urged to Patch Esri Portal for ArcGIS as Critical CVE-2026-69227 Exposes Admin APIs
A critical flaw allows unauthenticated access to admin APIs in Esri Portal for ArcGIS, requiring immediate attention from managed service providers.
Vulnerabilities
Organisations Urged to Update PraisonAI 1.6.59 After CVSS 9.8 Flaw Exposed Agent Workflows and Data
A critical flaw in PraisonAI allowed anyone to access agent systems. Version 1.6.59 patches the missing access controls that exposed workflows and data.