https://patchobserver.com/news/vulnerabilities/node-js-services-face-high-severity-dos-risk-from/Patch Observeren2026-10-21T22:28:53ZNode.js Services Face High-Severity DoS Risk from Unpatched adm-zip Versions Before 0.6.1https://patchobserver.com/news/vulnerabilities/perl-net-libssh-flaw-allows-unverified-server/Patch Observeren2026-10-21T22:16:55ZPerl Net::LibSSH flaw allows unverified server connections in versions before 0.004https://patchobserver.com/news/vulnerabilities/node-js-toml-parser-flaw-blocks-event-loop-fix/Patch Observeren2026-10-21T20:46:36ZNode.js TOML Parser Flaw Blocks Event Loop, Fix Available in 5.0.1https://patchobserver.com/news/vulnerabilities/mongodb-compass-flaw-allows-arbitrary-code/Patch Observeren2026-10-21T18:39:58ZMongoDB Compass Flaw Allows Arbitrary Code Execution on View Edithttps://patchobserver.com/news/vulnerabilities/crewai-framework-rce-flaw-requires-agent-loading/Patch Observeren2026-10-21T18:16:15ZCrewAI Framework RCE Flaw Requires Agent Loading Fixhttps://patchobserver.com/news/vulnerabilities/orgs-hit-by-dos-moov-io-signedxml-1-4-1-fixes-cve/Patch Observeren2026-10-21T18:06:07ZOrgs hit by DoS: moov-io signedxml 1.4.1 fixes CVE-2026-113729 XML memory crashhttps://patchobserver.com/news/vulnerabilities/organisations-urged-to-update-virtualenv-to-fix/Patch Observeren2026-10-21T17:58:49ZOrganisations urged to update virtualenv to fix high-severity bash command execution flawhttps://patchobserver.com/news/vulnerabilities/mcp-sdk-cve-2026-111767-leaks-shared-session-data/Patch Observeren2026-10-21T08:56:43ZMCP SDK CVE-2026-111767 Leaks Shared Session Data; Patch 1.32.0 Fixes Isolation Failure for Usershttps://patchobserver.com/news/vulnerabilities/patch-python-tls-bundles-now-to-stop-mitm-attacks/Patch Observeren2026-10-21T08:56:43ZPatch Python TLS Bundles Now to Stop MITM Attacks via Compromised Roothttps://patchobserver.com/news/vulnerabilities/chrome-156-stable-release-patches-353-flaws/Patch Observeren2026-10-21T08:27:38ZChrome 156 stable release patches 353 flaws including critical memory corruptionhttps://patchobserver.com/news/vulnerabilities/php-users-must-patch-two-critical-rce-flaws-by/Patch Observeren2026-10-21T07:37:48ZPHP Users Must Patch Two Critical RCE Flaws by October 21https://patchobserver.com/news/vulnerabilities/tenda-ac19-firmware-16-03-10-07-faces-critical/Patch Observeren2026-10-21T07:16:37ZTenda AC19 Firmware 16.03.10.07 Faces Critical Remote Overflow Riskhttps://patchobserver.com/news/vulnerabilities/unauthenticated-oracle-soa-suite-flaw-allows-full/Patch Observeren2026-10-21T05:55:19ZUnauthenticated Oracle SOA Suite Flaw Allows Full System Takeoverhttps://patchobserver.com/news/vulnerabilities/java-sdk-flaw-exposes-task-data-verify-1-3-0/Patch Observeren2026-10-21T04:50:16ZJava SDK flaw exposes task data; verify 1.3.0.Final release statushttps://patchobserver.com/news/vulnerabilities/network-admins-totolink-x2000r-firmware-flaw/Patch Observeren2026-10-21T04:29:08ZNetwork admins: Totolink X2000R firmware flaw enables authenticated remote code execution via DHCP setuphttps://patchobserver.com/news/vulnerabilities/orgs-urged-to-update-a2a-java-sdk-to-1-3-2-final/Patch Observeren2026-10-21T04:21:16ZOrgs urged to update A2A Java SDK to 1.3.2.Final to prevent custom auth header leaks during redirectshttps://patchobserver.com/news/vulnerabilities/totolink-x2000r-firmware-flaw-lets-attackers/Patch Observeren2026-10-21T03:48:48ZTotolink X2000R Firmware Flaw Lets Attackers Install Arbitrary Codehttps://patchobserver.com/news/vulnerabilities/organisations-urged-to-patch-php-5-8-ahead-of-oct/Patch Observeren2026-10-21T02:46:49ZOrganisations urged to patch PHP 5-8 ahead of Oct 21 fixes after critical RCE flaws leak earlyhttps://patchobserver.com/news/vulnerabilities/totolink-x2000r-router-exposed-to-critical-remote/Patch Observeren2026-10-21T01:42:23ZTotolink X2000R Router Exposed to Critical Remote Code Execution Flawhttps://patchobserver.com/news/vulnerabilities/totolink-x2000r-buffer-overflows-pose-severe-risk/Patch Observeren2026-10-21T00:47:36ZTotolink X2000R Buffer Overflows Pose Severe Risk to Managed Networks via Remote Code Executionhttps://patchobserver.com/news/vulnerabilities/ibm-datastage-flaw-lets-attackers-bypass/Patch Observeren2026-10-21T00:19:33ZIBM DataStage flaw lets attackers bypass encryption and poison tenant datahttps://patchobserver.com/news/vulnerabilities/critical-command-injection-flaw-in-totolink/Patch Observeren2026-10-20T21:42:42ZCritical Command Injection Flaw in Totolink X2000R Firmware Exposes Users to Remote Code Executionhttps://patchobserver.com/news/vulnerabilities/apache-couchdb-3-5-3-fixes-high-severity/Patch Observeren2026-10-20T20:30:28ZApache CouchDB 3.5.3 Fixes High-Severity Decompression Bomb Vulnerabilityhttps://patchobserver.com/news/vulnerabilities/apostrophe-cms-prototype-pollution-causes/Patch Observeren2026-10-20T18:27:36ZApostrophe CMS Prototype Pollution Causes Persistent Denial of Servicehttps://patchobserver.com/news/vulnerabilities/orgs-using-apache-tomcat-11-must-upgrade-to-11-0/Patch Observeren2026-10-20T18:15:50ZOrgs Using Apache Tomcat 11 Must Upgrade to 11.0.27 to Stop Data Leaks From Buffer Under-Read Flawhttps://patchobserver.com/news/vulnerabilities/python-certifi-update-removes-emsign-root/Patch Observeren2026-10-20T17:27:32ZPython certifi Update Removes emSign Root Certificate in Critical Patchhttps://patchobserver.com/news/vulnerabilities/solarwinds-observability-self-hosted/Patch Observeren2026-10-20T16:51:25ZSolarWinds Observability Self-Hosted Authorization Flaw Allows Data Modificationhttps://patchobserver.com/news/vulnerabilities/stirling-pdf-administrators-face-high-risk-sql/Patch Observeren2026-10-20T16:19:56ZStirling-PDF administrators face high-risk SQL bypass vulnerability in versions through 3.2.0https://patchobserver.com/news/vulnerabilities/netx-secure-tls-1-3-parser-flaw-allows-pre-auth/Patch Observeren2026-10-20T15:44:45ZNetX Secure TLS 1.3 parser flaw allows pre-auth heap readhttps://patchobserver.com/news/vulnerabilities/crass-ruby-gem-vulnerable-to-cpu-exhaustion-via/Patch Observeren2026-10-20T15:01:38ZCrass Ruby Gem Vulnerable to CPU Exhaustion via CSS Parsing Flawhttps://patchobserver.com/news/vulnerabilities/draytek-vigor2960-critical-remote-code-execution/Patch Observeren2026-10-20T14:06:25ZDrayTek Vigor2960 Critical Remote Code Execution Flaw Lacks Active Vendor Supporthttps://patchobserver.com/news/vulnerabilities/fortinet-fortisiem-faces-critical-unauthenticated/Patch Observeren2026-10-20T13:42:26ZFortinet FortiSIEM Faces Critical Unauthenticated RCE via gRPC Flawhttps://patchobserver.com/news/vulnerabilities/on-prem-and-cloud-unblu-spark-users-face-config/Patch Observeren2026-10-20T11:33:04ZOn-prem and Cloud Unblu Spark Users Face Config Tampering via CVE-2026-9589 in Versions Before 8.37.0https://patchobserver.com/news/vulnerabilities/organisations-boost-security-coverage-with/Patch Observeren2026-10-20T06:54:32ZOrganisations boost security coverage with ThreatBook's RedAgents multi-AI parallel testing platformhttps://patchobserver.com/news/vulnerabilities/organizations-in-israel-uk-and-us-hire-senior/Patch Observeren2026-10-20T04:39:14ZOrganizations in Israel, UK, and US hire senior security experts amid high demandhttps://patchobserver.com/news/vulnerabilities/organisations-urged-to-patch-pillow-13-0-0-to/Patch Observeren2026-10-20T02:31:44ZOrganisations Urged to Patch Pillow 13.0.0 to Block Critical Arbitrary Code Execution Flaw CVE-2026-112398https://patchobserver.com/news/vulnerabilities/coze-studio-users-face-high-risk-command/Patch Observeren2026-10-20T01:31:42ZCoze Studio Users Face High-Risk Command Execution Flaw Before 0.5.0https://patchobserver.com/news/vulnerabilities/db-gpt-0-8-2-vulnerability-grants-unauthenticated/Patch Observeren2026-10-20T01:31:37ZDB-GPT 0.8.2 Vulnerability Grants Unauthenticated Root Access to Containershttps://patchobserver.com/news/vulnerabilities/qilin-inc-ransomware-bypasses-mfa-on-pan-os/Patch Observeren2026-10-20T01:15:54ZQilin, Inc Ransomware Bypasses MFA on PAN-OS Gateways via CVE-2026-0257https://patchobserver.com/news/vulnerabilities/aiohttp-users-must-patch-keepalive-flaw-before/Patch Observeren2026-10-20T01:15:54Zaiohttp users must patch keepalive flaw before servers run out of connectionshttps://patchobserver.com/news/vulnerabilities/archibus-critical-flaw-allows-unauthenticated/Patch Observeren2026-10-20T01:15:54ZArchibus Critical Flaw Allows Unauthenticated Remote Code Executionhttps://patchobserver.com/news/vulnerabilities/h3c-magic-nx15-remote-code-injection-flaw-exposes/Patch Observeren2026-10-20T00:03:43ZH3C Magic NX15 Remote Code Injection Flaw Exposes Networks to Public Exploithttps://patchobserver.com/news/vulnerabilities/organisations-urged-to-patch-plex-as-attackers/Patch Observeren2026-10-19T23:39:38ZOrganisations urged to patch Plex as attackers chain flaws to deploy cryptominers and proxy malwarehttps://patchobserver.com/news/vulnerabilities/orgs-urged-to-patch-mercury-3-2-4-to-stop/Patch Observeren2026-10-19T22:30:58ZOrgs Urged to Patch Mercury 3.2.4 to Stop Terminal Shell Access via Missing Comma CVE-2026-111057