Vulnerabilities
Organisations at Risk: CVSS 9.8 CVE-2026-109892 in Frontend Admin 3.29.13 Allows Privilege Escalation
A critical vulnerability in the Frontend Admin plugin allows privilege escalation, affecting all versions up to 3.29.13.
Vulnerabilities
Vulnerabilities
MSPs Face Critical Fluent CRM Risk as Privilege Escalation Flaw Lacks Confirmed Fix
A critical flaw in Fluent CRM versions up to 3.2.5 allows privilege escalation. MSPs must assess exposure immediately as the source material does not confirm a fix.
Vulnerabilities
Orgs at risk: Eclipse EthereumAuthenticator critical flaw enables unauthenticated access via path matching errors
A critical vulnerability in Eclipse EthereumAuthenticator allows attackers to bypass authentication checks if request paths match specific patterns.
Vulnerabilities
AWS API MCP Server Startup Error Bypasses Security Policies Until Restart; Upgrade to 1.3.47
A startup error in the AWS API MCP Server bypasses security policies until the process restarts, requiring an immediate upgrade to version 1.3.47.
Vulnerabilities
Orgs urged to patch AWS Smithy-RS 0.66.5 to block unauthenticated Slowloris DoS in Rust servers
An unauthenticated denial-of-service vulnerability in AWS Smithy-RS affects versions through 0.66.4, with a fix available in version 0.66.5.
Vulnerabilities
Omnispace Agora Critical Flaw Lets Attackers Predict Passwords and Takeover Accounts Before Users Log In
A critical vulnerability in Omnispace Agora Project allows attackers to predict default passwords, enabling account takeover before legitimate users can log in.
Vulnerabilities
Omnispace Agora Account Takeover Risk Demands Immediate Patching for Pre-26.10.0 Users
A critical vulnerability in Omnispace Agora allows unauthenticated attackers to hijack accounts using predictable password-reset tokens in versions before 26.10.0.
Vulnerabilities
MyReport Updater Flaw Lets Attackers Run Code as SYSTEM Before Patch
A critical vulnerability in Report One MyReport Updater through version 2.1.1 allows unauthenticated remote code execution. No patch is confirmed yet.
Vulnerabilities
Stirling-PDF Users Urged to Patch Critical Admin RCE Flaw in Version 2.13.2
An update for Stirling-PDF version 2.13.2 addresses a critical vulnerability that lets authenticated admins execute arbitrary commands via database imports.
Vulnerabilities
SQL Server Heap Overflow Lets Authenticated Users Run Remote Code
Microsoft SQL Server versions through 2022 face a high-severity flaw that allows authorized attackers to execute code over the network.
Vulnerabilities
SQL Server Privilege Escalation Flaw Affects 2017, 2019, and 2022 Versions
Microsoft confirms a high-severity stack-based buffer overflow in SQL Server that allows authorized users to elevate privileges over a network connection.
Vulnerabilities
PAN-OS Admins Can Now Patch Root Command Execution Flaw CVE-2026-0320
Admins can now patch a medium-severity flaw allowing root command execution on PAN-OS devices. Updates are available for most versions, with a fix ETA for others.
Vulnerabilities
KEDA 2.21.0 Patch Fixes Critical Privilege Escalation Flaw
A critical flaw in KEDA allows namespace admins to steal cluster-wide permissions. Version 2.21.0 provides the fix for affected Kubernetes environments.
Vulnerabilities
Juniper Junos OS Buffer Overflow Risks Root Code Execution for MSPs
A critical stack-based buffer overflow in Juniper routing daemons allows configured peers to execute root code or crash services, requiring immediate version checks.
Vulnerabilities
Juniper Junos J-Web Critical Flaw Exposes Root Access to Unauthenticated Attackers
A critical authentication bypass in Juniper Junos OS J-Web allows remote attackers to execute commands with root privileges on exposed interfaces.
Vulnerabilities
Organisations urged to patch Node.js office-converter CVE-2020-37282 critical remote command execution flaw immediately
A critical vulnerability in the Node.js office-converter library allows remote command execution, requiring immediate attention for versions up to 1.0.2.
Vulnerabilities
FortiOS GUI DoS flaw disrupts HTTPS management access for network admins
An unauthenticated denial of service vulnerability in FortiOS allows attackers to cause a denial of service on the HTTPS management interface using crafted HTTP requests.
Vulnerabilities
Managed Service Providers Urged to Patch Critical itthinx Affiliates Deserialization Vulnerability
A critical deserialization vulnerability in itthinx Affiliates versions up to 7.0.1 allows object injection, requiring immediate attention for managed service providers.
Vulnerabilities
Genesis World Users Face Code Execution Risk From Unpatched Directory Traversal Flaws
Zero Day Initiative disclosed three vulnerabilities in Genesis World, including a remote code execution flaw, with no fix available as of October 2026.
Vulnerabilities
Organisations Must Patch Metasploit 6.5.5 to Stop Unauthenticated Credential Deletion via Web Service API
Rapid7 patches a critical flaw in Metasploit Framework that allows unauthenticated users to delete stored credentials via the web service API.
Vulnerabilities
Infrastructure Teams Urged to Patch Windows DHCP Server After Critical Use-After-Free Flaw Rated CVSS 9.8
A use-after-free vulnerability in Microsoft Windows DHCP Server allows network-based remote code execution, demanding immediate attention from infrastructure teams.
Vulnerabilities
Critical Windows iSCSI RCE Threatens Orgs Using Network Storage Protocols
A use-after-free error in Windows iSCSI allows unauthorized remote code execution, posing a critical risk to organizations relying on network storage protocols.
Vulnerabilities
Microsoft Windows Media Foundation Critical Flaw Demands Immediate MSP Attention
A critical heap overflow in Windows Media Foundation allows remote code execution, forcing managed service providers to prioritize patching.
Vulnerabilities
WordPress AGE-GATE Plugin CVE-2026-104800 Lets Attackers Run Code Without Login
All versions of the WordPress AGE-GATE plugin through 1.0 contain a critical flaw that lets attackers run code on servers without logging in.