Tag
#security
imgproxy ICO Loader RCE, Fixed in 4.0.16 (GHSA-hff9-5pqw-6w9f)
imgproxy 4.0.0 to 4.0.15 allocates ICO data with a wrapping size that unauthenticated crafted-image requests turn into heap corruption; fixed in 4.0.16.
Oct 31, 2026
pgAdmin 4 Import/Export RCE, Fixed in 9.19 (CVE-2026-116241)
pgAdmin 4 before 9.19 lets any Import/Export user run a psql TO PROGRAM command on the host, and ...
Oct 31, 2026
WordPress Core Upgrade-Window RCE, Fixed in 7.1.4 (CVE-2026-119977)
WordPress 4.7 to 7.1.3 stages core updates in a predictable, web-served path that unauthenticated...
Oct 31, 2026
Langflow Auto-Login Superuser Bypass, RCE via MCP (CVE-2026-93680)
Langflow OSS 1.0.0 to 1.12.8 hands any caller a superuser session that reaches RCE through its MC...
Oct 30, 2026
More tagged #security
testmetest: npm Worm Arms 42 GitHub Repos with a Hidden Publisher
An npm worm stole credentials, planted AI-tool hooks in 42 real GitHub repositories and hid a package publisher; treat installs as compromises.
Oct 30, 2026
Trojanized Claude Code Extension on Cursor Plants SSH Backdoor
A malicious Claude Code extension 2.1.313 on the Cursor Marketplace added an SSH backdoor; at most 5,000 users installed it on October 29, 2026.
Oct 30, 2026
Drupal Commerce Access Bypass, Exploited in the Wild (CVE-2026-118539)
Drupal Commerce before 2.41 and 3.3.13 lets limited users take over other vendors' variations and coupons via JSON:API; exploited.
Oct 30, 2026
Gotenberg PDF Metadata RCE, Exploited in the Wild (CVE-2026-42589)
A newline in a PDF metadata key runs ExifTool Perl code as a command on unauthenticated Gotenberg servers before 8.31.0; exploited by seven clusters.
Oct 30, 2026
Linux Kernel TCP Handshake Race RCE (CVE-2026-98432)
A race in Linux IPv4 TCP handshakes since 4.4 frees socket options in use; kernel team scores 9.8, Ubuntu and RHEL ship no fix yet.
Oct 30, 2026
Telegram for Android Voice-Call RCE, Fixed in 12.10.4
Telegram for Android 8.6.2 to 12.10.3 let a caller run code once the victim answered a voice call. No known exploitation. Fixed in 12.10.4.
Oct 29, 2026
Cisco ASA and FTD SSL VPN DoS Exploited in the Wild (CVE-2026-76418)
An unauthenticated crafted request reloads Cisco ASA and FTD firewalls using secondary authentication on a tunnel group; High 8.6, exploited, KEV.
Oct 29, 2026
GoAhead mTLS Accepts Revoked Client Certificates (CVE-2026-115881)
GoAhead loads the CRL but never checks it, so revoked client certificates pass mTLS; fixed in 6.1.1, shipped to device builders on August 2.
Oct 29, 2026
Oracle PeopleSoft RCE Exploited by ShinyHunters (CVE-2026-35273)
Unauthenticated RCE in PeopleTools 8.61 and 8.62 through an SSRF chain into PSEMHUB: exploited as a zero-day by ShinyHunters, fixed June 10.
Oct 29, 2026
Apple CoreGraphics Code Execution Exploited on iOS (CVE-2026-86950)
CVE-2026-86950, an exploited CoreGraphics out-of-bounds write, is in CISA KEV; iOS and iPadOS 26.7.1 and 18.7.11, macOS Tahoe 26.7.1 and Sequoia 15.8.1 fix it.
Oct 28, 2026