Apache OpenOffice security bulletin CVE-2026-59265 (oss-security announce by Dave Fisher, 2 October 2026) rates Critical a code-execution issue in the Java integration: a crafted untrusted document can run arbitrary code, including code fetched remotely, when the user opens it. Affected: Apache OpenOffice through 4.1.16 (older OpenOffice.org builds may also be affected); the fix is due in 4.1.17, still a release candidate as of 6 October. LibreOffice published the matching flaw as CVE-2026-63277 on 5 October: a Calc cell range linked to an external data source can name a Java database (JDBC) driver to load from a remote location, so opening the document runs that Java code; fixed versions only accept local file URLs in the Java class path. LibreOffice fixed it in 26.2.5 and 26.8.0, alongside five related Codean Labs findings announced the same day (CVE-2026-63266 arbitrary file write via an embedded Firebird database, CVE-2026-63267 and 63268 local file read and SSRF through external data links, CVE-2026-63269 local file read and SSRF through GStreamer HLS playlists on Linux, CVE-2026-63270 environment and ini value leaks). Credit: Thomas Rinsma and Edoardo Geraci (Codean Labs) and Rick de Jager (V12), independently; Caolán McNamara (Collabora) wrote the LibreOffice fix. No numeric CVSS published by either project; do not invent a score. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Apache OpenOffice)
Apache OpenOffice — CVE-2026-59265 (Critical; 2 Oct 2026)
GitLab AI Gateway critical patch release (2 October 2026; Docs advisory) remediates CVE-2026-90970 (CVSS 3.1 9.9; AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): improper neutralization in a custom flow prompt template that, under certain conditions, lets an authenticated user with Duo Agent Platform access escape the prompt-template sandbox via a crafted flow configuration and execute arbitrary commands on the AI Gateway. Impacted: AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. Fixed: 19.2.4, 19.3.2, 19.4.1. GitLab-hosted AI Gateways (GitLab.com, Dedicated, Self-Managed using GitLab-hosted gateway) already patched — no action. Self-Hosted AI Gateway on Self-Managed: upgrade immediately; GitLab says it conducted targeted pre-disclosure outreach to those customers. Credit: invisiblemeerkat. (sources: GitLab Docs AI Gateway patch release; BleepingComputer)
GitLab Docs — AI Gateway critical patch release 19.2.4 / 19.3.2 / 19.4.1 (CVE-2026-90970; 2 Oct 2026)
Wordfence CNA CVE-2026-19660 (published 2 October 2026; disclosed 1 Oct; CVSS 3.1 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): unauthenticated authentication bypass in DiviEngine’s Divi Membership WordPress plugin through 2.3.0. The process_paypal_callback function (hooked to init) accepts a base64-encoded paypal_param GET value with no PayPal IPN validation, signature check, ownership check, or nonce, then passes an attacker-controlled user ID to wp_set_current_user() / wp_set_auth_cookie() — full site takeover including administrators. The PayPal gateway class is instantiated on every front-end request even when PayPal is not enabled, so the hook is always registered. Finder credit: 0xd4rk5id3. Divi Engine changelog still lists 2.3.0 (1 Sep 2026) as newest at check — no patched release documented. (sources: CVE.org; Wordfence CNA)
Docker published two Moby security advisories on 1 October 2026, with the CVE records following on 7 October; both are fixed in Docker Engine 29.8.2. CVE-2026-92543 (GHSA-7cfq-22r6-qp73, CVSS 4.0 score 7.6 High): Docker Engine always treats 127.0.0.0/8 and ::1/128 as insecure registry ranges, and it decides a registry is insecure if any one of the addresses its hostname resolves to falls in those ranges. Because the connection then re-dials the hostname rather than the matching address, an attacker who can shape DNS answers (one loopback address plus one of their own) can make the daemon skip certificate verification and allow plain-HTTP fallback, exposing registry credentials sent in X-Registry-Auth or substituting the image behind a trusted tag. Removing entries from insecure-registries does not help, and a trusted CA does not mitigate it. CVE-2026-92542 (GHSA-6m9p-4h64-m6vh, CVSS 4.0 score 6.9 Medium): on Linux Swarm nodes the firewall rules that mark VXLAN traffic for IPsec encryption also match datagrams forged by ordinary user processes, so an unprivileged local user can inject Ethernet frames into an encrypted overlay network on another node. No exploitation has been reported. (sources: Moby GitHub security advisories; listed on Tenable's newest CVE feed)
Moby (Docker) — GHSA-7cfq-22r6-qp73: insecure-registry fallback via malicious DNS responses, CVE-2026-92543 (1 Oct 2026)
Dell's DSA-2026-324 (1 Oct 2026) fixes five flaws in Dell System Update, the command-line tool admins use to push BIOS, firmware and driver updates to PowerEdge servers on Linux and Windows. The critical one, CVE-2026-86360 (CVSS 3.1 9.6), is a path traversal that an unauthenticated remote attacker could use for filesystem access; Dell says it can be leveraged to run arbitrary code with root privileges and fully compromise the application and the underlying operating system. The same release fixes CVE-2026-86361 and CVE-2026-86362 (both 8.2, local low-privileged elevation of privilege), CVE-2026-63697 (7.6, improper certificate validation leading to remote execution by a high-privileged attacker) and CVE-2026-71168 (7.3, local path traversal leading to code execution). Dell has not flagged any of them as exploited. Reporters credited by Dell: Ori Gabriel, saltedfish, and Nir Yehoshua of Cipher Security Labs. (source: BleepingComputer)
Dell — DSA-2026-324: Security update for Dell System Update (DSU) vulnerabilities (1 Oct 2026)
Fortra's CVE records, published on 1 October 2026 (Perth time), describe three Critical flaws in its BoKS privileged access management products. CVE-2026-79901 (CVSS 3.1 9.9), in BoKS Manager boks-server: in deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp, so an attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline. The record lists boks-server versions before 9.0.0.6 as affected and tells customers to upgrade the active BoKS Master to boks-server 9.0.0.7 and restart BoKS before generating replacement passwords; it says installing the update does not secure passwords generated by an affected release, so affected or uncertain service-account passwords must be rotated through BoKS keytab management and keytabs rebuilt once the domain's maximum service-ticket lifetime plus clock-skew allowance has passed (immediately if compromise is suspected). CVE-2026-12627 (CVSS 3.1 9.8), in Fortra's Core Privileged Access Manager (BoKS): a stack-based buffer overflow in boks_autoregisterd that a remote attacker with network access to the autoregistration service may be able to use to trigger memory corruption during client response processing; affected 8.1.0.0 to 8.1.0.23 and 9.0.0.0 to 9.0.0.6, fixed by upgrading to boks-server 8.1.0.24 or 9.0.0.7. CVE-2026-79898 (CVSS 3.1 9.1), in BoKS Manager: a command injection in crlserver that lets an authenticated user authorised to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface cause shell command substitution to be processed by crlserver as root on the BoKS Master; affected 8.1.0.0 to 8.1.0.23 and 9.0.0.0 to 9.0.0.6, fixed in boks-server 8.1.0.24 or 9.0.0.7. The records point to Fortra advisories FI-2026-012, FI-2026-017 and FI-2026-015. (sources: CVE records CVE-2026-12627, CVE-2026-79901 and CVE-2026-79898) Correction (1 Nov 2026): removed the SecurityWeek link and credit, which this desk cannot read, and the details that came only from SecurityWeek or from Fortra's advisory pages, which did not load for the desk this pass (the total number of flaws in the batch, the High and Medium-rated fixes, the note about standard Active Directory accounts and the line about exploitation); the keytab flaw's affected range now follows Fortra's CVE record. The card now rests on Fortra's CVE records and its date stays 1 October 2026, the records' publication date. (source: CVE-2026-12627 record)
CVE.org — CVE-2026-12627: Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability (CNA: Fortra; published 1 Oct 2026)
ASUS product security notices (last updated 1 October 2026) address two authenticated remote flaws in consumer/prosumer router firmware reachable via the web management interface. CVE-2026-14157 (Critical, CVSS v4.0 9.4): a specially crafted VPN client configuration file uploaded through the management UI can cause arbitrary command execution on firmware series 3.0.0.6_102. Until patched, ASUS says import VPN client configs only from trusted, verifiable sources — avoid publicly shared or unknown-origin OVPN/profile files. CVE-2026-13313 (High, CVSS v4.0 8.9): authenticated attacker can bypass checks (debug code left active) to enable Telnet and run commands with elevated/root privileges; affects 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series. ASUS also recommends a strong unique admin password (≥10 chars, upper/number/symbol mix) and against running untrusted scripts/tools/commands on LAN hosts that can reach the router UI. Neither router bulletin states exploitation in the wild. Separate same-day board notice: CVE-2026-93495 (CVSS v4.0 7.0) improper BIOS init — physical crafted device → memory R/W on listed Z390/C246 boards (BIOS 2203 / 1502). (sources: CyberInsider; ASUS Product Security Advisory) ASUS security-advisory HTML table was empty on fetch (likely JS) — switch primary_url when the specific bulletin permalink is listed.
CyberInsider — ASUS warns of critical router flaw via malicious VPN files (1 Oct 2026)
GitHub Security Advisory GHSA-rvm3-566m-v7fv / CVE-2026-103922 (published 1 October 2026; GitHub CNA CVSS 3.1 9.3 Critical; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N): Capacitor Android/iOS WebView navigation guard validated host and scheme but not path. A victim who opens an untrusted link inside an affected app can navigate a frame to /_capacitor_http_interceptor_; the native HTTP proxy fetches attacker-chosen remote content and returns it as a document at the application origin, giving same-origin access to localStorage, cookies, and registered Capacitor plugin APIs (device data, tokens, files — plugin-dependent). Disabling CapacitorHttp does not mitigate on vulnerable builds because the proxy path was still served. Affected: >=6.0.0 <6.2.2, >=7.0.0 <7.6.9, >=8.0.0 <8.3.5, >=8.3.5 <8.4.3, >=8.5.0 <8.5.1. Fixed in 6.2.2, 7.6.9, 8.3.5, 8.4.3, 8.5.1 — rebuild and redistribute mobile apps. (sources: Cyber Security News; Ionic/GitHub GHSA-rvm3-566m-v7fv)
Red Hat CVE-2026-96659 (published 1 October 2026; Red Hat CVSS 3.1 9.1 Important; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L): authorization weakness (CWE-267) in Foreman template-preview endpoints used by Red Hat Satellite. An authenticated low-privileged user with only the Viewer role can submit crafted requests and retrieve sensitive host attributes that should be admin-only — including host root passwords. If template Safemode protections are disabled or circumvented, Red Hat warns the same flaw class can escalate to arbitrary command execution as the Foreman service account. Affects Satellite/Foreman deployments that expose the vulnerable preview path; companion Critical safemode-bypass CVE-2026-96658 (see /n/foreman-safemode-96658-20261001) shipped in the same 1 Oct RHSA train. Fixed via RHSA-2026:74503 / 74504 / 74505 / 74506 (Satellite 6.16–6.19 trains per Red Hat CVE page). (sources: Cyber Security News; Red Hat CVE-2026-96659)
Red Hat — CVE-2026-96659 (Satellite/Foreman template preview authz; 1 Oct 2026)
SEC Consult says in a blog post dated 1 October 2026 that researcher Timo Longin, working with the SEC Consult Vulnerability Lab, found two email spoofing vulnerabilities in Apple iCloud's email infrastructure. Both let a user authenticated to iCloud's SMTP service with their own address send mail that receiving systems showed as coming from another @icloud.com address, such as admin@icloud.com or tim.cook@icloud.com, while SPF, DKIM and DMARC still passed. The first abused CRLF injection in the From: header; the second, reported separately, abused differences in how iCloud's internal message pipeline handled dot-stuffing. SEC Consult notes that the envelope sender (Return-Path) still showed the sender's own address, which some heuristics could flag. Its timeline says the first issue was reported to Apple on 21 May 2024, Apple awarded US$15,000 through the Apple Security Bounty on 19 November 2024, and on 9 December 2025 SEC Consult confirmed the deployed fixes remediated the issue. The post lists no CVE. (source: SEC Consult) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; every detail now comes from SEC Consult's post, and the card date stays 1 October 2026, the post's date. (source: SEC Consult)
SEC Consult — From: anyone@icloud.com — Spoofing Arbitrary Apple iCloud Identities (1 Oct 2026)
Dell Security Advisory DSA-2026-448 (article 000515771; initial release 1 October 2026) patches multiple critical flaws in Dell Container Storage Modules (CSM), which connect Dell PowerStore/PowerScale/PowerFlex/PowerMax/Unity XT arrays to Kubernetes via CSI. Headline proprietary issues in CSM Authorization 2.4.0: CVE-2026-63688 (CVSS 3.1 10.0; AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) missing authentication on the csm-authorization-storage gRPC server lets an unauthenticated remote attacker obtain storage-backend administrator credentials for all registered arrays and fully bypass the CSM authorization model; CVE-2026-63692 (CVSS 10.0, same vector) missing authentication on the authorization proxy/tenant service enables unauthenticated elevation to administrative control across tenants. Same advisory also covers CVE-2026-67269 (CVSS 9.9) CSM Operator 1.12.0 privilege escalation to root on cluster nodes; CVE-2026-54472 (9.8) hard-coded credentials enabling forged admin tokens; CVE-2026-61421 (9.8) archived karavi-authorization JWT demo secret ("supersecret"); CVE-2026-67273 (9.6) template-engine issue granting cluster-wide Secrets read / RBAC tamper; plus additional High/Medium issues. Affected: CSM versions prior to 1.17.0. Remediated: CSM 1.18.0 or later. No workarounds. Dell has not reported active exploitation of these CSM flaws. (sources: Dell DSA-2026-448; BleepingComputer)
Red Hat CNA CVE-2026-96658 (published 1 October 2026; CVSS 3.1 9.9 Critical AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): authenticated low-privilege attacker can achieve remote code execution by bypassing the Foreman templating safemode sandbox — improper handling of delegated methods lets an attacker append unauthorised functions to the allowed execution list and run arbitrary commands on the hosting server. Red Hat Product Security rates Critical because a user with minimal read/view permissions can RCE the underlying Satellite host where Foreman relies on the sandbox to render templates. Fixed packages shipped 1 Oct via RHSA-2026:74506 (Satellite 6.16 el8/el9 rubygem-safemode 0:1.5.0-2), RHSA-2026:74504 (Satellite 6.18 el9 rubygem-safemode), and RHSA-2026:74503 (Satellite Utils 6.19 el9 foreman 0:3.18.0.14-1). Bugzilla 2534185. (source: Red Hat CVE)
Red Hat — CVE-2026-96658 Foreman safemode bypass RCE (1 Oct 2026)
