Wind River CNA CVE-2026-104018 (published 1 October 2026; CVSS 3.1 8.8 High AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): improper privilege management (CWE-269) in the VxWorks 7 command shell when per-user command privileges are enforced. Under certain shell operations a command may run without the usual privilege check, so an authenticated low-privilege user can execute unauthorised commands — confidentiality/integrity/availability impact on the device. Affects all VxWorks 7 versions prior to 26.09; fixed in 26.09 (per Wind River CVE text). CISA SSVC on NVD: exploitation none / not automatable at publication. (sources: Wind River CVE page)
Wind River Support — CVE-2026-104018 VxWorks 7 privilege management
Fortinet PSIRT FG-IR-26-175 (published / revised 1 October 2026; FortiGuard IR RSS + advisory) discloses CVE-2026-104286, a Critical CVSSv3 9.8 path-traversal (CWE-22) plus improper NULL-byte neutralization (CWE-158) flaw in the FortiMail management interface that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Impact: execute unauthorised code or commands. Attack type: unauthenticated. Known exploited: Yes (Fortinet). Affected: FortiMail 8.0.0–8.0.1 (upgrade to upcoming 8.0.2+), 7.6.0–7.6.6 (upcoming 7.6.7+), 7.4.0–7.4.8 (upcoming 7.4.9+), 7.2.0–7.2.9 (upgrade to 7.4 branch or later). Discovered internally by Fortinet Product Security. Workarounds until patches land: disable IBE (`config system encryption ibe` / `set status disable`) and/or remove internet exposure of the FortiMail management interface (trusted networks only). BleepingComputer (1 Oct) reports Fortinet IoCs (added/modified files under /data and /bin, SHA-256 hashes, attacker IPs 79.141.169.187 and 45.129.0.192, archive234 remote-archive config, cron/migadmin and IBE Base64 decode failure log patterns) and notes Fortinet is coordinating with government agencies including CISA. CISA added CVE-2026-104286 to KEV on 1 Oct 2026 (FCEB due 4 Oct 2026 per BleepingComputer). (sources: FortiGuard Labs PSIRT; BleepingComputer)
Fortinet PSIRT FG-IR-26-175 — FortiMail CVE-2026-104286 (1 Oct 2026)
Wordfence CNA CVE-2026-1581 (published 19 Feb 2026; CVSS 3.1 7.5 High AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): unauthenticated time-based SQL injection in the WordPress wpForo Forum plugin via the ‘wpfob’ parameter in all versions up to and including 2.4.14 (insufficient escaping/preparation on SQL). Vendor changelog: 2.4.15 (10 Feb 2026) lists “Security: Vulnerability - Unauthenticated Time-Based SQL Injection” (current trunk Stable tag 3.2.2). (source: Wordfence/MITRE CVE record) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: CVE record; WordPress.org)
Kiteworks GitHub advisory GHSA-5xhq-9wq3-rvj6 / CVE-2026-54154 (BleepingComputer 1 October 2026): a maximum-severity chain of path traversal, code injection, and missing authentication on publicly reachable Email Protection Gateway (EPG) endpoints can let an unauthenticated remote attacker achieve arbitrary code execution and escalate to full administrative (root) control of the appliance. CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affects all Kiteworks EPG releases before 9.4.1; fixed in 9.4.1+. Same 1 Oct patch batch also addresses 11 other critical issues (auth bypass, admin takeover, stored XSS, access control) across Core and EPG, totaling 126 vulnerabilities. Reported via YesWeHack bug bounty. Shadowserver tracks ~400 internet-exposed Kiteworks instances. (sources: Kiteworks; BleepingComputer)
CVE-2026-17106 (GHSA-hfg8-hc9c-6c3h; Docker/Moby; published mid-August 2026; dubbed CopyEscape): tar extraction in moby/go-archive (Unpack/UnpackLayer/Untar and ApplyLayer helpers) does not confine filesystem writes to the destination directory — lexical path checks can be defeated when archive entries introduce links the OS then follows. An attacker who controls a running container can race docker cp archive generation (directory → symlink TOCTOU) so the host-side CLI extracts attacker-chosen files outside the user-selected destination with the privileges of the docker cp process (including sudo docker cp → root on Linux; macOS Desktop extracts on the host even though containers run in a Linux VM). Imperva research (Ron Masas; Cyber Security News 1 Oct 2026) shows the chain replacing host binaries such as runc so a later Docker runtime invoke runs attacker code as root; also affects Docker Sandboxes sbx cp for AI-agent workflows pulling files from untrusted sandboxes. CVSS 4.0 7.1 HIGH (AV:L/AC:L/AT:P/PR:N/UI:A/…). Fixed: moby/go-archive 0.3.0; Docker Engine/CLI 29.7.0; Docker Desktop 4.86.0 (10 Aug 2026 notes: destination-escape in docker container cp); Docker Compose 5.4.0; Docker Sandboxes 0.38.0. Until patched: do not docker cp from untrusted/compromised containers; stop the container before copy; avoid sudo docker cp in CI. (sources: GitHub Advisory GHSA-hfg8-hc9c-6c3h; Docker Engine 29 notes; Cyber Security News)
NVIDIA Security Bulletin for GPU Display Driver — September 2026 (a_id 5861, initial release 30 September, revision 02 on 13 October 2026) includes CVE-2026-47595: in the Linux kernel-mode layer an unprivileged user can write to read-only memory because permissions are not preserved (CWE-281). NVIDIA rates it CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with impacts of code execution, privilege escalation, DoS, information disclosure and data tampering. CVE-2026-47595 is on the Linux R615/R610/R595/R580 fix lists in the bulletin. Patch Linux GeForce/RTX/Quadro/Tesla branches to 615.71.09, 610.57.04, 595.91.07 or 580.178.04 as applicable; vGPU Linux guest drivers prior to 20.2 / 19.6 also list this CVE. (source: NVIDIA bulletin) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: NVIDIA)
NVIDIA — Security Bulletin: NVIDIA GPU Display Driver — September 2026 (a_id 5861; rev 02 updated 13 Oct 2026)
The Model Context Protocol (MCP) project published advisory GHSA-6qxp-vccf-f47h on 30 September 2026, with CVE-2026-104850 following on 6 October. In affected versions the official TypeScript SDK's OAuth client let the MCP server it connected to decide which authorization server received the client's credentials, because saved credentials were not tied to the authorization server that issued them. A malicious or compromised MCP server could name its own authorization server and, with no user interaction, receive the refresh token and client secret saved from an earlier sign-in, or the client secret or signed assertion configured on a bundled provider. Affected: @modelcontextprotocol/sdk 1.12.0 to 1.30.1, and @modelcontextprotocol/client 2.0.0 and 2.1.0 in specific setups, when the client uses the SDK's OAuth support over HTTP (an authProvider on a transport, the withOAuth() middleware, or direct auth() or fetchToken() calls). MCP servers built with the SDK and stdio clients are not affected. The fix records the issuer on saved credentials and refuses to send them elsewhere, but upgrading is not enough on its own: bundled providers need expectedIssuer set, and credentials saved before the upgrade still go to whichever server is named first unless they gain an issuer or are cleared. A new interactive sign-in still goes where the MCP server points. (sources: MCP GitHub advisory; CVE record)
MCP TypeScript SDK — GHSA-6qxp-vccf-f47h: OAuth client could send credentials to an authorization server chosen by the MCP server (30 Sep 2026)
The Python Software Foundation announced CVE-2026-19445 on 30 September 2026 (security-announce, Seth Larson): a Critical use-after-free (CWE-416) in CPython's ssl module. A remote, unauthenticated TLS client can make a server crash or call through a freed pointer when the server's sni_callback assigns a different context to SSLSocket.context (the documented way to pick a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical exposure is servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with the context are not affected, and TLS clients are not affected. The CVE record marks CPython before 3.10.22, 3.11.0 to before 3.11.17, 3.12.0 to before 3.12.15, 3.13.0 to before 3.13.16, 3.14.0 to before 3.14.8 and 3.15.0a1 to before 3.15.0rc3 as affected. PSF scores it CVSS v4 9.2 (attack complexity high, attack requirements present). Fix: cpython PR 158504. Australia: WA Government SOC advisory 20261005002 (5 Oct) rates it Critical, notes CPython ships inside many operating systems and perimeter devices, and has no reports of exploitation on WA Government networks. NVD analysis pending.
Python security-announce — CVE-2026-19445 use-after-free of server-side SSLContext when sni_callback switches contexts (30 Sep 2026)
Cato Networks knowledge-base advisory (published 30 September 2026) covers CVE-2026-10726 and CVE-2026-10739 affecting Cato Windows SDP Client versions lower than 6.12.6: a local attacker with access to the installed client can escalate privileges. Fixed in Windows Client 6.12.6 and higher; Cato recommends identifying older clients via Access Overview (filter Cato Client / Windows) and upgrading via Client Rollout / automatic upgrade service. Quarkslab research write-up (1 October 2026) details CVE-2026-10739 as a split-tunnel upload / named-pipe path where a client-supplied SID is used in a filesystem path, enabling arbitrary SYSTEM file delete (and, in their chain, Windows Installer rollback to SYSTEM). Confirmed by Quarkslab on 6.2.0 and 6.4.6; vendor scope is any version before 6.12.6. OpenCVE / Rapid7 list CVE-2026-10739 as CVSS 4.0 8.5 HIGH (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/…). No wild exploitation stated in the vendor advisory. (sources: Cato Networks; Quarkslab)
n8n GitHub security advisories published 30 September 2026 (High; CVSS 4.0 vectors on GHSA pages; no CVE IDs assigned on these GHSAs at publish). Lead issues: GHSA-5jr4-xmvf-frmj — MCP workflow-validation interpreter allows shared prototype mutation so a member with only a read grant can pass permission checks and take over the instance owner account (MFA-protected accounts not affected); GHSA-x8wx-g24x-3549 — Git node Log operation skipped local-config neutralization, enabling program execution as the n8n process user (also usable as an agent tool; also patched on 1.123.83); GHSA-5qpp-pqww-h7fp — Microsoft SQL node v1 interpolates expressions into Query without parameterisation (arbitrary SQL under stored DB credential when untrusted input is bound); GHSA-728h-pmr2-7cgh — Send-and-Wait waiting-webhook HMAC bypass lets a caller with a resume token approve another party’s waiting execution (downstream runs as workflow owner); GHSA-3qcw-p65v-c7vq — unauthenticated unbounded OAuth client persistence via authorize endpoint (disk-fill). Same-day batch also includes additional High/Moderate items (credential check gaps, Chat Trigger XSS, AI Workflow Builder prototype pollution, etc.). (source: n8n GitHub security advisories)
TanStack (Tanner Linsley; blog and GHSA-qx66-fv34-fjm8, 30 September 2026) discloses CVE-2026-102989, a critical reflected cross-site scripting flaw in TanStack Start server-function response handling. The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields; an unauthenticated attacker can craft a server-function URL that returns attacker-controlled HTML from the application's origin. CVSS 3.1 9.3 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Affected: published @tanstack/start-server-core, react-start, solid-start, and vue-start from 1.143.12 up to (excluding) patched versions. Fixed: start-server-core 1.169.39; react-start 1.168.60; solid-start 1.168.57; vue-start 1.168.56. Redeploy required after dependency bump. Temporary mitigations: edge/WAF rules on /_serverFn/* (e.g. require x-tsr-serverFn: true; block document navigations); restrictive CSP on server-function responses. (sources: TanStack blog; GitHub Advisory GHSA-qx66-fv34-fjm8)
TanStack Blog — Start security update CVE-2026-102989 (30 Sep 2026)
