Cisco published cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 at 16:00 GMT (15 Oct 00:00 Perth) for CVE-2026-76519 (CWE-23) in the Advanced Malware Protection File Reputation path of Cisco Secure Email Gateway (physical and virtual). An unauthenticated remote attacker can send a crafted attachment through an affected gateway and, when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525, write arbitrary files and execute commands as root on the underlying AsyncOS host. Cisco rates it Critical (CVSS 3.1 9.8) with no workarounds, says its PSIRT became aware of active exploitation in October 2026, and notes the issue was found in internal scanning. Fixed builds include AsyncOS 15.5.5-014 and 16.5.0-780; the Content Scanner Tools package 25.3.0.5525 or later also delivers the fix without a full software upgrade or restart. Admins should check contentscannerstatus, grep system_logs for "System Security" compromise indicators, and cross-check firewall and network logs because root access can erase evidence. Secure Email and Web Manager and Secure Web Appliance are not affected. This is a separate actively exploited SEG flaw from September's CVE-2026-76461 SQL injection (already on Cyberstack and in CISA KEV). CISA also added CVE-2026-76519 itself to the Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies. Reported on 14–15 Oct by BleepingComputer. Correction (27 Oct 2026): the card date moved from 14 to 15 October 2026; Cisco's advisory shows 'First Published: 2026 October 14 16:00 GMT', which is 00:00 on 15 October in Perth (AWST); BleepingComputer's report is dated 14 October 2026 (US date, its page shows no time zone) and CISA's KEV entry is dated 14 October 2026; the BleepingComputer link label now uses the article's actual headline. (source: Cisco; BleepingComputer) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Cisco; BleepingComputer)
The Node.js project said in an advance notice dated 14 October 2026 that it will ship new versions of the 26.x, 24.x and 22.x release lines on or shortly after Wednesday 21 October 2026 to fix security vulnerabilities. The highest severity issue in each of the three lines is rated High. Node.js has not yet published the CVE numbers, affected components or fixed version numbers; those come with the release. The project reminds users that end-of-life versions are always affected when a security release happens, which includes Node.js 20 (last release 20.20.2 in March 2026) and older lines that will get no fix. Latest releases before the security update were 26.12.0 and 24.22.0 (both 14 October) and 22.23.3 (23 September). Node.js runs a large share of web back ends, build pipelines, serverless functions and developer tooling, including in Australian organisations. Separately, a trust-store change for the compromised eMudhra intermediate certificates was still listed as pending for Node.js on 21 October (see Cyberstack's eMudhra card); the advance notice does not say whether this release includes it. (source: Node.js security release notice) UPDATE (21 Oct): Node.js published the security releases: 26.12.1, 24.22.1 and 22.23.4. They fix ten vulnerabilities. High: CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js says permits remote code execution (26.x, 24.x, 22.x); CVE-2026-105482, dns.resolve truncating names that contain a NUL character (all three lines); CVE-2026-105483, a TLS certificate hostname check bypass when an IP address is written in fullwidth digits (26.x, 24.x); and CVE-2026-106069, a TLS hostname check bypass when the host loosely resolves to an IP address (all three). Medium: CVE-2026-105481 (a keep-alive socket can process a response written before the request was sent), CVE-2026-106072 (DNS SANs can authenticate non-canonical IPv4 endpoints) and CVE-2026-106074 (crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable applications, so every process repeats the same values). Low: CVE-2026-106070 (ZipFile returns attacker-controlled prefix bytes, 26.x), CVE-2026-106071 (Permission Model wildcard over-grant, 26.x) and CVE-2026-106073 (Permission Model bypass with fs.realpathSync). The releases also update c-ares and Undici on all three lines, OpenSSL on 24.x and 22.x and SQLite on 22.x, and update Node's bundled CA certificates for the eMudhra intermediate CA compromise on all three lines. Node.js publishes severity ratings, not CVSS scores. (source: Node.js security release post) UPDATE (23 Oct 2026): Imperva's red team said on 22 October that its 'Node2Shell' proof of concept ran code carried in Brotli data inside applications on the official Node.js 24.22.0 Linux arm64 image, through both a response read with the built-in fetch() and request bodies decoded by Express 5 and body-parser 2 parsers; it says execution took multiple attempts, it did not test every Node.js build or application, and 24.22.1 rejected the same inputs. Imperva says a bare Node.js HTTP server does not decode incoming Brotli bodies just by receiving them. Vercel said it deployed WAF rules on 21 October that block the inbound attack for projects on Vercel, but they do not cover responses an application fetches from other servers and do not replace patching. (source: Imperva; Vercel) UPDATE (24 Oct 2026): The Brotli flaw CVE-2026-111497 is in Google's Brotli C decoder, so other software that ships its own copy of that decoder needs its own fix. Google published fixed Brotli releases v1.2.1, v1.1.1 and v1.0.10 on 21 October, each listing 'CVE-2026-111497: out-of-bounds write permits remote code execution'. Envoy's advisory GHSA-3wvj-j6qm-62mr (23 Oct, rated Critical, CVSS 4.0 9.2) says Envoy v1.39.2, v1.38.5, v1.37.7 and v1.36.11 are vulnerable in deployments that have the Brotli decompressor configured, and that the flaw was addressed in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12. Istio's bulletin ISTIO-SECURITY-2026-007 says users who enable Brotli decompression, for example with an EnvoyFilter, should upgrade, to 1.31.2, 1.30.6 or 1.29.9 (the final 1.29 release). The Python Packaging Advisory Database (PYSEC-2026-4322 and PYSEC-2026-4323, 23 Oct) says the PyPI Brotli package up to and including 1.2.0 and brotlicffi releases before 1.2.1.0 carry the vulnerable decoder, fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0, and that with Brotli installed, common HTTP clients (urllib3/requests, httpx with the brotli extra, aiohttp) decode Brotli responses automatically. Red Hat rates the flaw Important (CVSS 3.1 8.1) and says there is no public, reliable remote code execution proof of concept. (source: Google Brotli on GitHub; Envoy; Istio; PyPA advisory database; Red Hat) UPDATE (25 Oct 2026): According to iTnews, Australian researcher Paul McCarty, co-founder and chief technology officer of OpenSourceMalware, found potentially vulnerable software that uses Google's Brotli decoder across several open source ecosystems, including Python, Go, .NET and Perl. iTnews reports McCarty as saying that Chrome and Firefox have picked up the fix in their bundled copies of Brotli; that Electron desktop apps such as Signal, Slack, Discord and Visual Studio Code each carry their own copy of the browser engine and rely on their own update mechanisms; and that Microsoft's .NET runtime, the DuckDB database and the Pillow and pyarrow Python libraries carry their own copies of the decoder. iTnews also reports that a Google engineer added the fix to Brotli in February, described only as a change to detect and report invalid streams earlier, and that it was not in an official Brotli release until October. (source: iTnews) UPDATE (26 Oct 2026): Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, along with .NET 11 Release Candidate 3, on 25 October (UTC) to fix CVE-2026-111497, which its .NET Blog describes as a buffer overflow in .NET's use of the Brotli decompression algorithm that may allow an unauthenticated attacker to read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege, on all platforms. Microsoft lists the fixed versions as .NET 8.0.33, 9.0.22 and 10.0.14, with .NET 11 RC2 users told to move to RC3. Microsoft says applications may be affected if they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression or the System.IO.Compression Brotli APIs; request decompression and automatic response decompression are not enabled by default, and .NET Framework is not affected. Microsoft says self-contained applications must be rebuilt and republished and containers rebuilt from updated .NET images, because installing a newer runtime on the host does not update a bundled runtime. The same release fixes CVE-2026-114148 (unsafe ownership metadata in Linux .NET tarballs) and re-releases fixes for CVE-2026-70197 and CVE-2026-102870 because, Microsoft says, the 13 October release did not fully address them. (source: Microsoft .NET Blog) UPDATE (26 Oct 2026): The Western Australian Government's WA SOC (WA Cyber Security Unit, DGOV Technical) issued advisory 20261026001, 'nodejs2shell - Critical Vulnerabilities', covering CVE-2026-111497 in Google Brotli 1.0.3 to 1.2.0 and in Node.js 26.x, 24.x and 22.x, which it lists at CVSS 9.2 (Critical). The WA SOC says successful exploitation can expose applications to unauthenticated remote code execution, memory disclosure and denial of service, and that it has not received any reports of exploitation of this vulnerability on Western Australian Government networks at the time of writing. It recommends administrators apply the vendor fixes to all affected devices within expected timeframes. (source: WA SOC) UPDATE (26 Oct 2026): The PHP team announced updated Windows builds, PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, which include Brotli 1.2.1 to fix CVE-2026-111497. PHP says that in its Windows builds the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled, which is off by default in cURL but can be turned on by applications and HTTP client libraries. The -1 suffix marks a Windows package rebuild with updated dependencies; the PHP source releases and runtime versions are unchanged. (source: PHP.net) UPDATE (26 Oct 2026): Fortinet's PSIRT published FG-IR-26-187, 'Multiple Node.js CVEs', on 26 October, saying it is investigating the impact of the October Node.js CVEs, including CVE-2026-111497, on its products; it lists FortiOS as under investigation and names products confirmed not affected, including FortiManager, FortiAnalyzer, FortiClient EMS, FortiAuthenticator, FortiWeb, FortiSOAR and FortiADC. (source: Fortinet PSIRT) UPDATE (26 Oct 2026): Ubuntu published USN-8956-1 on 26 October, fixing CVE-2026-111497 in its brotli, libbrotli1 and python3-brotli packages for Ubuntu 26.10 (1.2.0-4ubuntu0.1), 26.04 LTS (1.2.0-3ubuntu0.1), 24.04 LTS (1.1.0-2ubuntu0.1) and 22.04 LTS (1.0.9-2ubuntu0.1); Ubuntu says a remote attacker could possibly use the flaw to cause a denial of service or execute arbitrary code. (source: Ubuntu) UPDATE (26 Oct 2026; Palo Alto Networks): Palo Alto Networks published a portfolio status advisory for CVE-2026-111497 on 26 October, rating it CVSS-B 9.2 (Critical) and saying PAN-OS 12.2, 12.1 and 11.2 on PA-Series and VM-Series firewalls are exposed only when inspection of Brotli-compressed traffic and TLS/SSL decryption are enabled on the dataplane, with no impact on the management web interface or API; PAN-OS 11.1, PAN-OS 10.2 and Panorama are not affected. As of 27 Oct, PAN-OS fixes are listed with expected dates: 12.2.4-h1 (ETA 28 Oct), 12.1.4-h13 (ETA 29 Oct), 12.1.7-h11 (ETA 28 Oct), 12.1.10-h3 (ETA 30 Oct), 11.2.4-h23 (ETA 30 Oct), 11.2.7-h23 (ETA 29 Oct), 11.2.10-h17 (ETA 27 Oct), 11.2.13-h4 (ETA 27 Oct) and 11.2.16-h1 (ETA 28 Oct); until then Palo Alto Networks recommends disabling Brotli inspection, and says Threat Prevention subscribers get partial coverage from Threat ID 97686 (Applications and Threats content version 9165 and later). Prisma Cloud Application Security Transporter Client is fixed in 0.2.9, and Palo Alto Networks says it is not aware of any malicious exploitation. (source: Palo Alto Networks) Microsoft published the CVE record for CVE-2026-114148 at 23:21 on 29 October, Perth time, titled 'ASP.NET Core Elevation of Privilege Vulnerability' and scored CVSS 3.1 7.8. UPDATE (26 Oct 2026; Palo Alto Networks): Palo Alto Networks revised its CVE-2026-111497 advisory on 26 October, adding an FAQ that says the same PAN-OS hotfix covers both the PHP vulnerabilities and this Brotli vulnerability, with one exception: 11.2.10-h16 includes only the PHP fixes, while 11.2.10-h17 includes fixes for both. The revision also says that for Threat ID 97686, which gives partial coverage, to protect against this vulnerability, incoming traffic for the management port must be routed through a dataplane port, the certificate for inbound management traffic replaced, and inbound management traffic decrypted and inspected with threat prevention enabled. As of 27 Oct, 11.2.10-h17 and 11.2.13-h4 still show an ETA of 27 October and the other hotfixes ETAs from 28 to 30 October. (source: Palo Alto Networks) UPDATE (28 Oct 2026, Perth; CISA KEV and Palo Alto Networks): CISA added CVE-2026-111497 ("Google Brotli Unchecked Return Value Vulnerability") to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a due date of 10 November 2026 for US federal agencies and known ransomware use listed as Unknown (source: CISA KEV). Palo Alto Networks, as of its 27 October revision, still says it is not aware of any malicious exploitation of this issue; it removed the ETAs for PAN-OS 11.2.10-h17, 12.1.7-h11 and 12.2.4-h1 "as these versions are released", while 11.2.13-h4 still shows ETA 27 October, 11.2.16-h1 28 October, 12.1.4-h13 and 11.2.7-h23 29 October, and 12.1.10-h3 and 11.2.4-h23 30 October (source: Palo Alto Networks advisory CVE-2026-111497). UPDATE (29 Oct 2026, Perth; Palo Alto Networks): Palo Alto Networks' advisory, in revisions dated 28 October, removed the ETAs for PAN-OS 11.2.7-h23, 11.2.13-h4 and 11.2.16-h1 "as these versions are released", added a solution table, removed the threat ID from its workarounds and mitigations section, and added Idira IGA to the cloud products it lists as remediated; as of 29 October its product status table still shows ETAs of 29 October for 12.1.4-h13 and 30 October for 12.1.10-h3 and 11.2.4-h23, and it still says it is not aware of any malicious exploitation of this issue (source: Palo Alto Networks advisory CVE-2026-111497). UPDATE (29 Oct 2026, Perth; Palo Alto Networks): In a revision dated 29 October, Palo Alto Networks removed the ETAs for PAN-OS 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 'as these versions are released'; as of 29 October no PAN-OS hotfix in its product status table for this flaw still shows an ETA, and it still says it is not aware of any malicious exploitation of this issue (source: Palo Alto Networks advisory CVE-2026-111497). Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Node.js; Imperva)
Node.js — Wednesday, October 21, 2026 Security Releases (advance notice 14 Oct; release details 21 Oct 2026)
EG Secure Solutions disclosed on 14 October 2026 an OS command injection vulnerability, CVE-2026-106931 (JVN#88474777), in the statistics function of SiteGuard Server Edition, a host-based web application firewall widely used in Japan for Apache, Nginx and IIS. The vendor says exploitation has already been confirmed. A successful attack lets an attacker run arbitrary OS commands with root or SYSTEM privileges on the server running the product. Affected are version 2.20 and later with the statistics feature enabled, which is the default: Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache and Nginx editions before Ver7.00 Update6. IIS Ver3.10 through Ver4.00 Update4 are not affected. The vendor rates it CVSS 4.0 8.5 (CVSS 3.0 7.8) with a local attack vector and low privileges required. It notified customers with direct support contracts on 29 September and offers a replacement-file patch for those who cannot upgrade, including end-of-support versions. JPCERT/CC issued an alert the same day, noting the product is widely used in Japan and urging both patching and compromise checks. The vendor warns that upgrading may wipe attack traces, so collect the diagnostic information from the web admin console before updating. (sources: EG Secure Solutions; JPCERT/CC alert) UPDATE (22 Oct 2026): CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on 20 October 2026, with a 23 October due date for US federal agencies. (source: CISA KEV catalog) Correction (02 Nov 2026): removed The Hacker News as a source. (source: EG Secure Solutions; JPCERT/CC)
EG Secure Solutions — SiteGuard Server Edition OS command injection vulnerability (urgent), CVE-2026-106931 (14 Oct 2026, Japanese)
Vercel published a Next.js Security Update for Upstream Vulnerabilities on 14 October 2026, shipping out-of-band fixes that had been postponed from the September security release while upstream dependencies caught up. Two issues are rated critical at CVSS 4.0 9.5: (1) GHSA-673q-mjm6-r5xr — unauthenticated remote code execution in App Router apps with Cache Components when a use cache function returns multiple typed arrays (affected Next.js 16.0.0 through 16.4.0; fixed in 16.4.1; related React advisory GHSA-xqc2-xf4c-x3h3; no known workaround — upgrade even if you think you lack similar functions); (2) CVE-2026-96889 / GHSA-2464-fhr4-w9xw — unauthenticated RCE via the Image Optimization API when attacker-supplied SVG is processed through sharp on glibc-based Linux (affected 10.0.0–15.5.27 and 16.0.0–16.4.0; fixed in 15.5.28 and 16.4.1; workaround is sharp >= 0.35.5). A third issue, GHSA-p3m5-59mp-jv5r (related React GHSA-h3gv-c5rc-p453), is a high-severity denial of service against App Router apps that expose at least one Server Action (crafted requests can pin CPU and block further requests in the same process; Pages Router or apps without Server Actions are not vulnerable; fixed in the same patched trains). (sources: Next.js blog security update; vendor advisories on GitHub)
Next.js — Security Update for Upstream Vulnerabilities (14 Oct 2026)
The Drupal Security Team published SA-CORE-2026-014 on 14 October 2026 for CVE-2026-108097, a remote code execution flaw in the core Field UI module (the admin UI for managing fields and their display). Drupal rates it Critical 19/25 (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default). The advisory says the issue is not directly exploitable with core alone, but multiple serious exploit paths exist through contributed modules, and at least one known path needs no authentication; custom code may also expose the vulnerable functionality. Mitigate immediately by uninstalling the core field_ui module while preparing the upgrade. Fixed releases: Drupal 11.4.10, 11.3.19, 10.6.19, and 12.0.0-beta2 for the 12.0 beta line (beta branch only). Drupal 11.2.x and below, 10.5.x and below, and Drupal 8/9 are end-of-life and receive no fix. Drupal Steward is described as protecting some known attack vectors but not all. Reported by Drew Webber of the Security Team and Octavio Galland. (source: Drupal SA-CORE-2026-014) UPDATE 14–17 Oct 2026: In the same 14 October security window the Drupal Security Team also published SA-CONTRIB-2026-218 for the contributed Entity List module (entity_list, which builds lists of entities without Views): CVE-2026-108099, remote code execution, rated Critical 19/25 with the same risk vector. As with the core flaw, the module alone is not directly exploitable, but multiple serious exploit paths exist through other contributed modules, at least one known path needs no authentication, and custom code may also expose it. The fix is Entity List 3.0.10. BleepingComputer (17 October) reported both flaws together and noted the Security Team's pre-release warning that exploits might be developed within hours or days of disclosure. No exploitation has been reported so far. Drupal published the CVE records for CVE-2026-108097 and CVE-2026-108099 on cve.org at 11:09 on 30 October, Perth time; their affected version ranges match the Drupal security advisories.
Drupal.org — SA-CORE-2026-014: Field UI remote code execution (CVE-2026-108097, 14 Oct 2026)
The util-linux project published two security advisories with CVE records on 14 October 2026 for the set-user-ID mount utility shipped by nearly every Linux distribution. Both need a local low-privileged user whom /etc/fstab already allows to mount something (a user or users entry), and both are time-of-check to time-of-use races won by swapping a path component with renameat2(RENAME_EXCHANGE) in an ancestor directory the attacker can write to. CVE-2026-53612 (GHSA-g8wm-75wr-g2vh) is in the hook_owner post-mount hook: when the fstab entry also sets X-mount.mode, X-mount.owner or X-mount.group, mount runs chmod and lchown on a path that can be redirected to a root-owned file. It affects 2.39 through 2.41.4 and 2.42 through 2.42.1. CVE-2026-53613 (GHSA-8gj5-72r3-428g) is in restricted non-root mount requests, which check the fstab target and then resolve the path again, so the mount can be redirected to somewhere like /etc/sudoers.d. It affects 2.17 through 2.41.6 and 2.42 through 2.42.3, and 2.42.4 when the legacy mount(2) path is used without /proc. Both are rated CVSS 3.1 7.0 (local, high complexity). No exploitation has been reported. (sources: util-linux GitHub advisories; CVE records)
util-linux — GHSA-8gj5-72r3-428g, mount target TOCTOU (CVE-2026-53613; 14 Oct 2026)
Progress published CVE records on 14 October 2026 for at least 11 vulnerabilities in MOVEit Transfer, its managed file transfer server, all fixed in MOVEit Transfer 2025.1.6 and 2026.0.4 and referenced to Progress's MOVEit Transfer Critical Security Bulletin (September 2026). The highest-rated are CVE-2026-89067, an authentication bypass through an alternate path in Secure Messaging (CVSS 3.1 8.8, low-privileged network attacker; credited to Leo Oliver), and CVE-2026-87093, a service directory writable by local users that allows local privilege escalation (8.8). Several more weaken sign-in: CVE-2026-89068, a missing step in LDAP sign-on authentication (8.1, no privileges needed but high complexity); CVE-2026-89074, an email MFA bypass through unicode handling (7.5); CVE-2026-89070, OIDC authentication replay (7.5); CVE-2026-89073, an OAuth access-restriction bypass through weak session expiry (7.5); CVE-2026-89071, LDAP injection in certificate-based authentication (7.5); CVE-2026-89072, an authorisation flaw in client-certificate management (7.5); and CVE-2026-89077, an identity-validation flaw in SFTP authentication (7.5). The set also includes SQL injection in Custom Reports for admins (CVE-2026-89076, 7.2) and local disclosure of session information (CVE-2026-89075, 7.3). The CVE records do not report exploitation. MOVEit Transfer matters for Australian organisations because internet-facing MOVEit servers were mass-exploited by the Clop gang in 2023 (CVE-2023-34362).
Progress — MOVEit Transfer Critical Security Bulletin, September 2026 (CVE records published 14 Oct 2026)
Juniper Networks published its October 2026 Junos OS and Junos OS Evolved security advisories on 14 October 2026, with CVE records for at least 16 issues. The most serious are in J-Web, the built-in web management interface. CVE-2026-101956 (JSA112188) lets an unauthenticated remote attacker run arbitrary Junos commands with root privileges through an exposed J-Web interface. CVE-2026-101986 (JSA112187) bypasses J-Web authentication to run CGI content with elevated privileges using a crafted HTTP request. CVE-2026-101983 is a stack buffer overflow in httpd that an unauthenticated attacker can reach when a J-Web virtual-domain is configured. Juniper rates all three 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0). Other bugs rated 9.8 are CVE-2026-33792, a stack overflow in srxpfe on SRX Series triggered by a crafted packet on a configured GRE tunnel (JSA112186); CVE-2026-102182 in kmd on MX Series via certificate-based IKE packets (JSA112196); and CVE-2026-33789 and CVE-2026-33796 in rpd when BGP Monitoring Protocol (BMP) is enabled (JSA112187). The release also fixes an SRX ADVPN peer-message overflow (CVE-2026-102084), an SRX Security Intelligence feed format-string bug (CVE-2026-102062), an authd overflow reachable with SNMP read access when SNMP and AAA are on (CVE-2026-101979), and a PTX zero-touch provisioning DHCP command injection (CVE-2026-101967), among others. Juniper SIRT says it is not aware of malicious exploitation, and lists no workarounds for the J-Web, GRE and IKE issues. (sources: Juniper's JSA advisories; Juniper-issued CVE records) UPDATE 19 October 2026: Singapore's Cyber Security Agency (alert AL-2026-146, 19 Oct) and Belgium's CCB (16 Oct) have issued patch-now warnings for the same release, and both list further 9.8-rated bugs that Juniper's CVE records (all referencing JSA112187) confirm: CVE-2026-101954, a fourth unauthenticated J-Web flaw, in J-Web and its NETCONF session handling, that gives root-level configuration access and full device takeover when web management is reachable (Junos OS 25.2, 25.4 and 26.2 trains and matching Evolved releases); CVE-2026-102178, a stack overflow in the BGP daemon triggered by flowspec route re-advertisement from a configured flowspec peer when BGP update-threading is enabled; CVE-2026-101990, an rpd stack overflow from a flow-spec update selected for re-advertisement (code execution on Junos OS, crash on Evolved); CVE-2026-101982, an rpd stack overflow from EVPN-VPWS route advertisements by a configured BGP/EVPN peer (root code execution on Junos OS); and CVE-2026-102175, a heap overflow in the sdxd service-deployment daemon reachable by an attacker who controls or intercepts the configured SDX/SRC server connection. All are rated 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0) by Juniper and are fixed in the same releases as the J-Web bugs. Still no reported exploitation.
Noma Labs published SneakPeek on 14 October 2026, an exploit chain in the preview pane of Claude Code Desktop, the desktop app's coding interface. When Claude reads or edits an HTML file, the pane renders it automatically. Files under 256 KB load as data: URLs with a Content Security Policy that blocks scripts. Files over 256 KB were written to a temporary file and loaded from file://, where the CSP was not applied. The request filter meant to stop local file reads only worked when the pane was proxying a dev server, not when rendering a static file from disk. Noma's proof of concept hid a payload in an oversized test-coverage report in a public repo. Once the victim cloned it and asked Claude to look at the report, the script read SSH private keys, AWS keys, npm and GitHub tokens, Kubernetes and Docker credentials, Git tokens and Claude's own OAuth tokens. It then sent them out with navigator.sendBeacon, and could leak the user's real IP address through WebRTC, with no permission prompt. Noma reported it on 4 July 2026. Anthropic scored it 8.7 (CVSS 4.0, high) and treated it as equivalent to code execution on the host. Its first patch blocked file:// fetches from the page, but Noma bypassed that with a Web Worker created from a blob: URL. Anthropic then shipped a complete fix in Claude Desktop 1.30096.1 (17 August 2026), delivered by auto-update. Noma says a GitHub advisory and CVE are still pending. No in-the-wild exploitation is reported. Separate from the Claude Code plugin SHA-pin bypass (CVE-2026-86063) on Cyberstack.
Noma Labs — SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data (14 Oct 2026)
OpenVPN's CNA published CVE-2026-84471 on 14 October 2026 (CVE record datePublished 14:29 UTC). The community security announcement describes a possible double-free of a TLS session buffer in the lame-duck path because the guard in check_session_buf_not_used() was incomplete, extending the earlier work on CVE-2026-13117. The CVE description (also from OpenVPN) frames it as an incomplete fix for the related CVE-2026-12996 use-after-free and says a remote authenticated peer can cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry (CWE-416). OpenVPN rates it CVSS 4.0 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H). Affected lines in the CVE record are OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7; the vendor announcement says 2.6.0–2.6.22 and 2.7_alpha1–2.7.6 are affected and lists fixed builds 2.6.23 and 2.7.7. GitHub release notes for openvpn 2.6.23 (23 September 2026) explicitly credit the improved check_session_buf_not_used() / double-free lame-duck fix as CVE-2026-84471. No public exploitation is reported. Related earlier TLS-session memory issues on the same code path include CVE-2026-12996 (fixed in 2.6.21 / 2.7.5) and CVE-2026-13117.
OpenVPN community — CVE-2026-84471 security announcement (possible double-free in check_session_buf_not_used() lame duck handling; fixed 2.6.23 / 2.7.7)
nginx.org released nginx 1.30.6 (stable) and 1.31.7 (mainline) on 14 October 2026 with fixes for five vulnerabilities, and F5 published matching advisories and CVE records the same day. The three most serious hit the NGINX data plane and are rated High 8.1 (CVSS 3.1) and Critical 9.2 (CVSS 4.0) by F5: CVE-2026-97205, a use-after-free in ngx_http_core_module when asynchronous file I/O (AIO) is on and a Server Side Includes page uses an include virtual command; CVE-2026-93479, a heap buffer overflow when map regex capture variables are evaluated in a root directive or access-log format before the map's own variable; and CVE-2026-15176, a heap buffer overflow when a location combines alias with rewrite and a set or return that references $request_filename (or $request_filename appears in a log_format). A remote unauthenticated request can crash and restart workers; F5 says code execution is possible only if ASLR is disabled or bypassed, and each bug needs a specific configuration. The same release also fixes CVE-2026-95101, HTTP/3 request body injection (F5 CVSS 5.3 / 6.9), and CVE-2026-97629, session forgery when TLS session ticket keys are rotated (6.5 / 8.3). nginx.org itself grades all five medium. NGINX Plus 37.x, NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric and some NGINX Ingress Controller releases are also affected; Plus R35 and R36 get no fix. No exploitation has been reported. Separate from the October nginx-ui card on Cyberstack (a different project).
nginx.org — nginx security advisories (CVE-2026-15176, -93479, -95101, -97629, -97205; not vulnerable 1.31.7+, 1.30.6+; 14 Oct 2026)
Collabora published GHSA-g3vx-3m76-fghh on 14 October 2026 for CVE-2026-110447 in the optional Nextcloud app Collabora Online - Built-in CODE Server (package richdocumentscode). When the local CODE process is not running (restart, upgrade, or crash), an unauthenticated HTTP request can inject OS commands through proxy.php because request path text was placed inside a double-quoted bash command up to 26.4.302. Attackers used that window to plant web shells; admins reported first hits from 10 September 2026, with request markers such as %2e%2e, $(, ${IFS}, and base64 -d piped to sh. Collabora rates it Critical (CVSS 4.0 9.2), fixed the bug in 26.4.303 on 11 September, and warns that disabling the app is not enough — it must be upgraded to ≥ 26.4.303 or removed. Standalone Collabora Online servers are not affected; installs that use only the Nextcloud Office app (richdocuments) against an external Collabora server are not affected. Fixed builds need Nextcloud 30 or later; EOL Nextcloud ≤ 29 still receive an affected app-store build and should upgrade Nextcloud or remove the app. This path is separate from CVE-2025-66208 in the same script. UPDATE (24 Oct 2026): CISA added CVE-2026-110447 ('Collabora Online – Built-in CODE Server OS Command Injection Vulnerability') to its Known Exploited Vulnerabilities catalog on 23 October 2026, with a remediation due date of 26 October 2026 for US federal civilian agencies and forensic triage required. (source: CISA KEV) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Collabora advisory on GitHub; CISA)
Collabora GHSA-g3vx-3m76-fghh — Unauthenticated OS command injection in richdocumentscode proxy (CVE-2026-110447, 14 Oct 2026)
