https://vulnpost.com/Tech and security news that mattersenWed, 21 Oct 2026 16:20:35 +0000https://vulnpost.com/news/vulnerabilities/follow-redirects-cve-2026-111755-regex-flaw-leaks/https://vulnpost.com/news/vulnerabilities/follow-redirects-cve-2026-111755-regex-flaw-leaks/Wed, 21 Oct 2026 09:40:33 +0000VulnerabilitiesA flaw in follow-redirects versions 1.16.0 up to 1.16.1 allows sensitive headers with specific characters to leak during cross-origin redirects. Version 1.16.1 patches the issue.https://vulnpost.com/news/vulnerabilities/chrome-156-skia-memory-corruption-fixes-address/https://vulnpost.com/news/vulnerabilities/chrome-156-skia-memory-corruption-fixes-address/Wed, 21 Oct 2026 08:27:38 +0000VulnerabilitiesGoogle releases Chrome 156 for desktop and ChromeOS, addressing 353 security issues on desktop with critical memory corruption fixes in Skia and Accessibility.https://vulnpost.com/news/vulnerabilities/argo-cd-kustomize-flaw-enables-critical-rce-on/https://vulnpost.com/news/vulnerabilities/argo-cd-kustomize-flaw-enables-critical-rce-on/Wed, 21 Oct 2026 07:47:21 +0000VulnerabilitiesA flaw in Argo CD allows attackers to run commands on repo servers via crafted Kustomize files, with patches now available for affected versions.https://vulnpost.com/news/vulnerabilities/ibm-app-connect-enterprise-flaw-allows-remote/https://vulnpost.com/news/vulnerabilities/ibm-app-connect-enterprise-flaw-allows-remote/Wed, 21 Oct 2026 06:58:19 +0000VulnerabilitiesIBM App Connect Enterprise versions up to 13.0.8.2 face critical risk from unrestricted IP binding that exposes sensitive data.https://vulnpost.com/news/vulnerabilities/php-critical-rce-flaws-prompt-emergency-patch-for/https://vulnpost.com/news/vulnerabilities/php-critical-rce-flaws-prompt-emergency-patch-for/Wed, 21 Oct 2026 06:12:34 +0000VulnerabilitiesPHP issues urgent security update for two remote code execution flaws rated 9.2, affecting only actively supported branches.https://vulnpost.com/news/vulnerabilities/totolink-x2000r-router-rce-vulnerability-allows/https://vulnpost.com/news/vulnerabilities/totolink-x2000r-router-rce-vulnerability-allows/Wed, 21 Oct 2026 03:45:17 +0000VulnerabilitiesAuthenticated attackers can execute arbitrary code on Totolink X2000R routers running specific firmware versions via a high-severity injection vulnerability.https://vulnpost.com/news/vulnerabilities/pillow-13-0-0-fixes-high-severity-heap-buffer/https://vulnpost.com/news/vulnerabilities/pillow-13-0-0-fixes-high-severity-heap-buffer/Wed, 21 Oct 2026 03:33:17 +0000VulnerabilitiesSecurity teams must upgrade Pillow to version 13.0.0 to address a high-severity memory leak in TIFF decoding that exposes heap contents.https://vulnpost.com/news/vulnerabilities/php-remote-code-execution-flaws-emergency-patches/https://vulnpost.com/news/vulnerabilities/php-remote-code-execution-flaws-emergency-patches/Wed, 21 Oct 2026 02:46:49 +0000VulnerabilitiesTwo critical RCE vulnerabilities in PHP versions 5 through 8 require immediate preparation for emergency updates scheduled for next week.https://vulnpost.com/news/vulnerabilities/totolink-x2000r-stack-overflow-in-boa-formipqos/https://vulnpost.com/news/vulnerabilities/totolink-x2000r-stack-overflow-in-boa-formipqos/Wed, 21 Oct 2026 02:30:30 +0000VulnerabilitiesAn authenticated attacker can trigger arbitrary code execution in specific Totolink X2000R firmware builds via a crafted HTTP request.https://vulnpost.com/news/vulnerabilities/totolink-x2000r-ipv6-config-buffer-overflows/https://vulnpost.com/news/vulnerabilities/totolink-x2000r-ipv6-config-buffer-overflows/Wed, 21 Oct 2026 01:14:54 +0000VulnerabilitiesMultiple buffer overflows in the X2000R’s IPv6 configuration allow authenticated attackers to run arbitrary code on the device.https://vulnpost.com/news/vulnerabilities/totolink-x2000r-pppoe-stack-overflow-bugs-enable/https://vulnpost.com/news/vulnerabilities/totolink-x2000r-pppoe-stack-overflow-bugs-enable/Wed, 21 Oct 2026 00:28:21 +0000VulnerabilitiesAuthenticated attackers can execute code on specific Totolink X2000R firmware versions via crafted HTTP requests targeting PPPoE settings.https://vulnpost.com/news/vulnerabilities/oracle-e-business-suite-tcf-servlet-sql-injection/https://vulnpost.com/news/vulnerabilities/oracle-e-business-suite-tcf-servlet-sql-injection/Wed, 21 Oct 2026 00:04:30 +0000VulnerabilitiesUnauthenticated attackers can exploit CVE-2026-101767 to run code on EBS servers. Oracle released a patch in October 2026.https://vulnpost.com/news/vulnerabilities/oracle-october-cpu-fixes-1209-cves-with-112/https://vulnpost.com/news/vulnerabilities/oracle-october-cpu-fixes-1209-cves-with-112/Tue, 20 Oct 2026 22:39:35 +0000VulnerabilitiesThe final quarterly update for 2026 addresses flaws in 33 product families, with Fusion Middleware receiving the most patches.https://vulnpost.com/news/vulnerabilities/apache-tomcat-http-2-async-flaw-mixes-user/https://vulnpost.com/news/vulnerabilities/apache-tomcat-http-2-async-flaw-mixes-user/Tue, 20 Oct 2026 18:15:50 +0000VulnerabilitiesA flaw in Apache Tomcat's HTTP/2 async processing can cause user request mix-ups. The advisory lists affected versions but does not mention a fix.https://vulnpost.com/news/vulnerabilities/go-1-27-3-and-1-26-10-released-for-ca-certificate/https://vulnpost.com/news/vulnerabilities/go-1-27-3-and-1-26-10-released-for-ca-certificate/Tue, 20 Oct 2026 18:12:53 +0000VulnerabilitiesGoogle released minor point updates for Go 1.27 and 1.26 that include a security fix related to CA certificate removal.https://vulnpost.com/news/vulnerabilities/apache-tomcat-jstl-plug-in-has-low-severity/https://vulnpost.com/news/vulnerabilities/apache-tomcat-jstl-plug-in-has-low-severity/Tue, 20 Oct 2026 17:57:31 +0000VulnerabilitiesA logic error in the Jasper JSTL plug-in allows code execution after redirects in multiple Apache Tomcat versions, with no patch confirmed yet.https://vulnpost.com/news/vulnerabilities/openstack-cinder-messages-api-flaw-leaks-cross/https://vulnpost.com/news/vulnerabilities/openstack-cinder-messages-api-flaw-leaks-cross/Tue, 20 Oct 2026 17:28:55 +0000VulnerabilitiesA vulnerability in OpenStack Cinder allows cross-project information disclosure via the Messages API, affecting specific versions from 9.0.0 to 29.0.0.https://vulnpost.com/news/vulnerabilities/openstack-manila-fixes-cross-project-share/https://vulnpost.com/news/vulnerabilities/openstack-manila-fixes-cross-project-share/Tue, 20 Oct 2026 17:27:32 +0000VulnerabilitiesOpenStack Manila versions before specific updates allow unauthorized changes to public share settings and export metadata across projects.https://vulnpost.com/news/vulnerabilities/roundcube-webmail-patches-command-injection-and/https://vulnpost.com/news/vulnerabilities/roundcube-webmail-patches-command-injection-and/Tue, 20 Oct 2026 17:02:45 +0000VulnerabilitiesThe Roundcube team released security updates on Oct 19 to address multiple vulnerabilities, including command injection, in versions prior to 1.6.20 and 1.7.5.https://vulnpost.com/news/vulnerabilities/mozilla-issues-guidance-following-emudhra/https://vulnpost.com/news/vulnerabilities/mozilla-issues-guidance-following-emudhra/Tue, 20 Oct 2026 16:51:25 +0000VulnerabilitiesMozilla published advice on Oct 20 regarding compromised eMudhra intermediate certificates, urging protection for Firefox users via security mailing lists.https://vulnpost.com/news/vulnerabilities/threadx-buffer-validation-flaw-allows-out-of/https://vulnpost.com/news/vulnerabilities/threadx-buffer-validation-flaw-allows-out-of/Tue, 20 Oct 2026 15:42:32 +0000VulnerabilitiesA high-severity vulnerability in Eclipse ThreadX allows privileged code to read or write beyond intended buffer boundaries due to a single-byte check error.https://vulnpost.com/news/vulnerabilities/advantech-adam-3600-patch-fixes-remote-code/https://vulnpost.com/news/vulnerabilities/advantech-adam-3600-patch-fixes-remote-code/Tue, 20 Oct 2026 09:57:59 +0000VulnerabilitiesA high-severity vulnerability in the ADAM-3600 allows authenticated attackers to run arbitrary code with service privileges. Version 2.8.5.0 resolves the issue.https://vulnpost.com/news/vulnerabilities/advantech-adam-3600-patch-fixes-path-traversal/https://vulnpost.com/news/vulnerabilities/advantech-adam-3600-patch-fixes-path-traversal/Tue, 20 Oct 2026 09:37:50 +0000VulnerabilitiesA high-severity path traversal bug in the ADAM-3600 allows authenticated attackers to read system files. Version 2.8.5.0 resolves the issue for affected users.https://vulnpost.com/news/vulnerabilities/advantech-adam-3600-patch-fixes-unauthenticated/https://vulnpost.com/news/vulnerabilities/advantech-adam-3600-patch-fixes-unauthenticated/Tue, 20 Oct 2026 08:39:42 +0000VulnerabilitiesA high-severity flaw in the ADAM-3600 logging system allows remote attackers to crash the service. Version 2.8.5.0 resolves the issue.https://vulnpost.com/news/vulnerabilities/riskified-united-utilities-toyota-logistics-hire/https://vulnpost.com/news/vulnerabilities/riskified-united-utilities-toyota-logistics-hire/Tue, 20 Oct 2026 04:39:14 +0000VulnerabilitiesThree organizations in Israel, the UK, and the US are hiring senior security experts to strengthen their teams amid high demand for specialized roles.https://vulnpost.com/news/vulnerabilities/eptura-archibus-critical-rce-unauthenticated/https://vulnpost.com/news/vulnerabilities/eptura-archibus-critical-rce-unauthenticated/Tue, 20 Oct 2026 03:23:43 +0000VulnerabilitiesRapid7 found three vulnerabilities in the facility management platform, including a critical remote code execution flaw that allows unauthenticated attackers to take control of servers.https://vulnpost.com/news/vulnerabilities/pillow-ghostscript-argument-injection-cve-2026/https://vulnpost.com/news/vulnerabilities/pillow-ghostscript-argument-injection-cve-2026/Tue, 20 Oct 2026 02:31:44 +0000VulnerabilitiesPython imaging library Pillow has released version 13.0.0 to fix a critical argument injection flaw that allows attackers to execute arbitrary commands via Ghostscript.https://vulnpost.com/news/vulnerabilities/ning-compress-lzf-pre-1-2-0-oob-access-enables/https://vulnpost.com/news/vulnerabilities/ning-compress-lzf-pre-1-2-0-oob-access-enables/Tue, 20 Oct 2026 02:21:42 +0000VulnerabilitiesVersions before 1.2.0 contain an out-of-bounds memory access that lets attackers leak JVM heap data or crash services.https://vulnpost.com/news/vulnerabilities/apache-camel-jgroups-deserialization-bug-cve-2026/https://vulnpost.com/news/vulnerabilities/apache-camel-jgroups-deserialization-bug-cve-2026/Tue, 20 Oct 2026 01:57:46 +0000VulnerabilitiesA high-severity deserialization flaw in Apache Camel’s JGroups component enables remote code execution. Patches are available for supported versions.https://vulnpost.com/news/vulnerabilities/db-gpt-0-8-2-critical-flaw-allows-unauthenticated/https://vulnpost.com/news/vulnerabilities/db-gpt-0-8-2-critical-flaw-allows-unauthenticated/Tue, 20 Oct 2026 01:31:37 +0000VulnerabilitiesA critical vulnerability in DB-GPT through version 0.8.2 lets attackers run code as root without authentication, exploiting a mock admin role function.https://vulnpost.com/news/vulnerabilities/aiohttp-keepalive-flaw-lets-attackers-hoard/https://vulnpost.com/news/vulnerabilities/aiohttp-keepalive-flaw-lets-attackers-hoard/Tue, 20 Oct 2026 01:15:54 +0000VulnerabilitiesVersions before 3.14.4 lack initial timeout checks, allowing idle connections to persist indefinitely and exhaust capacity.https://vulnpost.com/news/vulnerabilities/ibm-security-verify-access-cve-2026-109126-allows/https://vulnpost.com/news/vulnerabilities/ibm-security-verify-access-cve-2026-109126-allows/Tue, 20 Oct 2026 00:23:26 +0000VulnerabilitiesIBM confirms a high-severity flaw in specific appliance versions that permits local attackers to gain elevated rights via hardcoded credentials.https://vulnpost.com/news/vulnerabilities/h3c-magic-nx15-critical-rce-flaw-cve-2026-112371/https://vulnpost.com/news/vulnerabilities/h3c-magic-nx15-critical-rce-flaw-cve-2026-112371/Tue, 20 Oct 2026 00:03:43 +0000VulnerabilitiesA critical remote code injection flaw in H3C Magic NX15 version NX15V100R017 allows attackers to manipulate path arguments for arbitrary code execution.https://vulnpost.com/news/vulnerabilities/pillow-apng-memory-exhaustion-vulnerability-fixed/https://vulnpost.com/news/vulnerabilities/pillow-apng-memory-exhaustion-vulnerability-fixed/Mon, 19 Oct 2026 23:48:43 +0000VulnerabilitiesA high-severity flaw in the Python imaging library allows crafted animated PNGs to crash servers by exhausting system memory before safety checks run.https://vulnpost.com/news/vulnerabilities/plex-media-server-rce-chain-deploys-cryptominers/https://vulnpost.com/news/vulnerabilities/plex-media-server-rce-chain-deploys-cryptominers/Mon, 19 Oct 2026 23:39:38 +0000VulnerabilitiesAttackers are chaining four flaws in Plex Media Server to execute code remotely, deploying cryptominers and proxy software on unpatched systems.https://vulnpost.com/news/vulnerabilities/grav-api-plugin-vulnerability-lets-attackers/https://vulnpost.com/news/vulnerabilities/grav-api-plugin-vulnerability-lets-attackers/Mon, 19 Oct 2026 22:30:58 +0000VulnerabilitiesThe Grav API plugin for versions prior to 1.0.42 contains critical flaws that allow attackers to exhaust server storage or bypass page rules.https://vulnpost.com/news/vulnerabilities/mercury-rce-bug-in-pre-3-2-6-lets-attackers-run/https://vulnpost.com/news/vulnerabilities/mercury-rce-bug-in-pre-3-2-6-lets-attackers-run/Mon, 19 Oct 2026 22:30:40 +0000VulnerabilitiesA critical flaw in Mercury versions before 3.2.6 lets anonymous users run arbitrary Python code on servers configured without authentication tokens.https://vulnpost.com/news/vulnerabilities/citrix-netscaler-rce-access-log-poisoning-enables/https://vulnpost.com/news/vulnerabilities/citrix-netscaler-rce-access-log-poisoning-enables/Mon, 19 Oct 2026 21:36:57 +0000VulnerabilitiesAttackers execute commands on NetScaler ADC and Gateway without credentials. Citrix provides patches for versions 14.1 and 13.1.https://vulnpost.com/news/vulnerabilities/craft-cms-twig-filter-flaw-allows-remote-code/https://vulnpost.com/news/vulnerabilities/craft-cms-twig-filter-flaw-allows-remote-code/Mon, 19 Oct 2026 20:41:27 +0000VulnerabilitiesAuthenticated users can exploit a missing guard in Craft CMS to write webshells, affecting versions prior to 4.18.8 and 5.11.0.https://vulnpost.com/news/vulnerabilities/tapo-c320ws-wi-fi-camera-has-authenticated-stack/https://vulnpost.com/news/vulnerabilities/tapo-c320ws-wi-fi-camera-has-authenticated-stack/Mon, 19 Oct 2026 18:07:22 +0000VulnerabilitiesAn authenticated stack-based buffer overflow in the Tapo C320WS Wi-Fi camera allows local attackers to execute commands with root privileges on affected devices.