cve

BREAKING: Malicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)

How to fix CVE-2026-92392: upgrade curl to 8.23.0. A malicious HTTP/2 server can trigger a use-after-free during uploads in curl 8.12.0 to 8.22.0.

BREAKING: Windows zero-day lets booby-trapped files skip the download warning (CVE-2026-96951)

How to fix CVE-2026-96951: install the October 2026 Windows update. Exploited Windows Shell bug lets crafted files skip Mark of the Web warnings.

BREAKING: New no-login code execution bug in Magento and Adobe Commerce (CVE-2026-103849)

How to fix CVE-2026-103849: upgrade Adobe Commerce or Magento Open Source to the October 2026 build (APSB26-153). No-login code execution, CVSS 10.

BREAKING: GitLab critical patch fixes no-login code execution on self-managed servers (CVE-2026-97229)

How to fix CVE-2026-97229: upgrade GitLab to 19.4.2, 19.3.5 or 19.2.8. No-login code execution via CI/CD regex on self-managed GitLab, plus 23 other fixes.

Opening a LibreOffice spreadsheet can run remote Java code (CVE-2026-63277)

How to fix CVE-2026-63277: upgrade LibreOffice to 26.2.5 or 26.8.0. A Calc file could load a remote Java driver on open. Five sibling bugs fixed too.

NetScaler's SAML zero-day: What CVE-2026-88779 means for anyone running SAML

Citrix has patched an actively exploited memory overflow in the SAML handling of NetScaler ADC and Gateway. It is the fourth NetScaler SAML vulnerability this year, and the pattern says a lot about where authentication code breaks.

BREAKING: NetScaler SAML memory overflow hits CISA KEV

How to fix CVE-2026-88779: upgrade NetScaler ADC/Gateway to 14.1-73.41 or 13.1-64.28. Same-day CISA KEV on NetScaler SAML memory-overflow DoS.

Security in the LLM Age

Zammad session fixation to root hits CISA KEV

How to fix CVE-2026-102489: upgrade Zammad to 7.2.0. Same-day CISA KEV on Zammad session fixation RCE chained with local privilege escalation CVE-2026-102490. Due 2026-10-05.

FortiMail unauthenticated path traversal hits CISA KEV

How to fix CVE-2026-104286: disable FortiMail IBE (config system encryption ibe / set status disable) or upgrade to upcoming 8.0.2 / 7.6.7 / 7.4.9. Same-day CISA KEV on unauthenticated FortiMail path traversal.

TanStack Start XSS (CVE-2026-102989): what to do on Appwrite

A critical XSS in TanStack Start server functions lets a crafted link run scripts on your domain. Here's how to upgrade, and what Appwrite Sites blocks for you.

BREAKING: Next.js image optimizer SSRF and cache poisons in September 2026 release

How to fix CVE-2026-94483: upgrade next to 15.5.27 or 16.3.8

Cisco SD-WAN Manager admin API bypass hits CISA KEV

How to fix CVE-2026-76504: upgrade Cisco Catalyst SD-WAN Manager to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1. Same-day CISA KEV on Cisco SD-WAN Manager admin API bypass; federal due 2026-10-03.

BREAKING: Cisco SD-WAN Manager admin API open without a login (CVE-2026-76504)

How to fix CVE-2026-76504: upgrade Cisco Catalyst SD-WAN Manager to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1. Same-day Cisco PSIRT advisory with active exploitation; unauth admin API via URI-encoding bypass.

Apple CoreGraphics file OOB write hits CISA KEV

How to fix CVE-2026-86950: update to iOS/iPadOS 26.7.1, macOS Sequoia 15.8.1, or macOS Tahoe 26.7.1. Same-day CISA KEV on Apple CoreGraphics OOB write with Apple exploitation acknowledgment.

Unsloth RCE: malicious Hugging Face model config.json injects code

How to fix CVE-2026-93348: upgrade unsloth-zoo to 2026.8.14+ and unsloth to 2026.8.20+. Malicious Hugging Face model config.json model_type injects code into Unsloth exec path.

BREAKING: Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)

How to fix CVE-2026-88771: upgrade NetScaler ADC/Gateway to 14.1-73.37 or 13.1-64.23

WordPress page template include hits CISA KEV

How to fix CVE-2026-87902: upgrade WordPress to 7.1.2 (or your branch patch). Same-day CISA KEV on WordPress Core page-template LFI with conditional RCE.