CVE ID :CVE-2026-72753 Published : Oct. 26, 2026, 6:18 p.m. | 1 hour, 52 minutes ago Description :When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If…
CVE ID :CVE-2026-116634 Published : Oct. 26, 2026, 6:17 p.m. | 1 hour, 53 minutes ago Description :OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers…
CVE ID :CVE-2026-115915 Published : Oct. 26, 2026, 6:17 p.m. | 1 hour, 53 minutes ago Description :vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting…
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece…
CVE ID :CVE-2026-105608 Published : Oct. 26, 2026, 5:52 p.m. | 18 minutes ago Description :HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to…
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says…
CVE ID :CVE-2026-71456 Published : Oct. 26, 2026, 5:17 p.m. | 53 minutes ago Description :Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20. Severity: 8.5 |…
CVE ID :CVE-2026-115905 Published : Oct. 26, 2026, 5:17 p.m. | 53 minutes ago Description :zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative…
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set…
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. “In one case, the attackers targeted a government entity in Europe and within two…