CVE ID :CVE-2026-102764 Published : Oct. 15, 2026, 8:30 p.m. | 21 minutes ago Description :The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the…
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel’s live cloud sandboxes, and Vercel confirmed it. The…
CVE ID :CVE-2026-106700 Published : Oct. 15, 2026, 8:17 p.m. | 34 minutes ago Description :ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied…
CVE ID :CVE-2026-106708 Published : Oct. 15, 2026, 8:17 p.m. | 34 minutes ago Description :XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection…
CVE ID :CVE-2026-57496 Published : Oct. 15, 2026, 7:17 p.m. | 1 hour, 34 minutes ago Description :NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the…
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week’s security stories. The rest gets interesting in different ways. A…
CVE ID :CVE-2026-84731 Published : Oct. 15, 2026, 6:17 p.m. | 33 minutes ago Description :An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP…
CVE ID :CVE-2026-55103 Published : Oct. 15, 2026, 6:17 p.m. | 33 minutes ago Description :Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request…
CVE ID :CVE-2026-55240 Published : Oct. 15, 2026, 6:15 p.m. | 35 minutes ago Description :Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src passes survey feedTemplate and monitor notification templates to…
CVE ID :CVE-2026-55239 Published : Oct. 15, 2026, 6:14 p.m. | 36 minutes ago Description :Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src constructs raw SQL through Prisma.sql() by…