Skip to content
TrustList

TrustList daily digest · Tech and security

Tuesday, 13 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security8

  1. 1Security advisories

    Bricksforge WordPress plugin flaw lets anyone upload files, now exploited

    CVE-2026-85097 scores CVSS 10 in Patchstack's database and affects every release up to 3.1.8.9. It follows a password-reset flaw fixed in September and a privilege-escalation bug disclosed earlier.

  2. 2Security advisories

    SAP patches a CVSS 10 token flaw in its Cloud SDK for Python

    Four of the 16 new notes are critical, including code injection in S/4HANA and broken access control in NetWeaver Visual Composer; SAP reports no exploitation so far.

  3. 3Security advisories

    Ivanti Connect Secure zero-day lets attackers run commands unauthenticated

    CISA added CVE-2026-104935 to its exploited list the same day and gave US federal agencies until 16 October; the CVE record lists 25.1.3.0, 25.1.3.1 and 22.8R2.5 as unaffected.

  4. 4Security advisories

    AssetView flaw lets a logged-in Windows user gain SYSTEM rights

    JPCERT/CC rates CVE-2026-101020 at 8.5 under CVSS 4.0; Hammock says there is no workaround and that versions before 13.2.0 cannot be upgraded directly.

  5. 5Security advisories

    Docker Hub fixes critical flaw that passed access tokens to new owners

    Account-to-organisation conversion kept the old token secrets alive. Docker closed the hole in under four hours after a report and found no abuse across about 304,000 pushes.

  6. 6Security advisories

    MariaDB names five server flaws fixed in its August and September builds

    The worst, CVE-2026-107815 (CVSS 8.5), lets a user of the CONNECT engine crash the server or run code; the fixed releases have been out since 13 August, but the CVE numbers only arrived on 9 October.

  7. 7Security advisories

    ShareFile Storage Zones Controller 5.12.7 fixes a chain to code execution

    Three high severity flaws affect customer-managed zones on version 5; version 6 is not affected, and Italy's national cyber agency rates the systemic impact as medium.

  8. 8Security advisories

    CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

    Six of the flaws give a back-office user a way to run code on the server. CERT/CC says it could not reach the maintainers, who released security fixes for the 3.x lines on 6 October.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy