Skip to content
TrustList

TrustList daily digest · Tech and security

Wednesday, 14 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security7

  1. 1Security advisories

    Commvault patches critical command execution flaw in its CVFS storage

    One of ten Commvault advisories issued on 13 October, CVE-2026-77099 scores 9.3 and needs no login; on 11.36 and 11.40 the Commvault upgrade must come before the CVFS update.

  2. 2Security advisories

    Microsoft fixes 1,413 flaws, one Windows Shell bug already exploited

    CISA gave US federal agencies until 16 October to patch CVE-2026-96951, a Mark of the Web bypass; 72 of the month's fixes are rated critical, most of them in Windows and Office.

  3. 3Security advisories

    Fortinet patches SQL injection in FortiAnalyzer, FortiManager, FortiMail

    Four CVEs let a low-privileged user run commands on FortiAnalyzer and FortiManager; the 7.2 line gets no fix and must move to a newer release, and version 8.0 is not affected.

  4. 4Security advisories

    Adobe fixes CVSS 10 flaws in ColdFusion and Experience Manager

    Neither bulletin reports exploitation, but ColdFusion servers have been attacked soon after past patch days; AEM 6.5 customers must apply named hotfixes on top of their service pack.

  5. 5Security advisories

    CERT-In warns fintechs that attackers are draining payout APIs

    Rated critical, the advisory to NBFCs, digital lenders, payment firms and wallets says attackers call disbursal APIs with stolen bank credentials from the victims' own whitelisted servers.

  6. 6Security advisories

    curl 8.23.0 fixes 24 flaws, one rated high, and drops SMB support

    The high-rated flaw, CVE-2026-92392, is a use-after-free in HTTP/2 uploads affecting curl 8.12.0 to 8.22.0; the other 23 are rated low, and several leak credentials across origins.

  7. 7Security advisories

    Attackers exploit SiteGuard WAF flaw that runs commands as root

    EG Secure Solutions told support customers on 29 September; JPCERT/CC says the host-based WAF is widely used in Japan and warns that upgrading can erase the traces of an attack.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy