TrustList insights

Security advisories

263 articles, newest first. Last updated 5 Nov 2026.

263 articles

FreeSWITCH flaw lets one SIP MESSAGE run server commands

CVE-2026-116779, rated 9.8, lets a SIP MESSAGE pick FreeSWITCH's api chat route and run any API command. The project says it has been exploited. Version 1.11.3 closes the route by default; enable-chat=false is the…

5 Nov 2026

Also new

Vulnerability Management

Cisco reissues fix for exploited Secure Email Gateway flaw CVE-2026-76461

5 Nov 2026

Vulnerability Management

SolarWinds fixes critical Dameware flaw; Tanium patches Threat Response

5 Nov 2026

Vulnerability Management

Attackers drop webshells through YOOtheme Pro flaw CVE-2026-102785

5 Nov 2026

More security advisories

Application Security

zlib 1.4 fixes a dozen memory bugs and changes its build

The compression library's first release since 1.3.2 fixes CVE-2026-85091 in non-blocking gzwrite(), an 8 MB overwrite in inflateGetDictionary() and minizip path flaws. It also renames MSVC libraries and moves the CMake…

5 Nov 2026

Network Security

OpenSSH 10.6p2 closes a password bypass on musl Linux without PAM

Linux systems built on musl libc with PAM disabled, Alpine among them, can have sshd password authentication bypassed. The maintainers say set PasswordAuthentication=no or turn SSH off at once, then upgrade to 10.6p2.

5 Nov 2026

Vulnerability Management

GitHub Enterprise Server patches SSH and Dependabot flaws in four lines

Releases 3.19.14, 3.20.10, 3.21.8 and 3.22.3 fix a use-after-free that lets an SSH user run commands as the Git service, and an incomplete earlier fix that let Dependabot write Actions workflows.

5 Nov 2026

Vulnerability Management

AWS fixes EKS network policy bypass and a Firecracker memory flaw

Bulletin 2026-170 covers a shared eBPF state bug that lets a neighbouring pod slip past NetworkPolicy ingress rules on EKS. Bulletin 2026-169 fixes guest access to Firecracker memory in one snapshot setup; Lambda is…

5 Nov 2026

Vulnerability Management

APT flaw lets a hostile mirror swap a Debian or Ubuntu package for root

CVE-2026-109518 abuses APT's handling of hard links when it follows redirects and retries downloads, which is on by default from Debian 12 and Ubuntu 22.04. Fixed packages shipped on 4 November.

5 Nov 2026

Vulnerability Management

Cisco fixes UCS Central flaw that lets a logged-in user run commands

CVE-2026-76506 (CVSS 7.6) lets any user with valid credentials run commands, write files and read data through the web interface. Release 2.1(2c) fixes it; 2.0 and earlier must migrate, and there is no workaround.

5 Nov 2026

Vulnerability Management

XSA-523: two grant copy flaws let a Xen guest read and write Dom0 memory

Every Xen from 4.6 is affected and the advisory knows of no mitigation, only patches, which it lists for releases back to 4.17. Two more advisories, XSA-529 and XSA-530, are embargoed until 10 November.

5 Nov 2026

Vulnerability Management

Elastic 8.19.24, 9.4.9 and 9.5.6 fix 21 flaws, 12 rated high

Ten of the high-rated advisories trace to two bundled dependencies: a Brotli decoder bug in Node.js and the compromised eMudhra roots in Java, Node.js and Docker image trust stores. Elastic did not reproduce code…

5 Nov 2026

Patch Management

Rails 8.0.5.2 and 8.1.4.1 fix 21 flaws as 8.0 support nears its end

One critical Active Storage flaw allows arbitrary file reads and writes during image analysis, and four more are rated high. Security support for Rails 8.0 ends on 7 November, so 8.0 apps should plan the move to 8.1.

4 Nov 2026

Patch Management

WordPress update race flaw CVE-2026-119977 is now being exploited

Italy's ACN and the Dutch NCSC report attacks on the core update race condition fixed in WordPress 7.1.4, in which an unauthenticated attacker runs code from the staging folder during an update. Backports go to 4.7.39.

4 Nov 2026

Patch Management

Barracuda fixes a root-level flaw pair in Email Security Gateway

A pre-authentication bypass (CVE-2026-116606, CVSS 9.3) in Email Security Gateway and a command injection (CVE-2026-111560, CVSS 8.6) in six products combine to give root through the admin interface. Patches apply…

4 Nov 2026

Patch Management

Chrome 157 ships 213 security fixes, seven of them critical

Version 157.0.8103.38/39 reached the stable channel with critical fixes in Dawn, ANGLE, WebGL, Prerender, Geometry and Core. Firefox 159.0.1 fixed a high-impact layout flaw the same day.

4 Nov 2026

Linux

cPGuard update channel hijacked to push a backdoor to 2,950 servers

An attacker used OPSSHIELD's billing server to upload a fake cPGuard update that ran as root for about 70 minutes, collecting password hashes, SSH keys and MySQL root passwords. Update to 5.88.26 and rotate every secret.

4 Nov 2026

Banking

KIR fixes Szafir e-signature flaws; Szafir Weryfikująca is left unpatched

An XXE flaw lets a crafted XML read local files when it is signed or verified, update filenames allow path traversal, and no certificates were validated. Szafir 2.0 build 708 fixes them; the end-of-life verifier will…

4 Nov 2026

Payroll Management

CERT Polska: three flaws in ZUS's Płatnik contributions software

Płatnik fetched updates over plain HTTP, stored passwords in an easily decoded form and checked logins only on the client, letting an attacker sign in as any user. Version 10.02.002, metric 334, fixes all three.

4 Nov 2026

Patch Management

psqlODBC 18.00.0006 fixes two more memory corruption flaws

A malicious or impersonated server can overflow the client's buffer through a large-object read (CVE-2026-120057), and untrusted SQL text with ODBC escapes can overflow the stack (CVE-2026-120061). Both rate 7.5.

3 Nov 2026

Patch Management

Zyxel patches GS1900 switches and dozens of access points

CVE-2026-107441 lets an unauthenticated attacker on the LAN run OS commands on ten GS1900 switch models; CVE-2026-76955 lets a LAN attacker gain privileges on about 40 APs, FWA7 units and the USG LITE 60AX.

3 Nov 2026

IoT

Attackers exploit Node-RED flaw in Siemens SIMATIC IoT2050 gateways

CVE-2026-58115, rated CVSS 10.0 and fixed in Industrial OS V4.3.4.1 in August, was used on 30 October to plant a Linux bot through the unauthenticated Node-RED HTTP interface.

3 Nov 2026

Android

Android November bulletin fixes a zero-click Framework flaw

The most severe flaw lets an attacker run code with no user interaction, and a critical bug in WAP Push SMS handling, with a public proof of concept, can disrupt calls. Patch level 2026-11-05 covers everything.

3 Nov 2026

Vulnerability Management

AWS discloses four flaws in pandas SDK, MCP server and dev tools

Bulletins 2026-161 to 164 cover AWS SDK for pandas, the Serverless MCP Server, Virtual Engineering Workbench and the aidlc-traceability CLI. Two fixes shipped months ago; two need an update or redeploy now.

3 Nov 2026

Threat Intelligence

Dutch NCSC warns of attacks on internet-connected refrigeration

Attackers are changing temperatures and defrost cycles on cooling installations from several suppliers across Europe, the Netherlands included. The NCSC tells owners to ask their supplier now and take the systems off…

3 Nov 2026

Vulnerability Management

SQLite fixes three heap overflows in 3.54.0, CLI recover flaw open

Italy's ACN warned on 2 November about four flaws rated 8.5 under CVSS 4.0. Three in FTS5 and the session extension were fixed in 3.54.0; the .recover command injection is listed through 3.54.1 with no fixed release.

3 Nov 2026

Vulnerability Management

Langflow 1.13.0 fixes two unauthenticated 9.8 flaws in every 1.x release

IBM's records cover Langflow OSS 1.0.0 to 1.12.8: an authentication bypass and code execution, both 9.8 with no login needed. Version 1.12.8, released hours before the fix, is still affected.

2 Nov 2026

Vulnerability Management

Traefik 3.7.17 stops NTLM headers exhausting proxy memory

A client with no credentials can tie up memory, file descriptors and backend connections on Traefik 3.7.14 to 3.7.16 and 2.11.58 to 2.11.60, whether or not NTLM is used. It is the latest of more than a dozen fixes…

2 Nov 2026

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

Keep exploring

More on TrustList

Everything here links back to the same verified catalogue. Pick your next stop.