TrustList insights

Security advisories

122 articles, newest first. Last updated 16 Oct 2026.

122 articles

Chrome 155 update fixes ten security bugs, one rated critical

Version 155.0.8059.84/.85 patches a critical use-after-free in Prerender and six high-severity bugs, four of them in the V8 engine. Hong Kong's CERT warns of remote code execution.

16 Oct 2026

Also new

Vulnerability Management

Linux kernel flaw lets a guest VM read and crash its host

16 Oct 2026

Vulnerability Management

Cisco Meraki hardening release covers seven flaw classes, top score 9.6

16 Oct 2026

Vulnerability Management

BeyondTrust Remote Support flaw exploited as a zero-day since August

16 Oct 2026

More security advisories

Patch Management

Windows 11 October update can stop Smart App Control turning back on

KB5127648 for versions 24H2, 25H2 and 26H2 can grey out the switch once the feature is off. Microsoft gives a registry fix and two Group Policy packages until a permanent fix ships.

16 Oct 2026

Vulnerability Management

Nextcloud's built-in Collabora server flaw was exploited before disclosure

CVE-2026-110447 lets an attacker run commands on a Nextcloud server with no login while the built-in CODE server is down. A fix shipped on 11 September; the CVE followed on 14 October.

16 Oct 2026

Vulnerability Management

Drupal fixes critical Field UI flaw with a no-login path via add-ons

SA-CORE-2026-014 scores 19 out of 25. Sites on 11.2 or 10.5 and older have no patch; uninstalling the Field UI module blocks the flaw until an upgrade is possible.

15 Oct 2026

Vulnerability Management

AWS patches Gremlin import flaw in Amazon Neptune graph database

Bulletin 2026-136-AWS covers every engine from 1.2.0.0. Clusters with automatic minor upgrades get the fix in their next maintenance window; the rest must move to 1.4.7.1, 1.4.8.1 or 1.5.0.0.

15 Oct 2026

Vulnerability Management

nginx 1.31.7 and 1.30.6 fix five flaws, one present since 2005

The alias and rewrite overflow affects every release since 0.1.29. The fix release also moves HTTP/2 to RFC 9218 prioritisation and adds MaxMind DB support to the GeoIP modules.

15 Oct 2026

Vulnerability Management

Next.js 16.4.1 fixes two critical flaws that need no login to exploit

One flaw sits in image optimisation of SVG files and reaches back to Next.js 10; the other hits the use cache directive in 16.x and has no workaround. A third advisory fixes a Server Actions denial of service.

15 Oct 2026

Vulnerability Management

Slican fixes three flaws in IPx phone exchanges; old models stay exposed

CERT Polska says a hardcoded key lets anyone with the firmware files decrypt traffic. The fix needs IPx 6.62.0100; CCT-1668, MAC-6400 and CXS-0424, discontinued in 2011 and 2012, will not get one.

15 Oct 2026

Vulnerability Management

Exploit attempts hit Langflow flaw that runs any command via MCP

Any signed-in Langflow user could run shell commands on the server by adding an MCP server. The flaw was patched in September; a related one was fixed only in 1.10.3, and the current release is 1.12.6.

15 Oct 2026

Vulnerability Management

Ahsay says its first AhsayCBS patches were incomplete and ships new hotfixes

The backup server maker now tells partners on versions 7 to 10 to apply hotfix 10.3.4.45 or 9.15.2.70 and to rebuild any server that shows signs of compromise from a clean install.

15 Oct 2026

Vulnerability Management

Cisco patches exploited root-access flaw in Secure Email Gateway

CVE-2026-76519 scores 9.8, was found in Cisco's own scanning, and can be fixed without a restart by updating the Content Scanner Tools package.

15 Oct 2026

Vulnerability Management

Palo Alto Networks fixes exploited root-level flaw in PAN-OS

The company found CVE-2026-0322 itself, saw very limited attacks from three IP addresses, and lists no workaround. One fix, for 11.2.16, was still due on 15 October.

15 Oct 2026

API

CERT-In warns fintechs that attackers are draining payout APIs

Rated critical, the advisory to NBFCs, digital lenders, payment firms and wallets says attackers call disbursal APIs with stolen bank credentials from the victims' own whitelisted servers.

14 Oct 2026

Vulnerability Management

curl 8.23.0 fixes 24 flaws, one rated high, and drops SMB support

The high-rated flaw, CVE-2026-92392, is a use-after-free in HTTP/2 uploads affecting curl 8.12.0 to 8.22.0; the other 23 are rated low, and several leak credentials across origins.

14 Oct 2026

Vulnerability Management

Commvault patches critical command execution flaw in its CVFS storage

One of ten Commvault advisories issued on 13 October, CVE-2026-77099 scores 9.3 and needs no login; on 11.36 and 11.40 the Commvault upgrade must come before the CVFS update.

14 Oct 2026

Vulnerability Management

Adobe fixes CVSS 10 flaws in ColdFusion and Experience Manager

Neither bulletin reports exploitation, but ColdFusion servers have been attacked soon after past patch days; AEM 6.5 customers must apply named hotfixes on top of their service pack.

14 Oct 2026

Vulnerability Management

Fortinet patches SQL injection in FortiAnalyzer, FortiManager, FortiMail

Four CVEs let a low-privileged user run commands on FortiAnalyzer and FortiManager; the 7.2 line gets no fix and must move to a newer release, and version 8.0 is not affected.

14 Oct 2026

Vulnerability Management

Attackers exploit SiteGuard WAF flaw that runs commands as root

EG Secure Solutions told support customers on 29 September; JPCERT/CC says the host-based WAF is widely used in Japan and warns that upgrading can erase the traces of an attack.

14 Oct 2026

Vulnerability Management

Microsoft fixes 1,413 flaws, one Windows Shell bug already exploited

CISA gave US federal agencies until 16 October to patch CVE-2026-96951, a Mark of the Web bypass; 72 of the month's fixes are rated critical, most of them in Windows and Office.

14 Oct 2026

Vulnerability Management

SAP patches a CVSS 10 token flaw in its Cloud SDK for Python

Four of the 16 new notes are critical, including code injection in S/4HANA and broken access control in NetWeaver Visual Composer; SAP reports no exploitation so far.

13 Oct 2026

Vulnerability Management

Ivanti Connect Secure zero-day lets attackers run commands unauthenticated

CISA added CVE-2026-104935 to its exploited list the same day and gave US federal agencies until 16 October; the CVE record lists 25.1.3.0, 25.1.3.1 and 22.8R2.5 as unaffected.

13 Oct 2026

Vulnerability Management

MariaDB names five server flaws fixed in its August and September builds

The worst, CVE-2026-107815 (CVSS 8.5), lets a user of the CONNECT engine crash the server or run code; the fixed releases have been out since 13 August, but the CVE numbers only arrived on 9 October.

13 Oct 2026

Application Security

CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

Six of the flaws give a back-office user a way to run code on the server. CERT/CC says it could not reach the maintainers, who released security fixes for the 3.x lines on 6 October.

13 Oct 2026

Vulnerability Management

AssetView flaw lets a logged-in Windows user gain SYSTEM rights

JPCERT/CC rates CVE-2026-101020 at 8.5 under CVSS 4.0; Hammock says there is no workaround and that versions before 13.2.0 cannot be upgraded directly.

13 Oct 2026

Vulnerability Management

ShareFile Storage Zones Controller 5.12.7 fixes a chain to code execution

Three high severity flaws affect customer-managed zones on version 5; version 6 is not affected, and Italy's national cyber agency rates the systemic impact as medium.

13 Oct 2026

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

Keep exploring

More on TrustList

Everything here links back to the same verified catalogue. Pick your next stop.