42 casos · pág. 2/3
Microsoft awarded researcher Sam Chen (Samchen) US$4,000 for reporting CVE-2026-81376, a critical (CVSS 3.1 score 9.6) Workspace Trust security feature bypass in Visual Studio Code versions before 1.136.2. A specially prepared workspace could connect to an attacker-controlled service and bypass Restricted Mode, potentially exposing local …
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each fl…
CERT-FR advisory CERTFR-2026-AVI-1335, published 16 October 2026, reports multiple vulnerabilities in the Linux kernel shipped with SUSE products. Some of them allow an attacker to escalate privileges, cause a remote denial of service and breach data confidentiality. Other listed impacts are data integrity breach and security policy bypas…
CERT-FR advisory CERTFR-2026-AVI-1325, published 15 October 2026, reports a vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows a remote attacker to execute arbitrary code and compromise data integrity. Cisco states that CVE-2026-76519 is actively exploited. The advisory is based on Cisco security advisory c…
CERT-FR advisory CERTFR-2026-AVI-1320, published 15 October 2026, reports multiple vulnerabilities in SonicWall Network Security Manager (NSM) On-Prem that allow a remote attacker to execute arbitrary code and bypass the security policy. The advisory references CVE-2026-100232 and CVE-2026-96540, based on SonicWall bulletin SNWLID-2026-00…
CERT-FR advisory CERTFR-2026-AVI-1321, published 15 October 2026, reports multiple vulnerabilities in Drupal core that allow a remote attacker to execute arbitrary code and perform indirect code injection (XSS). The advisory references CVE-2026-108097, CVE-2026-108514 and CVE-2026-108515, based on three Drupal security bulletins dated 14 …
CERT-FR advisory CERTFR-2026-AVI-1318, published 15 October 2026, reports multiple vulnerabilities in Moodle that allow a remote attacker to perform cross-site scripting (XSS) and bypass the security policy. The advisory references CVE-2026-47759, CVE-2026-47761 and CVE-2026-47762, based on two Moodle security bulletins dated 15 October 2…
Cisco disclosed CVE-2026-76488, a medium-severity vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC). An authenticated remote attacker with valid administrative credentials could read sensitive files from the underlying file system of an affected device. The files include key ma…
Researcher Quentin Kaiser (QTNKSR) disclosed a memory corruption flaw in Broadcom's Wi-Fi Protected Setup (WPS) implementation. It allows an unauthenticated attacker within wireless range to disclose memory and execute code, including as root, on vulnerable routers. The attacker does not need the Wi-Fi password, network membership or a co…
Drupal published an advisory on October 14, 2026 for CVE-2026-108097, a critical remote code execution vulnerability in the Field UI module (fieldui) of Drupal core. The advisory gives it a risk score of 19/25, with basic attack complexity, no authentication required, and full confidentiality and integrity impact. Drupal core alone is not…
CERT-FR advisory CERTFR-2026-AVI-1334, published 16 October 2026, reports multiple vulnerabilities in the Linux kernel shipped with Red Hat Enterprise Linux. Some of them allow a remote attacker to execute arbitrary code, escalate privileges and cause a remote denial of service. Other listed impacts are data integrity and confidentiality …
CERT-FR advisory CERTFR-2026-AVI-1332, published 16 October 2026, reports multiple vulnerabilities in Microsoft products that may allow remote arbitrary code execution, privilege escalation, remote denial of service and breach of data confidentiality. The advisory is based on Microsoft security bulletins dated 15 October 2026 for four CVE…
CERT-FR advisory CERTFR-2026-AVI-1310 reports multiple vulnerabilities in Citrix products, based on Citrix security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data integrity and con…
CERT-FR advisory CERTFR-2026-AVI-1316 reports multiple vulnerabilities across Microsoft products, based on Microsoft security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data …
CERT-FR advisory CERTFR-2026-AVI-1315 reports multiple vulnerabilities in Microsoft Azure components, published on 14 October 2026. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft published the corresponding security bulletins on 13 October 2026. …
A critical Linux kernel networking flaw, CVE-2026-99999 (nicknamed PwnEscape, CVSS 9.3), lets code inside a guest VM read host memory, crash the host and, in lab conditions, run code on it. Researcher Paulos Yibelo of pwn.ai demonstrated the memory leak against Vercel's production sandboxes, which Vercel confirmed. The flaw was found in a…
CERT-FR advisory CERTFR-2026-AVI-1322, published 15 October 2026, reports multiple vulnerabilities in Juniper Networks products, based on the vendor's October 2026 security bulletins of 14 October (JSA112168 to JSA112250). The flaws affect Junos OS, Junos OS Evolved (including MX and SRX Series) and Juniper Cloud-Native Router. According …
CERT-FR advisory CERTFR-2026-AVI-1313 reports multiple vulnerabilities in Microsoft .NET, ASP.NET Core and .NET Framework, covered by Microsoft's October 13, 2026 security bulletins for 43 CVEs. Some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. The advisory also l…
CERT-FR advisory CERTFR-2026-AVI-1314 reports multiple vulnerabilities in Microsoft Windows and related components, covered by Microsoft's October 13, 2026 security bulletins (ADV260001 and dozens of CVEs). Some of them allow remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass and compro…
F5 released NGINX 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026 to fix five vulnerabilities. Three are memory-corruption bugs that F5 scores 9.2 (Critical) on CVSS v4.0, and they can crash a worker process or, in some conditions, allow code execution. The others are a TLS session-ticket flaw that can bypass client-certificate …
