Vulnerabilities
Isolate Genesis World Instances to Block Directory Traversal Flaws
Zero Day Initiative reports three unpatched flaws in Genesis World that enable information disclosure and remote code execution via manipulated file paths.
BlueTeam Herald Advisory Desk
Vulnerabilities
Inspect QEMU vhost setups: Stale IOTLB cache enables VM escape and kernel R/W via CVE-2026-74580
A stale IOTLB cache in Linux vhost allows local privilege escalation and guest escape, requiring immediate review of virtualized environments using QEMU.
Vulnerabilities
Patch AEM Now: Critical Code Execution Flaw Affects Cloud and On-Prem Instances
Adobe Experience Manager users must address CVE-2026-106626, a critical input validation flaw allowing privileged attackers to run arbitrary code without interaction.
Vulnerabilities
Patch Blazor Debugger Now to Block Remote Code Execution on Dev Machines
CVE-2026-102870 allows attackers to run code on developer workstations via the ASP.NET Core debugger; update NuGet packages immediately.
Vulnerabilities
Update Ivanti Connect Secure to 25.1.3+ to Stop Unauthenticated Remote Command Execution via CVE-2026-104935
Ivanti confirms zero-day exploitation of CVE-2026-104935, allowing remote command execution without credentials on affected VPN appliances.
Vulnerabilities
Patch SaltStack Docs Repo to Block Malicious PR Code and Prevent Secret Theft
A critical flaw in the SaltStack documentation repository allowed attackers to steal secrets by injecting malicious code into forked pull requests before a recent patch.
Vulnerabilities
Patch IBM Db2 Mirror for i 7.4-7.6 Now to Address Critical Code Execution Risk (CVE-2026-96012)
IBM Db2 Mirror for i versions 7.4 through 7.6 contain a critical flaw allowing authenticated attackers to escalate privileges and execute code.
Vulnerabilities
Patch MarkLogic Server Now to Block Privilege Escalation in CVE-2026-85955
A critical flaw in MarkLogic Server allows remote attackers to execute code with elevated permissions by bypassing required privilege checks.
Vulnerabilities
Patch GitLab CE and EE to Block Unauthenticated Remote Code Execution
A critical flaw in GitLab CI/CD allows unauthenticated attackers to run arbitrary code. Self-managed users must upgrade immediately to mitigate this severe risk.
Vulnerabilities
Apply Vendor Patch for Sergey AIWU v1.5.9 to Fix CVSS 9.8 Sub Priv Escalation
A CVSS 9.8 flaw allows subscribers to gain unauthorized privileges in Sergey AIWU versions 1.5.9 and below, requiring immediate vendor patches.
Vulnerabilities
Secure WooCommerce Sites Against Critical Unauthenticated Code Execution in Booster Plugin
A critical vulnerability in Booster for WooCommerce allows attackers to execute code without authentication, affecting versions up to 8.4.0.
Vulnerabilities
PC makers brace for new downturn as global shipments plunge 20.1% to lowest level since early 2023
Global PC shipments dropped 20.1 percent, marking the steepest decline since the first quarter of 2023, signaling a potential new downward cycle.
Vulnerabilities
Patch ThemeREX Dwell Now to Fix Critical Deserialization Bug in Versions Through 1.16.0
A critical deserialization vulnerability in ThemeREX Dwell through version 1.16.0 allows object injection, carrying a CVSS score of 9.8.
Vulnerabilities
Patch Nginx UI 2.5.0: Backup Restore Flaw Lets Admins Run Arbitrary Code via Config Overwrite
An authenticated admin can execute arbitrary code on Nginx UI servers via a backup restore flaw fixed in version 2.5.0.
Vulnerabilities
Patch TinaCMS to Stop Attackers Hijacking Editor Sessions via Unpatched Preview Links
Unpatched TinaCMS versions allow attackers to hijack editor sessions via preview links, risking full content control without authentication.
Vulnerabilities
Act now: Apply BIND mitigations by Oct 11 to comply with CISA's KEV listing mandate
CISA mandates federal agencies patch or mitigate a high-severity BIND vulnerability by October 11 to prevent remote server crashes.