Vulnerability

398 Articles

PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early

CVE-2026-109618 and CVE-2026-109619: PHP will patch leaked critical flaws on October 21 at 14:00 UTC. Both are rated CVSS v4.0 9.2.

Security —— Oct 20, 2026 3 min read

Laravel has disclosed a critical authentication bypass in its built-in token API guard that lets unauthenticated…

Security —— Oct 16, 2026 3 min read

CVE-2026-0322 lets authenticated attackers run code as root on PAN-OS firewalls. Palo Alto confirms exploitation; see…

Security —— Oct 16, 2026 7 min read

BeyondTrust patches CVE-2026-102764, a Remote Support zero-day China-linked ARMORY CASTLE used to deploy SAWFLY and BARECLAW…

Security —— Oct 16, 2026 4 min read

Next.js 16.4.1 and 15.5.28 fix two critical RCE flaws, including CVE-2026-96889 in SVG image optimization, plus…

Security —— Oct 16, 2026 3 min read

CVE-2026-106931 in SiteGuard WAF Server Edition is exploited, letting attackers run OS commands as root. Fixed…

Security —— Oct 15, 2026 4 min read

CVE-2026-99999 (PwnEscape) is a critical Linux kernel flaw that lets a VM guest leak host memory…

Security —— Oct 14, 2026 4 min read

curl 8.23.0 fixes CVE-2026-92392, a high-severity HTTP/2 upload use-after-free that a malicious server can turn into…

GitLab —— Oct 12, 2026 3 min read

GitLab patches CVE-2026-97229, a CVSS 10.0 flaw letting unauthenticated attackers run code via a crafted CI/CD…

Security —— Oct 6, 2026 4 min read

CVE-2026-21589 lets unauthenticated attackers read files from eight Atlassian Data Center products. Fixed versions and mitigations.