F5 patched three NGINX memory-corruption flaws, CVE-2026-97205, CVE-2026-93479 and CVE-2026-15176, rated CVSS 8.1 that could allow remote code execution.
Check Point Research disclosed CVE-2026-35029 and CVE-2026-59823 in LiteLLM, flaws enabling admin takeover and theft of OpenAI, Anthropic and Google
Rapid7 published a proof-of-concept for GitLab CVE-2026-97229, a CVSS 10.0 flaw; Censys counts 25,766 internet-facing hosts running vulnerable versions.
Docker patched GhostPat, a critical Docker Hub flaw (CVE-2026-105445, CVSS 9.4) that let attackers act as other accounts at the
SecurityOnline reports attackers are exploiting CVE-2026-110447, a CVSS 9.2 command injection in Nextcloud’s Collabora CODE app, to plant PHP webshells.
Bloom Security’s SlugFest finding showed npm trusted publishing could let attackers hijack 1,500+ packages after repo renames; GitHub now tightens
SAP’s October patch day fixes 20 vulnerabilities, four critical, led by a CVSS 10.0 SSRF flaw in SAP Cloud SDK
IBM issued three critical bulletins rated CVSS 9.8 to 9.9 for IBM i, Db2 Mirror for i and Maximo AI
Progress Software’s October bulletin fixes 31 MarkLogic Server flaws, including three rated CVSS 9.9 that allow code execution and hidden
CERT/CC says 11 unpatched Thelia flaws, seven enabling remote code execution by back-office users, remain open because the vendor could
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.