News · via Microsoft Security Response Center
CVE-2026-102232 Visual Studio Code Security Feature Bypass Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Vulnerability
Coverage tagged "Vulnerability".
News · via Microsoft Security Response Center
CVE-2026-102233 Visual Studio Code Security Feature Bypass Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
News · via Microsoft Security Response Center
CVE-2026-102234 Visual Studio Code Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
News · via Microsoft Security Response Center
CVE-2026-96956 SQL Server Elevation of Privilege Vulnerability
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
News · via BleepingComputer
SAP warns of maximum severity OAuth2 SSRF security flaw
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python.
News · via Canadian Centre for Cyber Security
JetBrains security advisory (AV26-1032)
Serial number: AV26-1032 Date: October 13, 2026 As of October 9, 2026, JetBrains is affected by a vulnerability in the following product: Exposed Prior to 1.5.1 The Cyber Centre encourages users and…
News · via Canadian Centre for Cyber Security
Progress security advisory (AV26-1031)
Serial number: AV26-1031 Date: October 13, 2026 As of October 12, 2026, Progress is affected by vulnerabilities in the following product: MarkLogic Server Prior to 11.3.7 Prior to 12.1.0 The Cyber…
News · via Canadian Centre for Cyber Security
SAP security advisory – October 2026 monthly rollup (AV26-1030)
Serial number: AV26-1030 Date: October 13, 2026 As of October 13, 2026, SAP_SE is affected by vulnerabilities in the following products: SAP Cloud SDK Prior to 0.45.2 SAP Commerce Cloud (OOTB Code)…
News · via Canadian Centre for Cyber Security
MikroTik security advisory (AV26-1029)
Serial number: AV26-1029 Date: October 13, 2026 As of October 12, 2026, MikroTik is affected by a vulnerability in the following product: RouterOS Prior to 7.24.5 The Cyber Centre encourages users…
News · via Canadian Centre for Cyber Security
GitLab security advisory (AV26-1028)
Serial number: AV26-1028 Date: October 13, 2026 As of October 12, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Prior to 19.2.8 Prior to 19.3.5 Prior to 19.4.2 The…
News · via Canadian Centre for Cyber Security
Dell security advisory (AV26-1027)
Serial number: AV26-1027 Date: October 13, 2026 As of October 6, 2026, Dell is affected by vulnerabilities in the following products: Command | Configure (DCC) Prior to 5.2.3.35 Dell Container…
![[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls](/media/2610/8f46402e7192bba0eecd2c31-770.webp)
News · via The Hacker News
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and…
News · via The Hacker News
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix…
News · via SecurityWeek
Cyberattack Prompts Ahold Delhaize to Disconnect Systems
The company says it took some of its systems offline to contain a security issue within its network.
News · via Help Net Security
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register…
News · via The Hacker News
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says…
News · via The Hacker News
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has…
News · via Fortinet PSIRT
Broken authorization
CVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests…
News · via Fortinet PSIRT
Double free in signal handler
CVSSv3 Score: 2.1 A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands. Revised on…
News · via Fortinet PSIRT
GUI Denial of Service
CVSSv3 Score: 6.7 An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management…