Trending now

CVE-2026-108142 is an authorization bypass vulnerability in Veeam Backup & Replication, disclosed by Veeam on October 27, 2026, in its security advisory KB4948. Reported through HackerOne, the flaw allows an unauthenticated attacker to bypass access checks on the CDP Coordinator Service. The vulnerability affects both Windows-based deployments and the Veeam Software Appliance. The issue impacts Veeam Backup & Replication version 13.1.1.18 and earlier builds in the 13.1 branch, as well as version 13.0.2.29 and earlier builds in the 13.0 branch, while version 12.x is unaffected. Veeam has resolved the vulnerability in Backup & Replication versions 13.1.2 (build 13.1.2.57) and 13.0.3 (build 13.0.3.63).

CVE-2025-65200 is a vulnerability identified in LocalStack, a platform that emulates Amazon Web Services (AWS) cloud environments for local development. The issue specifically affects version 4.9.2 of the software and allows for arbitrary code execution within the context of the running LocalStack Docker container. The vulnerability can be exploited by hosting crafted content on a web-accessible URL and passing that URL as the `templateURL` parameter to the `_localstack/cloudformation/deploy` endpoint. When the endpoint processes this input, the hosted content is executed inside the container, enabling attackers to run unauthorized commands.

CVE-2026-46300, dubbed "Fragnesia," is a local privilege escalation (LPE) vulnerability found in the Linux kernel's XFRM ESP-in-TCP subsystem. This flaw allows an unprivileged local attacker to perform arbitrary byte writes into the kernel page cache of read-only files. The vulnerability arises from a logic error where `skb_try_coalesce()` fails to propagate the `SKBFL_SHARED_FRAG` marker, causing the kernel to lose track of externally backed fragments. This page-cache corruption can be exploited to modify the in-memory cached copies of read-only files, such as `/usr/bin/su`, enabling an unprivileged process to gain root privileges. Fragnesia is the third LPE vulnerability discovered by William Bowling of the V12 security team in the same general area of the Linux kernel (IPsec ESP / rxrpc), following "Copy Fail" and "Dirty Frag." A public proof-of-concept exploit for CVE-2026-46300 is available.

CVE-2026-41709 is an insufficient logging vulnerability affecting Broadcom's VMware ESX bare-metal hypervisor. Disclosed and patched by Broadcom in July 2026, the flaw allows a malicious actor with administrative privileges to perform certain operations without them being recorded in the system logs. In October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. According to cybersecurity researchers at CrowdStrike, a China-nexus cyber espionage group known as Warp Panda exploited this vulnerability as a zero-day in early 2026. The threat actor targeted U.S. organizations, particularly within the legal sector, using the flaw to reduce audit trail visibility and cover their tracks. By bypassing audit logging, the group was able to hinder forensic reconstruction and maintain persistent, covert access to compromised environments.

CVE-2026-109618 is a remote code execution (RCE) vulnerability affecting the PHP core. The flaw reportedly impacts a wide range of PHP versions, specifically versions 5, 6, 7, and 8. While specific technical details have been withheld by researchers to prevent exploitation, cybersecurity firm watchTowr confirmed the vulnerability's validity and successfully reproduced it in their testing environment. The vulnerability was originally under embargo for a coordinated disclosure on October 22, 2026, but details of the flaw leaked early on October 20, 2026, via a post on Hacker News. In response to the premature leak, the PHP security team accelerated its release timeline, scheduling emergency security updates for October 21, 2026, to address the issue.

CVE-2026-109619 is a remote code execution (RCE) vulnerability affecting the PHP scripting language. Security researchers and early reports indicate that the flaw impacts PHP versions 5, 6, 7, and 8. While specific technical details regarding the vulnerability's mechanics have not been publicly disclosed, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process. The vulnerability was originally scheduled for coordinated disclosure under embargo on October 22, 2026. However, after information about the flaw leaked online on October 20, the PHP security team accelerated its timeline, scheduling a security release for October 21, 2026, at 14:00 UTC. Security organizations and researchers have advised administrators to prepare to apply the upcoming patches as soon as they are released.

CVE-2026-111497 is a vulnerability affecting the Brotli decompression library integrated into Node.js (specifically within the 22.x, 24.x, and 26.x release lines) and other platforms like Envoy. The flaw is characterized as an out-of-bounds write memory error in the Brotli decoder. When a system decodes Brotli-compressed data, a bug in how the decoder unpacks the data allows it to write past the end of its allocated memory block. This memory corruption can be triggered when an application processes untrusted or malicious Brotli-compressed content, potentially allowing an attacker to leak memory or achieve remote code execution (RCE). To mitigate this issue, users are advised to update to patched versions of Node.js, which include 22.23.4, 24.22.1, and 26.12.1.

CVE-2026-48356 is an unrestricted file upload vulnerability affecting Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe I/O Events connector for Commerce. The flaw arises from insufficient validation of uploaded file types, allowing attackers to upload files without adequate restrictions on their extension or MIME classification. This enables attackers to place content on the system that a web server interprets as an executable script. Successful exploitation requires user interaction—such as a victim visiting a maliciously crafted URL or interacting with a compromised page—and can lead to arbitrary code execution in the context of the current user, potentially granting the attacker elevated access or control over the victim's session. Also known as "PolyShell," the vulnerability has been actively exploited in the wild, with activity traced back to at least July 2025. Security researchers have observed attackers leveraging the flaw to breach hundreds of e-commerce stores, injecting malicious loaders via Magento CMS blocks to fetch and execute attacker-controlled payloads. Due to this active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog in October 2026. Adobe addressed the issue in its July 2026 security updates (APSB26-73), and organizations are advised to apply the patches and inspect their systems for unauthorized file uploads.