Overview
- Palo Alto Networks
- Cloud NGFW
14 Oct 2026
Published
14 Oct 2026
Updated
CVSS v4.0
MEDIUM (4.6)
EPSS
Pending
KEV
Description
A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode.
Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.
Statistics
- 1 Post
Last activity: 9 hours ago
Overview
Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.
Statistics
- 1 Post
Last activity: 16 hours ago
Overview
- Microsoft
- ASP.NET Core 10.0
13 Oct 2026
Published
14 Oct 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
1.06%
KEV
Description
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Statistics
- 1 Post
Last activity: 16 hours ago
Overview
Description
The Java OpenWire protocol marshaller is vulnerable to Remote Code
Execution. This vulnerability may allow a remote attacker with network
access to either a Java-based OpenWire broker or client to run arbitrary
shell commands by manipulating serialized class types in the OpenWire
protocol to cause either the client or the broker (respectively) to
instantiate any class on the classpath.
Users are recommended to upgrade
both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3
which fixes this issue.
Statistics
- 1 Post
Last activity: 12 hours ago
Overview
Description
This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.
Statistics
- 1 Post
Last activity: 5 hours ago
Overview
Description
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.
Statistics
- 2 Posts
Last activity: Last hour
Fediverse
(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-105133 and CVE-2026-105134- AhsayCBS Security Brief: Protect the Systems Your Recovery Depends On
Executive briefing on AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134, covering incomplete patch re-verification, command injection risks, and recovery readiness....
Overview
Description
This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.
Statistics
- 1 Post
- 7 Interactions
Last activity: 3 hours ago
Fediverse
Hey Palo, this doesn't distract from CVE-2026-0332. Yeah, yeah, I know, they do it too.
https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
Overview
- Microsoft
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
13 Oct 2026
Published
14 Oct 2026
Updated
CVSS v3.1
HIGH (8.8)
EPSS
0.48%
KEV
Description
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Statistics
- 1 Post
- 1 Interaction
Last activity: 15 hours ago
Fediverse
⚠️ CRITICAL: Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Microsoft patched 1,411 vulnerabilities in October 2026, including three zero-days: CVE-2026-96951 (Windows Shell, actively exploited) and CVE-2026-108398 (.NET Framework, publicly disclosed). CVE-2026-108398 allows attackers to bypass Windows Defender Application Control and execute unauthorized a…
🤖 AI generated summary
Overview
Description
With its original introduction, GNTTAB_cache_flush was made available
uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL
pointer check, yet the addition of that check failed to adjust the
subsequent error path. That error path fails to drop a page reference in
case the specified page is owned by a special system domain (DOM_IO and
DOM_COW are system domains which can have memory pages assigned to them.)
Statistics
- 1 Post
- 18 Interactions
Last activity: 18 hours ago
Overview
Description
This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.
Statistics
- 1 Post
- 18 Interactions
Last activity: 18 hours ago