CISA warns of six vulnerabilities in J4Care dcm4chee‑arc‑light
CISA reported that CVE-2026-97851 has a CVSS v3.1 base score of 9.1 (Critical) due to missing authorization on a storage status‑change REST endpoint.
Vulnerabilities & Patches
vulnerability CVE zero-day patch exploit advisory update KEV
-
-
Microsoft Patch Tuesday fixes over 1,400 CVEs, CISA warns of Ivanti Zero-Day
CISA instructed federal civilian agencies to patch Ivanti Connect Secure vulnerability CVE-2026-104935 by Friday and to address Windows Shell bypass CVE-2026-96951 by Oct. 16, 2026.
-
Next.js releases out‑of‑band patch for two critical RCE flaws
The patches fix a React Server Components flaw and a librsvg memory bug, both rated CVSS 9.5.
-
Cisco issues 35-Vulnerability Patch batch, flags Critical NX-OS and APIC Flaws
Cisco says none of the newly patched flaws are known to be exploited, but several critical bugs lack any workaround, per SecurityWeek and The420.in.
-
Microsoft patches record 1,413 flaws in October Patch Tuesday
The update fixed an actively exploited Windows Shell zero‑day (a flaw exploited before a patch is available), CVE-2026-96951, rated CVSS 8.8 (a common severity scoring system).
-
CISA orders patch for Ivanti Connect Secure zero‑day after Oct 1 exploitation
The directive follows Volexity’s report of a three‑flaw chain granting root access and notes the flaw’s CVSS 8.6 rating.
-
Microsoft’s September 2026 Patch Tuesday release nears 1,000 vulnerabilities, forcing CIOs to balance patching speed and scale as AI accelerates discovery
Microsoft reported nearly 1,000 vulnerabilities in its September 2026 Patch Tuesday release, with frontier AI models increasing vulnerability findings beyond traditional human review capacity
-
National vulnerability database publishes CVE‑2026‑68875, a buffer over‑read affecting the Windows NTFS driver
The flaw allows an authorized local user to run arbitrary code using the rights of that account.
-
AI patches stop crashes but fail maintainer tests in Northwestern study
Researchers found AI agents halted crashes in about 90% of cases but passed original maintainers' test suites only about 61% of the time.
-
Microsoft warns Windows PCs missing key updates will lose security fixes in 2027
Devices without replacement certificates after May 17, 2027, and June 19, 2027, will stop receiving Windows Update patches.
-
CISA discloses security flaws in Satel Netco Design software Oct. 8, 2026
The advisory states that releases of Satel Netco Design earlier than version 2.1.7 are affected.
-
Project Zero releases emergency patching guidance for large vendors
Project Zero says the guidance describes four emergency patching methods: feature flags, filtering, alternate channels, and hotpatching.