A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 4 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 11 October 2026 · 10 items.
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
CVSS 9.3 CRITICAL Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or si…
Read at source →CVSS 9.3 CRITICAL BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign to…
Read at source →CVSS 10.0 CRITICAL A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection…
Read at source →CVSS 8.6 HIGH A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may b…
Read at source →Lower-severity or unconfirmed-exploitation vulnerabilities.
CVSS 2.1 LOW A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument g…
Read at source →CVSS 5.5 MEDIUM A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of…
Read at source →CVSS 6.9 MEDIUM A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot S…
Read at source →Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Read at source →Malware, campaigns and adversary tradecraft.
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keycha…
Read at source →Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. [...]
Read at source →