Vulnerabilities
Upgrade DynamoDB MCP Server to Stop Code Execution on Hosts
A flaw in the open-source AWS tool lets attackers run commands on servers via crafted database model names. Update to version 2.1.6 immediately.
Vulnerabilities
Vulnerabilities coverage from Shell Bulletin holds 98 articles, 26 of them reference guides. The newest was published on October 22, 2026. New stories are added as soon as they are confirmed, from more than 150 sources checked as often as every 45 seconds. Each story lists its sources. Primary sources we follow for this section include FIRST: Common Vulnerability Scoring System and MITRE CWE.
Vulnerabilities
Secure SOA Suite Endpoints Against CVE-2026-91216 System Takeover Risk
Unauthenticated attackers can take over Oracle SOA Suite via T3 or IIOP protocols, requiring immediate review of network access controls.
Vulnerabilities
Secure Oracle Essbase 21.8.3.0.0 Against Unauthenticated System Takeover
A critical flaw in Oracle Essbase allows attackers to take over systems without credentials. Small businesses must verify their version and restrict access immediately.
Vulnerabilities
Check LocalAI Gallery Settings to Stop Server-Side Request Forgery Attack
Critical flaw in LocalAI versions allows attackers to redirect internal requests via gallery configurations, exposing sensitive metadata.
Vulnerabilities
Isolate Unpatched PHP Servers Now: Critical Remote Code Execution Flaws CVE-2026-109618 and 109619 Patched
Attackers can execute code remotely on unpatched PHP servers via two critical flaws. Patches are available for supported versions; isolate systems if you cannot update immediately.
Vulnerabilities
Patching Oracle Java and GraalVM Essential to Block Remote JSSE Data Theft via CVE-2026-91403
Unauthenticated remote attackers can seize full control of data in affected Oracle Java versions via a critical JSSE vulnerability.
Vulnerabilities
Update Argo CD Now: Low Privileges Enable Server-Side Code Execution via Helm Plugin Injection
Attackers with minimal permissions can run code on Argo CD servers by injecting Helm plugins into Git repositories or API uploads.
Vulnerabilities
Deploy Kernel Patches Now to Block Critical Linux KVM Escape Flaw
A critical vulnerability in Linux networking code allows virtual machines to escape isolation and execute code on the host system, requiring immediate updates.
Vulnerabilities
Review IP Binding Configurations in IBM App Connect Enterprise to Prevent Data Exposure
A critical flaw in IBM App Connect Enterprise versions up to 13.0.8.2 allows remote attackers to steal sensitive data via unrestricted IP binding.
Vulnerabilities
Patch PHP servers now to block remote code execution via two severe flaws
Maintainers warn of imminent fixes for two 9.2-rated vulnerabilities after an exploit tool leak, urging immediate preparation for updates.
Vulnerabilities
Prepare PHP Systems for October 21 Critical Security Patch Release
The PHP team will release a critical update on October 21 fixing two severe flaws rated 9.2, requiring attention from web hosting providers.
Vulnerabilities
Update Tomcat 9-11 immediately to fix CVE-2026-101296 JNDI realm SASL auth bypass critical flaw
Attackers can bypass passwords in Apache Tomcat 7.0 through 11.0 if JNDI realms use specific SASL settings, requiring immediate upgrades.
Vulnerabilities
Download Apache Tomcat 11.0.27 Now to Prevent Cross-Request Data Leaks in AJP Protocol
A buffer under-read flaw in Apache Tomcat 11 allows response data to leak into subsequent requests on the same connection, risking sensitive information exposure.
Vulnerabilities
Secure Froxlor Servers Before 2.3.15 to Block Critical Root Escalation Risk
Authenticated Froxlor customers can seize full server control by exploiting a symlink flaw in versions prior to 2.3.15, granting them root-level access.
Vulnerabilities
Shut down CCC Attestation TLS PoC on open networks to block CVE-2026-112377 impersonation attacks
A critical flaw in the CCC Attestation SIG proof-of-concept allows attackers to relay valid evidence and impersonate workloads, requiring immediate isolation from untrusted networks.
Vulnerabilities
Patch Pillow to 13.0.0 to eliminate critical TIFF heap overflow enabling remote code execution
A critical heap buffer overflow in Pillow versions before 13.0.0 allows remote code execution when saving compressed TIFF files to memory buffers.
Vulnerabilities
Patch Piflow 2.0.0-2.0.1 to Prevent Unauthenticated RCE and Protect LLM API Keys from Exposure
Attackers can run arbitrary commands on Piflow 2.0.0 and 2.0.1 systems without login credentials, risking total server control.
Vulnerabilities
Patch H3C Magic NX15 Firmware to Block Critical RPC Code Injection and Protect Networks
Remote attackers can inject arbitrary code into H3C Magic NX15 devices via a public exploit targeting the RPC interface, posing a critical risk to networks.
Vulnerabilities
Secure Cognition API Endpoints Before Attackers Execute Remote Code
Unauthenticated flaws in Cognition versions prior to 0.13.0 allow remote attackers to run arbitrary shell commands on host servers without credentials.
Vulnerabilities
Patch Google Agent Mesh to Stop Unauthenticated Remote Service Access
A critical flaw in early Google SAM builds allows remote peers to bypass security checks and trigger backend services without valid credentials.
Vulnerabilities
Urgently Update QuantumCloud ChatBot Plugins to Mitigate Critical CVE-2026-110886 Deserialization Risk
A critical deserialization bug in QuantumCloud plugins allows object injection in versions up to 1.5.1, rated 9.8 by the NVD.
Vulnerabilities
Stop Admin Token Forgery in DataBuff ai-apm-web Before Attackers Gain Full Control
Unauthenticated attackers can forge administrative tokens using a hardcoded secret in DataBuff ai-apm-web versions through 0.1.10, granting full access to protected APIs.
Vulnerabilities
Update LangChat Now to Block Unauthenticated API Key Theft and Super-Admin Creation
A critical flaw in LangChat allows remote attackers to create super-admin accounts and steal provider API keys without any credentials.
Vulnerabilities
Secure LatePoint Accounts Against OTP Race Condition Bypass Attack
Unauthenticated attackers can seize customer accounts in the LatePoint WordPress plugin by exploiting a timing flaw that circumvents login lockout protections.