Advisories

Vendor and authority advisories

Security advisories published by software and hardware vendors and national cyber authorities, in one place.

Updated automatically every 6 hours. Last update 2 Nov 2026, 01:28 IST · 7 sources · Get these by email

Threats, ransomware & breaches CVE-2026-118147 Visual Studio Spoofing VulnerabilityImproper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network. Microsoft Security Response Center · Global · 30 Oct 2026
Threats, ransomware & breaches USN-8958-1: .NET vulnerabilitiesIt was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected… Ubuntu Security Notices · Global · 29 Oct 2026
Threats, ransomware & breaches Hitachi Energy TRO600 series productsView CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information. Please refer to… CISA Cybersecurity Advisories · United States · 29 Oct 2026
Threats, ransomware & breaches USN-8956-2: Brotli vulnerabilityUSN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this… Ubuntu Security Notices · Global · 27 Oct 2026
Threats, ransomware & breaches EPICS BaseView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are affected: EPICS Base release <=7.0.10… CISA Cybersecurity Advisories · United States · 27 Oct 2026
Threats, ransomware & breaches Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with,… CISA Cybersecurity Advisories · United States · 27 Oct 2026
Threats, ransomware & breaches USN-8956-1: Brotli vulnerabilityIt was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. Ubuntu Security Notices · Global · 26 Oct 2026
Threats, ransomware & breaches USN-8955-1: nginx vulnerabilitiesIt was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered… Ubuntu Security Notices · Global · 26 Oct 2026
Threats, ransomware & breaches CISA Adds One Known Exploited Vulnerability to CatalogCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber… CISA Cybersecurity Advisories · United States · 23 Oct 2026
Threats, ransomware & breaches USN-8954-1: zlib vulnerabilityAli Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution. Ubuntu Security Notices · Global · 22 Oct 2026
Threats, ransomware & breaches USN-8952-1: Tornado vulnerabilitiesIt was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,… Ubuntu Security Notices · Global · 22 Oct 2026
Threats, ransomware & breaches InterSystems Corporation InterSystems IRIS for HealthView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions of InterSystems Corporation InterSystems IRIS for Health are affected: InterSystems IRIS for Health 2026.2.0.221,… CISA Cybersecurity Advisories · United States · 22 Oct 2026
Threats, ransomware & breaches USN-8890-2: libsoup vulnerabilitiesUSN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of… Ubuntu Security Notices · Global · 21 Oct 2026
Threats, ransomware & breaches USN-8951-1: c-ares vulnerabilitiesIt was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares… Ubuntu Security Notices · Global · 21 Oct 2026
Threats, ransomware & breaches Persistent Denial of Service in Admin ProfileCVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Improper access control and session management in the web management interfaceCVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Broken authorizationCVSSv3 Score: 3.4 A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches Arbitrary file write in grpc phQueryMasterCVSSv3 Score: 9.4 An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. Revised on 2026-10-13 00:00:00 Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches arbitrary command execution in fgfmsd daemonCVSSv3 Score: 5.3 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted… Fortinet PSIRT · Global · 13 Oct 2026
Threats, ransomware & breaches 2026-016: Critical Vulnerability in GitLab CE and EEOn 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server. CERT-EU strongly… CERT-EU Security Advisories · European Union · 12 Oct 2026

Headlines and short excerpts are collected automatically from public sources and link to the original publisher. NAPSECURE does not verify third-party content. Categories are assigned automatically and may occasionally be wrong.