Vulnerabilities

Vulnerabilities

CVE-2026-83498 Lets Local Attackers Run Code Inside a Windows VBS Enclave

Microsoft fixed CVE-2026-83498 in SFAPE.dll; Doyensec lab research shows low-privilege local code could run inside the VBS enclave, without password theft.

Oct 14, 202609:57 4 min readRead →

Vulnerabilities

Ivanti Connect Secure Zero-Day Chain Gives Attackers Unauthenticated Root Access

Ivanti warned of an exploited three-flaw chain in Connect Secure enabling unauthenticated root execution, as reported by Volexity investigators.

Oct 13, 202620:29 4 min readRead →

Vulnerabilities

Vercel Sandbox Flaw Opens Indirect Exfiltration Route for Rogue AI Agents

AIR disclosed a Vercel Sandbox flaw that could let a rogue AI agent exfiltrate data via an allowlisted server, with no evidence of exploitation.

Oct 13, 202617:58 2 min readRead →

Vulnerabilities

Docker Hub Fixes CVE-2026-105445, Blocking Token-Based User Impersonation

Docker fixed CVE-2026-105445, where account conversion transferred PATs enabling registry impersonation. Docker reports no evidence of abuse.

Oct 13, 202616:46 2 min readRead →

Vulnerabilities

SAP Fixes OAuth2 SSRF That Can Expose BTP Application Credentials

SAP fixed an OAuth2 SSRF in Cloud SDK for Python that can expose BTP app credentials via tenant_subdomain. Learn affected versions and upgrade guidance.

Oct 13, 202615:37 2 min readRead →

Vulnerabilities

GitLab Fixes CVSS 10.0 CI/CD Flaw Enabling Unauthenticated Server Code Execution

GitLab patched CVE-2026-97229, a CVSS 10.0 CI/CD flaw that could allow unauthenticated code execution via crafted regex, plus three high-severity fixes.

Oct 13, 202612:09 4 min readRead →

Vulnerabilities

Critical MarkLogic flaws let delegated accounts gain persistent administrator control

Progress disclosed 31 MarkLogic Server flaws, including five critical issues that could let delegated admins gain persistent control or run elevated code.

Oct 13, 202610:59 5 min readRead →

Vulnerabilities

Remote Defrost Attack Spoils Food Across Hundreds of European Supermarket Locations

Reported attack forced European supermarket refrigeration into defrost mode, spoiling food; Danfoss connection and cause remain unconfirmed.

Oct 13, 202609:48 3 min readRead →

Vulnerabilities

Remote defrost attack disrupts refrigeration at French supermarkets

Attackers reportedly triggered defrost cycles on refrigeration controllers at French supermarkets, raising temperatures as Paris prosecutors investigate.

Oct 12, 202617:43 2 min readRead →