The catch: Cursor's revised notice says the extension added the attacker's SSH key, installed persistence and sent host details to the attacker, even where the SSH step failed. These stay after the ...

Update (2 November 2026): Red Hat released fixed kernels for Red Hat Enterprise Linux 8, 9 and 10 on 1 November 2026 and raised its own score to CVSS 3.1 9.8, Critical. Amazon Linux 2 and the Amazon ...

On 29 October 2026, Progress Software published CVE records for two critical vulnerabilities in WS_FTP Server, its Windows file transfer server. CVE-2026-84295 is an improper authentication flaw that, ...

On 28 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300, a Linux kernel flaw known as "Fragnesia", to its Known Exploited Vulnerabilities (KEV) catalog, ...

On 27 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356, a file upload flaw in Adobe Commerce and Magento Open Source, to its Known Exploited ...

On 28 October 2026, SignalWire, the maintainer of the open-source FreeSWITCH telephony platform, published advisory GHSA-mg63-h38w-8p9p for CVE-2026-116779 (SignalWire GHSA-mg63-h38w-8p9p). A single ...

On 27 October 2026, TeamViewer published security bulletin TV-2026-1011, fixing three flaws in its clients. The most broadly relevant is CVE-2026-111585, an integer overflow in the code that processes ...

TL;DR. PwnEscape (CVE-2026-99999) is a Linux kernel flaw in IPv4 packet handling that lets a guest virtual machine attack the host it runs on. The researcher showed it leaking host memory, crashing ...

The breach targeting PwC originated from a compromise of a third-party vendor hosting employee learning records. The Everest group, active since at least December 2020, is known for leveraging a ...

TL;DR. Drupal rates CVE-2026-118539 in Commerce Core Highly critical (21/25) and says it is being actively exploited in the wild; Rescana treats it as Critical. The flaw lets attackers tamper with ...