Wind River CNA CVE-2026-104018 (published 1 October 2026; CVSS 3.1 8.8 High AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): improper privilege management (CWE-269) in the VxWorks 7 command shell when per-user command privileges are enforced. Under certain shell operations a command may run without the usual privilege check, so an authenticated low-privilege user can execute unauthorised commands — confidentiality/integrity/availability impact on the device. Affects all VxWorks 7 versions prior to 26.09; fixed in 26.09 (per Wind River CVE text). CISA SSVC on NVD: exploitation none / not automatable at publication. Primary: Wind River CVE page; NVD/Rapid7 amplify patch floor.
Wind River Support — CVE-2026-104018 VxWorks 7 privilege management
Fortinet PSIRT FG-IR-26-175 (published / revised 1 October 2026; FortiGuard IR RSS + advisory) discloses CVE-2026-104286, a Critical CVSSv3 9.8 path-traversal (CWE-22) plus improper NULL-byte neutralization (CWE-158) flaw in the FortiMail management interface that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Impact: execute unauthorised code or commands. Attack type: unauthenticated. Known exploited: Yes (Fortinet). Affected: FortiMail 8.0.0–8.0.1 (upgrade to upcoming 8.0.2+), 7.6.0–7.6.6 (upcoming 7.6.7+), 7.4.0–7.4.8 (upcoming 7.4.9+), 7.2.0–7.2.9 (upgrade to 7.4 branch or later). Discovered internally by Fortinet Product Security. Workarounds until patches land: disable IBE (`config system encryption ibe` / `set status disable`) and/or remove internet exposure of the FortiMail management interface (trusted networks only). BleepingComputer (1 Oct) amplifies Fortinet IoCs (added/modified files under /data and /bin, SHA-256 hashes, attacker IPs 79.141.169.187 and 45.129.0.192, archive234 remote-archive config, cron/migadmin and IBE Base64 decode failure log patterns) and notes Fortinet is coordinating with government agencies including CISA. CISA added CVE-2026-104286 to KEV on 1 Oct 2026 (FCEB due 4 Oct 2026 per BleepingComputer). Primary: FortiGuard FG-IR-26-175; wire: BleepingComputer 1 Oct.
Fortinet PSIRT FG-IR-26-175 — FortiMail CVE-2026-104286 (1 Oct 2026)
Wordfence CNA CVE-2026-1581 (published 19 Feb 2026; CVSS 3.1 7.5 High AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): unauthenticated time-based SQL injection in the WordPress wpForo Forum plugin via the ‘wpfob’ parameter in all versions up to and including 2.4.14 (insufficient escaping/preparation on SQL). Vendor changelog: 2.4.15 (10 Feb 2026) lists “Security: Vulnerability - Unauthenticated Time-Based SQL Injection” (current trunk Stable tag 3.2.2). UPDATE 1 Oct 2026: The Hacker News (bundled with SC backdoor coverage) cites Previdian telemetry — fewer than 20 exploitation attempts since 3 July 2026 from five unique IPs (Bulgaria, Switzerland, France, US, Yemen). Primary: Wordfence/MITRE CVE record + wpForo changelog; wire: THN 1 Oct.
Kiteworks GitHub advisory GHSA-5xhq-9wq3-rvj6 / CVE-2026-54154 (BleepingComputer 1 October 2026): a maximum-severity chain of path traversal, code injection, and missing authentication on publicly reachable Email Protection Gateway (EPG) endpoints can let an unauthenticated remote attacker achieve arbitrary code execution and escalate to full administrative (root) control of the appliance. CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affects all Kiteworks EPG releases before 9.4.1; fixed in 9.4.1+. Same 1 Oct patch batch also addresses 11 other critical issues (auth bypass, admin takeover, stored XSS, access control) across Core and EPG, totaling 126 vulnerabilities. Reported via YesWeHack bug bounty. Distinct from desk kiteworks-shutdown-20260926 (26–27 Sep LE-intel precautionary shutdown / Advanced Forms defect; no CVE then). Shadowserver tracks ~400 internet-exposed Kiteworks instances. Primary: Kiteworks GHSA; wire: BleepingComputer 1 Oct.
CVE-2026-17106 (GHSA-hfg8-hc9c-6c3h; Docker/Moby; published mid-August 2026; dubbed CopyEscape): tar extraction in moby/go-archive (Unpack/UnpackLayer/Untar and ApplyLayer helpers) does not confine filesystem writes to the destination directory — lexical path checks can be defeated when archive entries introduce links the OS then follows. An attacker who controls a running container can race docker cp archive generation (directory → symlink TOCTOU) so the host-side CLI extracts attacker-chosen files outside the user-selected destination with the privileges of the docker cp process (including sudo docker cp → root on Linux; macOS Desktop extracts on the host even though containers run in a Linux VM). Imperva research (Ron Masas; Cyber Security News 1 Oct 2026) shows the chain replacing host binaries such as runc so a later Docker runtime invoke runs attacker code as root; also affects Docker Sandboxes sbx cp for AI-agent workflows pulling files from untrusted sandboxes. CVSS 4.0 7.1 HIGH (AV:L/AC:L/AT:P/PR:N/UI:A/…). Fixed: moby/go-archive 0.3.0; Docker Engine/CLI 29.7.0; Docker Desktop 4.86.0 (10 Aug 2026 notes: destination-escape in docker container cp); Docker Compose 5.4.0; Docker Sandboxes 0.38.0. Until patched: do not docker cp from untrusted/compromised containers; stop the container before copy; avoid sudo docker cp in CI. Primary: GHSA / Docker Engine 29 notes; wire: Cyber Security News 1 Oct.
NVIDIA Security Bulletin for GPU Display Driver — September 2026 (a_id 5861, initial release 30 September, revision 02 on 13 October 2026) includes CVE-2026-47595: in the Linux kernel-mode layer an unprivileged user can write to read-only memory because permissions are not preserved (CWE-281). NVIDIA rates it CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with impacts of code execution, privilege escalation, DoS, information disclosure and data tampering. Wire coverage on 15–16 October (The Hacker News ThreatsDay) highlighted researcher write-ups nicknamed 'Bad UVM' showing a path from nvidia-persistenced / UVM abuse to host root and GPU-enabled container escape — the same permission-preservation class as the CVE text. CVE-2026-47595 is on the Linux R615/R610/R595/R580 fix lists in the bulletin. Patch Linux GeForce/RTX/Quadro/Tesla branches to 615.71.09, 610.57.04, 595.91.07 or 580.178.04 as applicable; vGPU Linux guest drivers prior to 20.2 / 19.6 also list this CVE. Primary: NVIDIA bulletin; wire: THN ThreatsDay.
NVIDIA — Security Bulletin: NVIDIA GPU Display Driver — September 2026 (a_id 5861; rev 02 updated 13 Oct 2026)
The Model Context Protocol (MCP) project published advisory GHSA-6qxp-vccf-f47h on 30 September 2026, with CVE-2026-104850 following on 6 October. In affected versions the official TypeScript SDK's OAuth client let the MCP server it connected to decide which authorization server received the client's credentials, because saved credentials were not tied to the authorization server that issued them. A malicious or compromised MCP server could name its own authorization server and, with no user interaction, receive the refresh token and client secret saved from an earlier sign-in, or the client secret or signed assertion configured on a bundled provider. Affected: @modelcontextprotocol/sdk 1.12.0 to 1.30.1, and @modelcontextprotocol/client 2.0.0 and 2.1.0 in specific setups, when the client uses the SDK's OAuth support over HTTP (an authProvider on a transport, the withOAuth() middleware, or direct auth() or fetchToken() calls). MCP servers built with the SDK and stdio clients are not affected. The fix records the issuer on saved credentials and refuses to send them elsewhere, but upgrading is not enough on its own: bundled providers need expectedIssuer set, and credentials saved before the upgrade still go to whichever server is named first unless they gain an issuer or are cleared. A new interactive sign-in still goes where the MCP server points. Primary: MCP GitHub advisory and CVE record.
MCP TypeScript SDK — GHSA-6qxp-vccf-f47h: OAuth client could send credentials to an authorization server chosen by the MCP server (30 Sep 2026)
The Python Software Foundation announced CVE-2026-19445 on 30 September 2026 (security-announce, Seth Larson): a Critical use-after-free (CWE-416) in CPython's ssl module. A remote, unauthenticated TLS client can make a server crash or call through a freed pointer when the server's sni_callback assigns a different context to SSLSocket.context (the documented way to pick a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical exposure is servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with the context are not affected, and TLS clients are not affected. The CVE record marks CPython before 3.10.22, 3.11.0 to before 3.11.17, 3.12.0 to before 3.12.15, 3.13.0 to before 3.13.16, 3.14.0 to before 3.14.8 and 3.15.0a1 to before 3.15.0rc3 as affected. PSF scores it CVSS v4 9.2 (attack complexity high, attack requirements present). Fix: cpython PR 158504. Australia: WA Government SOC advisory 20261005002 (5 Oct) rates it Critical, notes CPython ships inside many operating systems and perimeter devices, and has no reports of exploitation on WA Government networks. NVD analysis pending.
Python security-announce — CVE-2026-19445 use-after-free of server-side SSLContext when sni_callback switches contexts (30 Sep 2026)
Cato Networks knowledge-base advisory (published 30 September 2026) covers CVE-2026-10726 and CVE-2026-10739 affecting Cato Windows SDP Client versions lower than 6.12.6: a local attacker with access to the installed client can escalate privileges. Fixed in Windows Client 6.12.6 and higher; Cato recommends identifying older clients via Access Overview (filter Cato Client / Windows) and upgrading via Client Rollout / automatic upgrade service. Quarkslab research write-up (1 October 2026) details CVE-2026-10739 as a split-tunnel upload / named-pipe path where a client-supplied SID is used in a filesystem path, enabling arbitrary SYSTEM file delete (and, in their chain, Windows Installer rollback to SYSTEM). Confirmed by Quarkslab on 6.2.0 and 6.4.6; vendor scope is any version before 6.12.6. OpenCVE / Rapid7 list CVE-2026-10739 as CVSS 4.0 8.5 HIGH (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/…). No wild exploitation stated in the vendor advisory. Primary: Cato KB; research wire: Quarkslab 1 Oct.
n8n GitHub security advisories published 30 September 2026 (High; CVSS 4.0 vectors on GHSA pages; no CVE IDs assigned on these GHSAs at publish). Lead issues: GHSA-5jr4-xmvf-frmj — MCP workflow-validation interpreter allows shared prototype mutation so a member with only a read grant can pass permission checks and take over the instance owner account (MFA-protected accounts not affected); GHSA-x8wx-g24x-3549 — Git node Log operation skipped local-config neutralization, enabling program execution as the n8n process user (also usable as an agent tool; also patched on 1.123.83); GHSA-5qpp-pqww-h7fp — Microsoft SQL node v1 interpolates expressions into Query without parameterisation (arbitrary SQL under stored DB credential when untrusted input is bound); GHSA-728h-pmr2-7cgh — Send-and-Wait waiting-webhook HMAC bypass lets a caller with a resume token approve another party’s waiting execution (downstream runs as workflow owner); GHSA-3qcw-p65v-c7vq — unauthenticated unbounded OAuth client persistence via authorize endpoint (disk-fill). Same-day batch also includes additional High/Moderate items (credential check gaps, Chat Trigger XSS, AI Workflow Builder prototype pollution, etc.). Distinct from desk n8n-ai-agents-authz-20260914 (CVE-2026-65015 / CVE-2026-59207 AI Agents authz, Sep 14). Primary: n8n GitHub security advisories 30 Sep.
TanStack (Tanner Linsley; blog and GHSA-qx66-fv34-fjm8, 30 September 2026; HN amplified 1 Oct) discloses CVE-2026-102989, a critical reflected cross-site scripting flaw in TanStack Start server-function response handling. The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields; an unauthenticated attacker can craft a server-function URL that returns attacker-controlled HTML from the application's origin. CVSS 3.1 9.3 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Affected: published @tanstack/start-server-core, react-start, solid-start, and vue-start from 1.143.12 up to (excluding) patched versions. Fixed: start-server-core 1.169.39; react-start 1.168.60; solid-start 1.168.57; vue-start 1.168.56. Redeploy required after dependency bump. Temporary mitigations: edge/WAF rules on /_serverFn/* (e.g. require x-tsr-serverFn: true; block document navigations); restrictive CSP on server-function responses. Distinct from desk crowdsec-tanstack-source-20260917 (May 2026 npm supply-chain/source exposure). Primary: TanStack blog / GHSA.
TanStack Blog — Start security update CVE-2026-102989 (30 Sep 2026)
CVE-2026-61500 (CVE record published 13 July 2026; GHSA-xxrm-3f86-v97j): Rejetto HTTP File Server (HFS) 3.0.0 through 3.2.0 derives the Koa/keygrip session-cookie signing key from non-cryptographic Math.random() and leaks outputs of the same V8 xorshift128+ PRNG to clients during loginSrp1. A remote attacker can collect a small number of login responses, reconstruct PRNG state, recover the signing key, forge an administrator session cookie, and reach RCE via the server_code / administrative API custom-endpoint path. CVSS 3.1 9.8 Critical and CVSS 4.0 9.3 Critical (CVE record). Fixed in HFS 3.2.1 (GitHub release / commit). UPDATE / desk hook 30 Sep 2026: Horizon3 Attack Research details how Anthropic Mythos (with a custom harness) rediscovered and fully chained the issue — including Z3-based PRNG state recovery and a working exploit path — as an agentic vulnerability-research case study. Primary: GHSA / rejetto v3.2.1; research wire: Horizon3 30 Sep. Updated 5 Oct 2026 (The Hacker News, 4:09 pm Perth): The Hacker News reports that a Python proof-of-concept exploit was publicly released in late September by security researcher Alejandro Ramos (aramosf). Updated 6 Oct 2026 (BleepingComputer, 5 October US time; 4:20 am 6 October Perth): BleepingComputer advises users to upgrade to 3.2.1 or, ideally, the latest stable release, 3.3.4, as soon as possible. No vendor, CISA or other source this desk can cite has confirmed exploitation in the wild; CVE-2026-61500 was not in CISA's Known Exploited Vulnerabilities catalogue when checked on 26 October 2026. No Australian exploitation reports. Correction (26 Oct 2026): reports that exploitation attempts began on 1 October from a China-based actor, that a single China Telecom IP address probed honeypots in Japan and the United States, and that this is the second Rejetto HFS flaw exploited in the wild have been removed: The Hacker News and BleepingComputer attribute them to one threat-intelligence company's honeypot data, and no vendor, CISA or other independent source confirms them. An unlinked SecurityWeek credit has also been removed. The CVSS scores are credited to the CVE record, now linked. (source: CVE record; The Hacker News; BleepingComputer)
