Israel's National Cyber Directorate (INCD) published four CVE records on 15 October 2026 for Unitronics UniStream Pro (B10/C10) with UniLogic: CVE-2026-45449 (OS command injection, CWE-78), CVE-2026-45450 (memory-buffer restriction, CWE-119), CVE-2026-45451 (improper authentication, CWE-287) and CVE-2026-45452 (externally controlled format string, CWE-134). Each is rated CVSS 3.1 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) — network reachable with low privileges and no user interaction. Affected builds are UniStream Pro B10/C10 with UniLogic prior to 1.41.329. Solutions in the CVE records: upgrade UniLogic and UniStream to 1.41.329 or above for CVE-2026-45449, and to 1.42.220 or above for the other three. No exploitation is stated in the records. Unitronics PLCs have previously been targeted in OT incidents; treat internet-exposed HMI/PLC pairs as high priority. Primary: CVE/INCD records.
CVE-2026-45449 — Unitronics UniStream Pro/UniLogic OS command injection (INCD, 15 Oct 2026)
JetBrains assigned CVE-2026-111094 on 15 October 2026 for TeamCity builds before 2026.2, 2026.1.4 and 2025.11.8: remote code execution was possible through a whitelist bypass in the build messages protocol (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network, high attack complexity, no privileges or user interaction). The same advisory set includes CVE-2026-111095 (stored XSS in the classic project overview, CVSS 8.0) and CVE-2026-111096 (stored XSS in the classic build log, CVSS 6.7). JetBrains lists the fixes on its privacy-security issues-fixed page; there is no report of in-the-wild use in the CVE records. Distinct from the 6 October TeamCity Kotlin DSL sandbox RCE card (CVE-2026-106218) already on this desk. Primary: JetBrains issues-fixed / CVE records.
Red Hat published CVE-2026-92982 on 15 October 2026 (public date 15 Oct 13:33 UTC) for Ansible Operator Plugins. A low-privileged Kubernetes user who can create or modify a custom resource can put Jinja2 expressions in CR spec values; Ansible evaluates those values inside the operator pod without proper sanitisation, so the attacker gets arbitrary code execution in that pod and can use the operator service account's cluster RBAC. Red Hat rates it Important, CVSS 3.1 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), CWE-1336. The markUnsafe flag in Ansible Operator Plugins (used in Red Hat Ansible Automation Platform and OpenShift Container Platform) defaults to false, which is what allows the injection. Mitigation from Red Hat: set markUnsafe: true in watches.yaml for the affected operator so CR spec fields are not evaluated as templates, then restart the operator pod. Red Hat's product impact table was still listing affected OpenShift / AAP-family products with fix status under investigation at last check — do not invent package EVRs; follow the live CVE page for errata. No exploitation is stated. Primary: Red Hat CVE-2026-92982.
Red Hat — CVE-2026-92982 Ansible Operator Plugins Jinja2 template injection (public 15 Oct 2026)
On 15 October 2026 BeyondTrust disclosed CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar): improper origin validation in an internal messaging component lets an unauthenticated remote attacker perform file operations on a vulnerable appliance and reach host-level control. The Hacker News reports CVSS 9.3 with the disclosure. Google Threat Intelligence Group / Mandiant says suspected PRC-nexus espionage actor Armory Castle (formerly UNC5221 / Warp Panda) exploited the flaw as a zero-day in late August 2026 during an incident-response engagement, then deployed the SAWFLY PHP webshell (encrypted C2 via a custom Base32/RC4 channel), escalated to root via an SUID copy of /bin/sh, queried appliance secrets with bt-secrets, and planted reboot-surviving sudoers persistence through post_boot.d. BeyondTrust's timeline (via THN) places first known zero-day use on a single self-hosted appliance on 29 August 2026. Mandiant says the flaw affects all supported Remote Support versions up to 26.2.3; Remote Support SaaS tenants were patched by BeyondTrust on 9 October 2026 (no customer action for the appliance patch); self-hosted customers on 24.3.1 or later should apply the BT26-05-RS patch from the /appliance interface (or confirm automatic apply); older than 24.3.1 must upgrade first. Mandiant warns any internet-reachable vulnerable appliance during the window should be treated as potentially compromised until reviewed. Primary research: Mandiant/GTIG. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on 16 October 2026 with a 19 October deadline for US federal agencies and a requirement to perform forensic triage, not just patch. Vendor advisory: BeyondTrust BT26-05. Wire: The Hacker News 16 Oct.
Google Mandiant / GTIG — Armory Castle exploits BeyondTrust Remote Support CVE-2026-102764 (published with 15 Oct disclosure)
Sonatype published four CVE records for Nexus Repository 3 on 15 October 2026 and fixed them in Sonatype Nexus Repository 3 CE/Pro 3.97.0 (release notes dated mid-October; CVE references point at the 3.97.0 notes and matching support articles). CVE-2026-97712 (CVSS 4.0 8.7 High): a user who only holds role create or role update can grant roles and privileges the account does not hold, including full administrative access. CVE-2026-97665 (CVSS 4.0 7.1 High): a missing authorisation check on the NuGet Components API upload path lets an account with only repository read and browse privileges upload and persist NuGet symbol packages (.snupkg) to a hosted repository when Symbol Server is enabled; if anonymous access is on, the built-in anonymous user can hold those read/browse rights. CVE-2026-97666 (CVSS 4.0 6.9 Medium): an unauthenticated remote attacker can feed attacker-controlled input into a Java class-loading call through an ExtDirect repository endpoint and learn whether specific classes are present — information disclosure only, not code execution by itself. CVE-2026-97667 (CVSS 4.0 5.1 Medium): an account with edit permission on a hosted R repository can store script content in R package metadata that runs in the browser of anyone who opens that package in the Browse UI. Affected ranges differ by CVE (97712 and 97666 from 3.0.0; 97667 from 3.28.0; 97665 from 3.95.0) but all are fixed in 3.97.0. No exploitation is stated in the CVE records. Primary: Sonatype 3.97.0 release notes and support advisories; CVE.org records published 15 Oct.
Sonatype — Nexus Repository 3.97.0 release notes (fixes CVE-2026-97712 and related Oct 2026 advisories)
CVE records published on 15 October 2026 assign identifiers to a July 2026 OPNsense security patch set. The lead issue is CVE-2026-57155 (GitHub GHSA-wjqq-rfmm-v5h3, CVSS 3.1 9.9 Critical): the Firewall Alias GeoIP importer downloads a country-IP database from a user-supplied URL and unpacks it as root. An unsanitized country_code field from the CSV is used as the output filename under /usr/local/share/GeoIP/alias, so a user who only holds Firewall Alias Edit can point the importer at a server they control and write attacker-chosen content to an attacker-chosen path as root (directory traversal). That arbitrary root write can be turned into root code execution via the default newsyslog hourly cron. Researcher write-up (HackerAsk, 1 Jul 2026) and the advisory say the chain was reproduced on 26.1.6_2 and 26.1.10. Related CVEs in the same fixed builds: CVE-2026-63442 (CVSS 3.1 8.1 High) — unauthenticated WebGUI login username CRLF log forgery that can add a victim IP to the sshlockout pf table (adjacent network); CVE-2026-58390 (CVSS 3.1 8.0 High) — stored XSS to root RCE via OpenVPN client common_name in status views; CVE-2026-71490 (CVSS 3.1 7.1 High) — comma-separated direct user privileges bypass MVC user-config-readonly write protection; plus several medium XSS/XPath issues. Vulnerable: OPNsense core <= 26.1.10 and <= 26.4.1. Patched: 26.1.11 and 26.4.1p1 (GitHub advisory patched_versions). No known public mass exploitation is stated in the CVE records. Primary: OPNsense GHSA-wjqq-rfmm-v5h3; CVE.org published 15 Oct.
OPNsense GHSA-wjqq-rfmm-v5h3 — Root RCE via arbitrary file write in GeoIP Alias Importer (CVE-2026-57155)
The Node.js project said in an advance notice dated 14 October 2026 that it will ship new versions of the 26.x, 24.x and 22.x release lines on or shortly after Wednesday 21 October 2026 to fix security vulnerabilities. The highest severity issue in each of the three lines is rated High. Node.js has not yet published the CVE numbers, affected components or fixed version numbers; those come with the release. The project reminds users that end-of-life versions are always affected when a security release happens, which includes Node.js 20 (last release 20.20.2 in March 2026) and older lines that will get no fix. Latest releases before the security update were 26.12.0 and 24.22.0 (both 14 October) and 22.23.3 (23 September). Node.js runs a large share of web back ends, build pipelines, serverless functions and developer tooling, including in Australian organisations. Separately, a trust-store change for the compromised eMudhra intermediate certificates was still listed as pending for Node.js on 21 October (see this desk's eMudhra card); the advance notice does not say whether this release includes it. Primary: Node.js security release notice (14 Oct). UPDATE (21 Oct): Node.js published the security releases: 26.12.1, 24.22.1 and 22.23.4. They fix ten vulnerabilities. High: CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js says permits remote code execution (26.x, 24.x, 22.x); CVE-2026-105482, dns.resolve truncating names that contain a NUL character (all three lines); CVE-2026-105483, a TLS certificate hostname check bypass when an IP address is written in fullwidth digits (26.x, 24.x); and CVE-2026-106069, a TLS hostname check bypass when the host loosely resolves to an IP address (all three). Medium: CVE-2026-105481 (a keep-alive socket can process a response written before the request was sent), CVE-2026-106072 (DNS SANs can authenticate non-canonical IPv4 endpoints) and CVE-2026-106074 (crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable applications, so every process repeats the same values). Low: CVE-2026-106070 (ZipFile returns attacker-controlled prefix bytes, 26.x), CVE-2026-106071 (Permission Model wildcard over-grant, 26.x) and CVE-2026-106073 (Permission Model bypass with fs.realpathSync). The releases also update c-ares and Undici on all three lines, OpenSSL on 24.x and 22.x and SQLite on 22.x, and update Node's bundled CA certificates for the eMudhra intermediate CA compromise on all three lines. Node.js publishes severity ratings, not CVSS scores. Primary: Node.js security release post (updated 21 Oct). UPDATE (23 Oct 2026): Imperva's red team said on 22 October that its 'Node2Shell' proof of concept ran code carried in Brotli data inside applications on the official Node.js 24.22.0 Linux arm64 image, through both a response read with the built-in fetch() and request bodies decoded by Express 5 and body-parser 2 parsers; it says execution took multiple attempts, it did not test every Node.js build or application, and 24.22.1 rejected the same inputs. Imperva says a bare Node.js HTTP server does not decode incoming Brotli bodies just by receiving them. Vercel said it deployed WAF rules on 21 October that block the inbound attack for projects on Vercel, but they do not cover responses an application fetches from other servers and do not replace patching. (source: Imperva; Vercel) UPDATE (24 Oct 2026): The Brotli flaw CVE-2026-111497 is in Google's Brotli C decoder, so other software that ships its own copy of that decoder needs its own fix. Google published fixed Brotli releases v1.2.1, v1.1.1 and v1.0.10 on 21 October, each listing 'CVE-2026-111497: out-of-bounds write permits remote code execution'. Envoy's advisory GHSA-3wvj-j6qm-62mr (23 Oct, rated Critical, CVSS 4.0 9.2) says Envoy v1.39.2, v1.38.5, v1.37.7 and v1.36.11 are vulnerable in deployments that have the Brotli decompressor configured, and that the flaw was addressed in v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12. Istio's bulletin ISTIO-SECURITY-2026-007 says users who enable Brotli decompression, for example with an EnvoyFilter, should upgrade, to 1.31.2, 1.30.6 or 1.29.9 (the final 1.29 release). The Python Packaging Advisory Database (PYSEC-2026-4322 and PYSEC-2026-4323, 23 Oct) says the PyPI Brotli package up to and including 1.2.0 and brotlicffi releases before 1.2.1.0 carry the vulnerable decoder, fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0, and that with Brotli installed, common HTTP clients (urllib3/requests, httpx with the brotli extra, aiohttp) decode Brotli responses automatically. Red Hat rates the flaw Important (CVSS 3.1 8.1) and says there is no public, reliable remote code execution proof of concept. According to The Hacker News, Bun is also affected and no real-world attacks have been reported. (source: Google Brotli on GitHub; Envoy; Istio; PyPA advisory database; Red Hat; The Hacker News) UPDATE (25 Oct 2026): According to iTnews, Australian researcher Paul McCarty, co-founder and chief technology officer of OpenSourceMalware, found potentially vulnerable software that uses Google's Brotli decoder across several open source ecosystems, including Python, Go, .NET and Perl. iTnews reports McCarty as saying that Chrome and Firefox have picked up the fix in their bundled copies of Brotli; that Electron desktop apps such as Signal, Slack, Discord and Visual Studio Code each carry their own copy of the browser engine and rely on their own update mechanisms; and that Microsoft's .NET runtime, the DuckDB database and the Pillow and pyarrow Python libraries carry their own copies of the decoder. iTnews also reports that a Google engineer added the fix to Brotli in February, described only as a change to detect and report invalid streams earlier, and that it was not in an official Brotli release until October. (source: iTnews)
Node.js — Wednesday, October 21, 2026 Security Releases (advance notice 14 Oct; release details 21 Oct 2026)
EG Secure Solutions disclosed on 14 October 2026 an OS command injection vulnerability, CVE-2026-106931 (JVN#88474777), in the statistics function of SiteGuard Server Edition, a host-based web application firewall widely used in Japan for Apache, Nginx and IIS. The vendor says exploitation has already been confirmed. A successful attack lets an attacker run arbitrary OS commands with root or SYSTEM privileges on the server running the product. Affected are version 2.20 and later with the statistics feature enabled, which is the default: Apache, Nginx and IIS editions before Ver8.00 Update5, and FreeBSD Apache and Nginx editions before Ver7.00 Update6. IIS Ver3.10 through Ver4.00 Update4 are not affected. The vendor rates it CVSS 4.0 8.5 (CVSS 3.0 7.8) with a local attack vector and low privileges required. It notified customers with direct support contracts on 29 September and offers a replacement-file patch for those who cannot upgrade, including end-of-support versions. JPCERT/CC issued an alert the same day, noting the product is widely used in Japan and urging both patching and compromise checks. The vendor warns that upgrading may wipe attack traces, so collect the diagnostic information from the web admin console before updating. Primary: EG Secure Solutions; JPCERT/CC alert; wire: The Hacker News ThreatsDay (16 Oct). UPDATE (22 Oct 2026): CISA added CVE-2026-106931 to its Known Exploited Vulnerabilities catalog on 20 October 2026, with a 23 October due date for US federal agencies. (source: CISA KEV catalog)
EG Secure Solutions — SiteGuard Server Edition OS command injection vulnerability (urgent), CVE-2026-106931 (14 Oct 2026, Japanese)
Vercel published a Next.js Security Update for Upstream Vulnerabilities on 14 October 2026, shipping out-of-band fixes that had been postponed from the September security release while upstream dependencies caught up. Two issues are rated critical at CVSS 4.0 9.5: (1) GHSA-673q-mjm6-r5xr — unauthenticated remote code execution in App Router apps with Cache Components when a use cache function returns multiple typed arrays (affected Next.js 16.0.0 through 16.4.0; fixed in 16.4.1; related React advisory GHSA-xqc2-xf4c-x3h3; no known workaround — upgrade even if you think you lack similar functions); (2) CVE-2026-96889 / GHSA-2464-fhr4-w9xw — unauthenticated RCE via the Image Optimization API when attacker-supplied SVG is processed through sharp on glibc-based Linux (affected 10.0.0–15.5.27 and 16.0.0–16.4.0; fixed in 15.5.28 and 16.4.1; workaround is sharp >= 0.35.5). A third issue, GHSA-p3m5-59mp-jv5r (related React GHSA-h3gv-c5rc-p453), is a high-severity denial of service against App Router apps that expose at least one Server Action (crafted requests can pin CPU and block further requests in the same process; Pages Router or apps without Server Actions are not vulnerable; fixed in the same patched trains). Primary: Next.js blog security update; vendor advisories on GitHub.
Next.js — Security Update for Upstream Vulnerabilities (14 Oct 2026)
The Drupal Security Team published SA-CORE-2026-014 on 14 October 2026 for CVE-2026-108097, a remote code execution flaw in the core Field UI module (the admin UI for managing fields and their display). Drupal rates it Critical 19/25 (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default). The advisory says the issue is not directly exploitable with core alone, but multiple serious exploit paths exist through contributed modules, and at least one known path needs no authentication; custom code may also expose the vulnerable functionality. Mitigate immediately by uninstalling the core field_ui module while preparing the upgrade. Fixed releases: Drupal 11.4.10, 11.3.19, 10.6.19, and 12.0.0-beta2 for the 12.0 beta line (beta branch only). Drupal 11.2.x and below, 10.5.x and below, and Drupal 8/9 are end-of-life and receive no fix. Drupal Steward is described as protecting some known attack vectors but not all. Reported by Drew Webber of the Security Team and Octavio Galland. Primary: Drupal SA-CORE-2026-014. UPDATE 14–17 Oct 2026: In the same 14 October security window the Drupal Security Team also published SA-CONTRIB-2026-218 for the contributed Entity List module (entity_list, which builds lists of entities without Views): CVE-2026-108099, remote code execution, rated Critical 19/25 with the same risk vector. As with the core flaw, the module alone is not directly exploitable, but multiple serious exploit paths exist through other contributed modules, at least one known path needs no authentication, and custom code may also expose it. The fix is Entity List 3.0.10. BleepingComputer (17 October) reported both flaws together and noted the Security Team's pre-release warning that exploits might be developed within hours or days of disclosure. No exploitation has been reported so far.
Drupal.org — SA-CORE-2026-014: Field UI remote code execution (CVE-2026-108097, 14 Oct 2026)
The util-linux project published two security advisories with CVE records on 14 October 2026 for the set-user-ID mount utility shipped by nearly every Linux distribution. Both need a local low-privileged user whom /etc/fstab already allows to mount something (a user or users entry), and both are time-of-check to time-of-use races won by swapping a path component with renameat2(RENAME_EXCHANGE) in an ancestor directory the attacker can write to. CVE-2026-53612 (GHSA-g8wm-75wr-g2vh) is in the hook_owner post-mount hook: when the fstab entry also sets X-mount.mode, X-mount.owner or X-mount.group, mount runs chmod and lchown on a path that can be redirected to a root-owned file. It affects 2.39 through 2.41.4 and 2.42 through 2.42.1. CVE-2026-53613 (GHSA-8gj5-72r3-428g) is in restricted non-root mount requests, which check the fstab target and then resolve the path again, so the mount can be redirected to somewhere like /etc/sudoers.d. It affects 2.17 through 2.41.6 and 2.42 through 2.42.3, and 2.42.4 when the legacy mount(2) path is used without /proc. Both are rated CVSS 3.1 7.0 (local, high complexity). No exploitation has been reported. Primary: util-linux GitHub advisories and CVE records.
util-linux — GHSA-8gj5-72r3-428g, mount target TOCTOU (CVE-2026-53613; 14 Oct 2026)
Progress published CVE records on 14 October 2026 for at least 11 vulnerabilities in MOVEit Transfer, its managed file transfer server, all fixed in MOVEit Transfer 2025.1.6 and 2026.0.4 and referenced to Progress's MOVEit Transfer Critical Security Bulletin (September 2026). The highest-rated are CVE-2026-89067, an authentication bypass through an alternate path in Secure Messaging (CVSS 3.1 8.8, low-privileged network attacker; credited to Leo Oliver), and CVE-2026-87093, a service directory writable by local users that allows local privilege escalation (8.8). Several more weaken sign-in: CVE-2026-89068, a missing step in LDAP sign-on authentication (8.1, no privileges needed but high complexity); CVE-2026-89074, an email MFA bypass through unicode handling (7.5); CVE-2026-89070, OIDC authentication replay (7.5); CVE-2026-89073, an OAuth access-restriction bypass through weak session expiry (7.5); CVE-2026-89071, LDAP injection in certificate-based authentication (7.5); CVE-2026-89072, an authorisation flaw in client-certificate management (7.5); and CVE-2026-89077, an identity-validation flaw in SFTP authentication (7.5). The set also includes SQL injection in Custom Reports for admins (CVE-2026-89076, 7.2) and local disclosure of session information (CVE-2026-89075, 7.3). The CVE records do not report exploitation. MOVEit Transfer matters for Australian organisations because internet-facing MOVEit servers were mass-exploited by the Clop gang in 2023 (CVE-2023-34362).
Progress — MOVEit Transfer Critical Security Bulletin, September 2026 (CVE records published 14 Oct 2026)
