Juniper Networks published its October 2026 Junos OS and Junos OS Evolved security advisories on 14 October 2026, with CVE records for at least 16 issues. The most serious are in J-Web, the built-in web management interface. CVE-2026-101956 (JSA112188) lets an unauthenticated remote attacker run arbitrary Junos commands with root privileges through an exposed J-Web interface. CVE-2026-101986 (JSA112187) bypasses J-Web authentication to run CGI content with elevated privileges using a crafted HTTP request. CVE-2026-101983 is a stack buffer overflow in httpd that an unauthenticated attacker can reach when a J-Web virtual-domain is configured. Juniper rates all three 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0). Other bugs rated 9.8 are CVE-2026-33792, a stack overflow in srxpfe on SRX Series triggered by a crafted packet on a configured GRE tunnel (JSA112186); CVE-2026-102182 in kmd on MX Series via certificate-based IKE packets (JSA112196); and CVE-2026-33789 and CVE-2026-33796 in rpd when BGP Monitoring Protocol (BMP) is enabled (JSA112187). The release also fixes an SRX ADVPN peer-message overflow (CVE-2026-102084), an SRX Security Intelligence feed format-string bug (CVE-2026-102062), an authd overflow reachable with SNMP read access when SNMP and AAA are on (CVE-2026-101979), and a PTX zero-touch provisioning DHCP command injection (CVE-2026-101967), among others. Juniper SIRT says it is not aware of malicious exploitation, and lists no workarounds for the J-Web, GRE and IKE issues. Primary: Juniper's JSA advisories and Juniper-issued CVE records. UPDATE 19 October 2026: Singapore's Cyber Security Agency (alert AL-2026-146, 19 Oct) and Belgium's CCB (16 Oct) have issued patch-now warnings for the same release, and both list further 9.8-rated bugs that Juniper's CVE records (all referencing JSA112187) confirm: CVE-2026-101954, a fourth unauthenticated J-Web flaw, in J-Web and its NETCONF session handling, that gives root-level configuration access and full device takeover when web management is reachable (Junos OS 25.2, 25.4 and 26.2 trains and matching Evolved releases); CVE-2026-102178, a stack overflow in the BGP daemon triggered by flowspec route re-advertisement from a configured flowspec peer when BGP update-threading is enabled; CVE-2026-101990, an rpd stack overflow from a flow-spec update selected for re-advertisement (code execution on Junos OS, crash on Evolved); CVE-2026-101982, an rpd stack overflow from EVPN-VPWS route advertisements by a configured BGP/EVPN peer (root code execution on Junos OS); and CVE-2026-102175, a heap overflow in the sdxd service-deployment daemon reachable by an attacker who controls or intercepts the configured SDX/SRC server connection. All are rated 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0) by Juniper and are fixed in the same releases as the J-Web bugs. Still no reported exploitation.
Noma Labs published SneakPeek on 14 October 2026, an exploit chain in the preview pane of Claude Code Desktop, the desktop app's coding interface. When Claude reads or edits an HTML file, the pane renders it automatically. Files under 256 KB load as data: URLs with a Content Security Policy that blocks scripts. Files over 256 KB were written to a temporary file and loaded from file://, where the CSP was not applied. The request filter meant to stop local file reads only worked when the pane was proxying a dev server, not when rendering a static file from disk. Noma's proof of concept hid a payload in an oversized test-coverage report in a public repo. Once the victim cloned it and asked Claude to look at the report, the script read SSH private keys, AWS keys, npm and GitHub tokens, Kubernetes and Docker credentials, Git tokens and Claude's own OAuth tokens. It then sent them out with navigator.sendBeacon, and could leak the user's real IP address through WebRTC, with no permission prompt. Noma reported it on 4 July 2026. Anthropic scored it 8.7 (CVSS 4.0, high) and treated it as equivalent to code execution on the host. Its first patch blocked file:// fetches from the page, but Noma bypassed that with a Web Worker created from a blob: URL. Anthropic then shipped a complete fix in Claude Desktop 1.30096.1 (17 August 2026), delivered by auto-update. Noma says a GitHub advisory and CVE are still pending. No in-the-wild exploitation is reported. Separate from the Claude Code plugin SHA-pin bypass (CVE-2026-86063) on this desk.
Noma Labs — SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data (14 Oct 2026)
OpenVPN's CNA published CVE-2026-84471 on 14 October 2026 (CVE record datePublished 14:29 UTC). The community security announcement describes a possible double-free of a TLS session buffer in the lame-duck path because the guard in check_session_buf_not_used() was incomplete, extending the earlier work on CVE-2026-13117. The CVE description (also from OpenVPN) frames it as an incomplete fix for the related CVE-2026-12996 use-after-free and says a remote authenticated peer can cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry (CWE-416). OpenVPN rates it CVSS 4.0 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H). Affected lines in the CVE record are OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7; the vendor announcement says 2.6.0–2.6.22 and 2.7_alpha1–2.7.6 are affected and lists fixed builds 2.6.23 and 2.7.7. GitHub release notes for openvpn 2.6.23 (23 September 2026) explicitly credit the improved check_session_buf_not_used() / double-free lame-duck fix as CVE-2026-84471. No public exploitation is reported. Related earlier TLS-session memory issues on the same code path include CVE-2026-12996 (fixed in 2.6.21 / 2.7.5) and CVE-2026-13117.
OpenVPN community — CVE-2026-84471 security announcement (possible double-free in check_session_buf_not_used() lame duck handling; fixed 2.6.23 / 2.7.7)
nginx.org released nginx 1.30.6 (stable) and 1.31.7 (mainline) on 14 October 2026 with fixes for five vulnerabilities, and F5 published matching advisories and CVE records the same day. The three most serious hit the NGINX data plane and are rated High 8.1 (CVSS 3.1) and Critical 9.2 (CVSS 4.0) by F5: CVE-2026-97205, a use-after-free in ngx_http_core_module when asynchronous file I/O (AIO) is on and a Server Side Includes page uses an include virtual command; CVE-2026-93479, a heap buffer overflow when map regex capture variables are evaluated in a root directive or access-log format before the map's own variable; and CVE-2026-15176, a heap buffer overflow when a location combines alias with rewrite and a set or return that references $request_filename (or $request_filename appears in a log_format). A remote unauthenticated request can crash and restart workers; F5 says code execution is possible only if ASLR is disabled or bypassed, and each bug needs a specific configuration. The same release also fixes CVE-2026-95101, HTTP/3 request body injection (F5 CVSS 5.3 / 6.9), and CVE-2026-97629, session forgery when TLS session ticket keys are rotated (6.5 / 8.3). nginx.org itself grades all five medium. NGINX Plus 37.x, NGINX Instance Manager, F5 WAF for NGINX, NGINX Gateway Fabric and some NGINX Ingress Controller releases are also affected; Plus R35 and R36 get no fix. No exploitation has been reported. Separate from the October nginx-ui card on this desk (a different project).
nginx.org — nginx security advisories (CVE-2026-15176, -93479, -95101, -97629, -97205; not vulnerable 1.31.7+, 1.30.6+; 14 Oct 2026)
Ahsay AhsayCBS Command Injection Vulnerability. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Ahsay AhsayCBS Improper Authentication Vulnerability. Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
Collabora published GHSA-g3vx-3m76-fghh on 14 October 2026 for CVE-2026-110447 in the optional Nextcloud app Collabora Online - Built-in CODE Server (package richdocumentscode). When the local CODE process is not running (restart, upgrade, or crash), an unauthenticated HTTP request can inject OS commands through proxy.php because request path text was placed inside a double-quoted bash command up to 26.4.302. Attackers used that window to plant web shells; admins reported first hits from 10 September 2026, with request markers such as %2e%2e, $(, ${IFS}, and base64 -d piped to sh. Collabora rates it Critical (CVSS 4.0 9.2), fixed the bug in 26.4.303 on 11 September, and warns that disabling the app is not enough — it must be upgraded to ≥ 26.4.303 or removed. Standalone Collabora Online servers are not affected; installs that use only the Nextcloud Office app (richdocuments) against an external Collabora server are not affected. Fixed builds need Nextcloud 30 or later; EOL Nextcloud ≤ 29 still receive an affected app-store build and should upgrade Nextcloud or remove the app. This path is separate from CVE-2025-66208 in the same script. UPDATE (24 Oct 2026): CISA added CVE-2026-110447 ('Collabora Online – Built-in CODE Server OS Command Injection Vulnerability') to its Known Exploited Vulnerabilities catalog on 23 October 2026, with a remediation due date of 26 October 2026 for US federal civilian agencies and forensic triage required. (source: CISA KEV)
Collabora GHSA-g3vx-3m76-fghh — Unauthenticated OS command injection in richdocumentscode proxy (CVE-2026-110447, 14 Oct 2026)
Cisco published cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 for CVE-2026-76519 (CWE-23) in the Advanced Malware Protection File Reputation path of Cisco Secure Email Gateway (physical and virtual). An unauthenticated remote attacker can send a crafted attachment through an affected gateway and, when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525, write arbitrary files and execute commands as root on the underlying AsyncOS host. Cisco rates it Critical (CVSS 3.1 9.8) with no workarounds, says its PSIRT became aware of active exploitation in October 2026, and notes the issue was found in internal scanning. Fixed builds include AsyncOS 15.5.5-014 and 16.5.0-780; the Content Scanner Tools package 25.3.0.5525 or later also delivers the fix without a full software upgrade or restart. Admins should check contentscannerstatus, grep system_logs for "System Security" compromise indicators, and cross-check firewall and network logs because root access can erase evidence. Secure Email and Web Manager and Secure Web Appliance are not affected. This is a separate actively exploited SEG flaw from September's CVE-2026-76461 SQL injection (already on the desk and in CISA KEV). CISA also added CVE-2026-76519 itself to the Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies. Wires on 14–15 Oct: BleepingComputer and The Hacker News.
Palo Alto Networks published CVE-2026-0322 on 14 October 2026 (16:00 UTC; 15 Oct 00:00 Perth). A code-injection flaw (CWE-94) in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code as root on the firewall. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected, and no special configuration is needed to be exposed. Palo Alto rates it HIGH with suggested urgency HIGHEST, Exploit Maturity ATTACKED, and says very limited exploitation has been observed targeting the management interface. The advisory lists three IP addresses tied to the activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234. There is no workaround; Threat Prevention Threat IDs 510046 and 510047 (content 9159-10287 and later) give only limited coverage and need management traffic routed through a data-plane interface with SSL decryption. Risk is highest where the management interface is reachable from the internet. The same 14 Oct bulletin also carries lower-rated PAN-OS, GlobalProtect app, Cortex XSOAR and Checkov fixes, listed separately on the Palo Alto advisory site. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies (BOD 26-04). Wire: The Hacker News (15 Oct).
Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface (14 Oct 2026)
Siemens ProductCERT published advisory SSA-591731 on 13 October 2026 for eight vulnerabilities (CVE-2026-63350 to CVE-2026-63357) in the web server of SIMATIC S7-1500 devices. Siemens says affected devices do not properly validate or sanitise content in imported trace files (including calculated signals in CSV trace files) before rendering it on the web server's Trace page, so an attacker could social engineer an authorised user who holds the function right 'Read diagnostics' into importing a specially crafted file; successful exploitation could let attacker-controlled JavaScript run in the user's browser session and perform PLC operations through the web server within the scope of that user's authorisation. Siemens rates three of the flaws (CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354) CVSS 3.1 9.6 / CVSS 4.0 9.4 and the other five CVSS 3.1 6.1 / CVSS 4.0 5.3. Siemens lists all versions of the affected products, including S7-1500 CPUs (with related ET 200 CPUs and SIPLUS variants), S7-1500 MFP and ODK CPUs, the S7-1500 Software Controller, ET 200SP Open Controller, SIMATIC Drive Controllers and S7-PLCSIM Advanced, and says 'Currently no fix is available' for each; it says it is preparing fixes and recommends mitigations in the meantime. Primary: Siemens ProductCERT SSA-591731 (V1.0, 13 Oct 2026). Updated 22 Oct 2026: CISA republished Siemens' advisory as ICSA-26-295-14 (8:00 pm Perth time). (source: CISA)
Siemens ProductCERT — SSA-591731: Multiple Vulnerabilities in SIMATIC S7 PLCs Web Server (13 Oct 2026, V1.0)
Adobe released security bulletin APSB26-144 for ColdFusion on 13 October 2026, its October Patch Tuesday, with 31 CVE records published the same day by Adobe as the CVE numbering authority. Three are scored 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed): CVE-2026-105899, an unrestricted upload of a dangerous file type that Adobe says could lead to arbitrary code execution; CVE-2026-106624, a code-injection flaw leading to arbitrary code execution; and CVE-2026-106622, a server-side request forgery (SSRF) flaw that could lead to privilege escalation. Two more, CVE-2026-105903 (code injection) and CVE-2026-106612 (incorrect authorisation), are scored 9.9 and need only a low-privileged account. Others in the bulletin include CVE-2026-106621 (9.1, code injection without authentication), CVE-2026-106619 (9.0, input validation, high attack complexity), CVE-2026-106620 (9.6, authorisation bypass giving write access), CVE-2026-75994 (9.6, code execution from the administrative network zone), CVE-2026-90530 (9.3, path traversal in the RDS developer feature), and a long list of 7.1 to 8.8 authorisation, SSRF, XXE and denial-of-service bugs. Adobe's CVE records list ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 as affected, fixed in 2025.0.14 and 2023.0.26. The record for CVE-2026-90530 notes that RDS is a development feature that the Production Secure Profile disables automatically. We found no reports of exploitation, and none of these CVEs is in CISA's Known Exploited Vulnerabilities catalog as of 20 October, but internet-facing ColdFusion servers have been exploited quickly after past bulletins, so treat this as urgent. Details come from Adobe's CVE records; Adobe's bulletin page refused our fetch. Primary: Adobe APSB26-144 and Adobe CVE records.
Adobe — APSB26-144 Security updates available for Adobe ColdFusion (13 Oct 2026)
Adobe's security bulletin APSB26-153, published on 13 October 2026, fixes CVE-2026-103849, a template-engine injection in Adobe Commerce and Magento Open Source that lets an unauthenticated attacker run arbitrary PHP on the store server. E-commerce security firm Sansec, which named the flaw BlockStrap (reported to Adobe by researcher vozec), said on 15 October that it reproduced four separate routes to code execution within 24 hours of the patch, although it had not yet seen attacks on live stores. BlockStrap is a second-pass directive injection: September's StyleSmuggler hotfix (CVE-2026-75650, VULN-39341) signs trusted template directives, but attacker-controlled data in a child email template can still be signed and re-scanned at the root level, where a smuggled {{block}} directive runs. Adobe's fix replaces that generic re-scan with registered placeholders. Adobe rated the bulletin priority 2 (patch within 30 days) because it reserves priority 1 for flaws it knows are exploited; Sansec disputes that, noting StyleSmuggler went from hotfix to mass exploitation in three days. A plain Composer install still pulls the vulnerable base version, so stores need the 2026-oct release or Adobe's isolated patch, and the October patch does not include the StyleSmuggler hotfix, which must stay installed separately. Public October patches cover Magento Open Source 2.4.7-p10, 2.4.8-p5 and 2.4.9; patches for 2.4.4 to 2.4.6 need an Adobe Commerce licence, so Open Source stores on 2.4.6 or older must upgrade. Mage-OS 3.6.0 (14 October) includes the fix. Primary: Adobe APSB26-153; research: Sansec (15 Oct); wire: BleepingComputer (16 Oct).
Adobe — APSB26-153 security update for Adobe Commerce and Magento Open Source (13 Oct 2026)
