CVEPhoto: rawpixel (CC0)Vulns & Patches_
Flaws in AI frameworks, inference servers and dev tools
CVECVECitrix discloses critical NetScaler zero-days after exploitation reports
SecurityWeek said unidentified actors began exploiting undisclosed NetScaler ADC and Gateway flaws in mid-September 2026; Dark Reading reported Citrix disclosed two critical NetScaler zero-days on Sep 27.
CVERCEPTC Windchill and FlexPLM flaw could enable remote code execution
PTC released patches for critical CVE-2026-126325 in Windchill and FlexPLM, which could let unauthorized users execute code remotely.
CVERCEN-able takes hosted N-central offline after researcher discloses flaws
N-able took hosted N-central environments offline after Sean Bales disclosed multiple vulnerabilities with proof-of-concept exploits.
CVERCEN-able takes hosted N-central offline after alleged zero-days disclosed
N-able took hosted N-central offline after a researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, BleepingComputer reported.
CVEPATCHZoom Workplace for Windows flaw could enable privilege escalation
Zoom released updates for two Windows flaws, including an improper input validation bug that could let unauthenticated users escalate privileges through network access.
CVECVEAhsayCBS flaws exploited to deploy web shells and miners
An impacted organization's servers were exploited between Oct 8 and Oct 11, 2026, before Ahsay released hotfixes. Huntress disclosed the findings on Nov 9, 2026.
CVEPATCHMicrosoft fixed 1,093 Windows and software vulnerabilities
Microsoft released updates for 1,093 vulnerabilities across Windows and supported software, including 63 critical flaws and an Outlook zero-day.
CVECHROMEGoogle Chrome update fixes nine flaws as CVE-2026-125350 is exploited
Google released Chrome updates fixing nine vulnerabilities, including CVE-2026-125350, which is being exploited in the wild. The Hacker News said an anonymous researcher reported the flaw on Nov 6.
CVERCESGLang flaw exploited to access NEAR AI infrastructure
An attacker used an SGLang remote-code-execution flaw to reach NEAR AI infrastructure, and NEAR AI said the attacker downloaded account details for approximately 100 users. NEAR AI published its report on Nov 9.
CVEPATCHGoogle Android October updates fix 25 vulnerabilities
Google’s Android updates resolve 25 Framework and System vulnerabilities, including seven critical-severity bugs. Google announced the fixes this week.
CVECVEMicrosoft Paint fix for CVE-2026-83844 available in Store, not Windows Update
Microsoft made Paint build 11.2609.401.0 available in the Store for a remote code execution flaw, The Hacker News reported. getrff.com published its report on Nov 4.
CVEJAVAOracle Java flaw could let attackers bypass restrictions and manipulate data
Oracle Java vulnerabilities could let remote attackers bypass security restrictions and manipulate data. HKCERT disclosed the issue on Oct 22, 2026.
CVEMFASonicWall patched CVE-2026-19868 SAML authentication-bypass flaw
SonicWall patched a SonicOS SSL VPN flaw that can bypass SAML authentication and may have been exploited in attacks, SecurityWeek said. Ryan Harris of The Electronic Office reported it.
CVECVEZyxel GS1900 switch flaw could let attackers run OS commands
Zyxel released Patch 3 for 10 GS1900 switch models; the flaw could let unauthenticated LAN attackers run OS commands, Zyxel said. The Hacker News said the firmware was posted on Oct 23.
CVEAISECOpenAI unveils GPT-6 Cyber for authorized vulnerability research
OpenAI unveiled GPT-6 Cyber as a more capable security model with stronger limits on authorized testing, the company said.
CVEAISECOpenAI cyber AI model generated 948 Linux root exploits
OpenAI said an upcoming cyber-focused AI model produced 948 Linux privilege-escalation exploits in a mid-October run. The Indian Express reported the disclosure on Nov 4.
CVEBTCBTCPay Server hot wallets had Bitcoin and Litecoin stolen
BTCPay Server received reports of Bitcoin and Litecoin being stolen from hot wallets on Nov 1, targeting servers on version 2.4.1 or earlier.
CVERCEGoogle Android flaw CVE-2026-58868 could enable remote code execution
Google patched CVE-2026-58868, a critical Android Framework flaw that could enable remote code execution without user interaction on Android 14 through 17.
CVENASSynology DSM flaw exploited to encrypt data and extort ransom
Threat actors are exploiting a flaw fixed in December 2024 against outdated Synology DSM devices, the vendor said on Oct 29, 2026. Synology said the attacks aim to encrypt data and extort ransom.
CVERCESupermarket refrigeration systems across Europe disrupted by cyberattacks
More than 50 stores in Belgium and over a dozen elsewhere were affected, The Record reported.
CVERCEWordPress Core flaw targeted after 7.1.4 release
Attackers attempted to exploit a WordPress Core remote code execution flaw affecting versions 4.7 through 7.1.3 after the Oct 28, 2026, patch release. The Hacker News disclosed the activity.
CVECVETeamViewer flaw could let remote hosts crash viewer, possibly run code
A TeamViewer flaw could let a malicious remote host crash the viewer and potentially run code on a technician’s machine. Remedio researcher Omri Dar disclosed the findings on Oct 29.
CVECVEAndroid SMS of Death flaw could crash phones and force reboots
Cybernews said Android’s SMS of Death vulnerability can crash calls, brick phones and force resets on Android 12 through 16. HKCERT published its report on Oct 30, 2026.
CVECHATGPTOpenAI fixed ChatGPT sandbox-escape chain that could take over accounts
OpenAI fixed a ChatGPT chain that could let attackers take over accounts by sending a link. Parameter Labs disclosed it on Oct 28.
CVECHATGPTChatGPT share-link flaw could run code in logged-in sessions
A malicious ChatGPT share link could let attackers read private conversations and act through a victim’s account. Parameter reported the flaw to OpenAI on Oct 18 and published details on Oct 28.
CVECVECisco Catalyst SD-WAN flaw exploited to deploy KeyDrift malware
UAT-11473 exploited CVE-2026-20127 to deploy KeyDrift on Cisco Catalyst SD-WAN Controllers. BleepingComputer disclosed the activity on Oct 28, 2026.
CVEFBIFBI seized Virtualine domain in international operation
The FBI seized Virtualine’s domain on Oct 27, disrupting access to a bulletproof hosting service. TRM Labs disclosed its findings on Oct 28.
CVECVELinux kernel flaw could let remote attackers run commands as root
CVE-2026-98432 affects Ubuntu, RHEL and other Linux distributions, The Hacker News reported. Anthropic said its model wrote an exploit, while the kernel CVE team rated it 9.8.
CVERCERuby releases Onigmo fixes for GitLab remote-code-execution flaws
Ruby released three versions fixing Onigmo bugs that GitLab found could enable remote code execution on GitLab servers. The releases contain all of the fixes.
CVECVELumen: Volt Typhoon exploited four confirmed zero-days via Silent Train network
Lumen said its monitoring helped uncover at least four confirmed and one likely zero-day vulnerabilities that Volt Typhoon exploited.