Vulnerability news

Today's write-ups

• CISA KEVOct 14, 2026

  Windows Shell Security Feature Bypass Vulnerability

  CVE-2026-96951

  75EVRS

  Urgent CISA KEVEPSS 74th percentile

  A command injection flaw in Windows Shell lets attackers bypass Mark of the Web protections using a crafted file sent by email or instant message, and it is being exploited in the wild.

  Affected: Windows 10, Windows 11 and Windows Server 2012 R2 through 2025.

  Fix: Install the October cumulative update and reboot.

  CISA entry ↗NVD entry ↗

  Updated Oct 14, 2026. Changed: Reformatted into summary, affected systems and fix.

  AI-written summary, Oct 14, 2026 Confirm details in the vendor advisory before acting. Source: CISA KEV

All headlines

• LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

  GitHub · CC BY 4.0 · Oct 16, 2026 · GHSA-w5f2-9q9c-ff4h

• kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

  GitHub · CC BY 4.0 · Oct 16, 2026 · GHSA-74vm-87hj-r66f

• lopdf has a stack overflow via deeply nested PDF objects

  GitHub · CC BY 4.0 · Oct 16, 2026 · GHSA-6fj4-rcr3-r7rr

• JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

  GitHub · CC BY 4.0 · Oct 16, 2026 · GHSA-rxjv-24xq-76wc

• Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

  GitHub · CC BY 4.0 · Oct 16, 2026 · GHSA-h4mw-j7qp-8mwm

• gomarkdown/markdown IsSafeURL panics on short URLs

  GitHub · CC BY 4.0 · Oct 16, 2026 · GHSA-cv23-7vc5-jfh7

• freerdp: freerdp: Arbitrary code execution via crafted display frames

  Red Hat · CC BY 4.0 · Oct 16, 2026 · CVE-2026-111382

• freerdp: freerdp: Arbitrary code execution via crafted persistent cache file

  Red Hat · CC BY 4.0 · Oct 16, 2026 · CVE-2026-111381

• freerdp: FreeRDP: Arbitrary code execution via integer overflow in audio input buffer calculation

  Red Hat · CC BY 4.0 · Oct 16, 2026 · CVE-2026-111380

• freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file

  Red Hat · CC BY 4.0 · Oct 16, 2026 · CVE-2026-111379

• freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser

  Red Hat · CC BY 4.0 · Oct 16, 2026 · CVE-2026-111378

• chromium-browser: chromium-browser: Use after free in Compositing

  Red Hat · CC BY 4.0 · Oct 15, 2026 · CVE-2026-110915

• chromium-browser: chromium-browser: Use after free in V8

  Red Hat · CC BY 4.0 · Oct 15, 2026 · CVE-2026-110919

• dotnet: ASP.NET Core: Denial of Service via unthrottled resource allocation

  Red Hat · CC BY 4.0 · Oct 15, 2026 · CVE-2026-109468

• TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

  GitHub · CC BY 4.0 · Oct 15, 2026 · GHSA-qx66-fv34-fjm8

• Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

  GitHub · CC BY 4.0 · Oct 15, 2026 · GHSA-2cvf-wqm6-wr9g

• 2026-017: Critical Vulnerability in Cisco Secure Email Gateway

  CERT-EU · CC BY 4.0 · Oct 15, 2026

• Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

  CISA · Oct 15, 2026 · CVE-2026-21589

• Ahsay AhsayCBS Command Injection Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-105134

• Cisco Secure Email Gateway Relative Path Traversal Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-76519

• Ahsay AhsayCBS Improper Authentication Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-105133

• Palo Alto Networks PAN-OS Code Injection Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-0322

• October 2026 Security Updates

  Microsoft · Oct 13, 2026

• Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

  CISA · Oct 13, 2026 · CVE-2026-104935

• Microsoft Windows Command Injection Vulnerability

  CISA · Oct 13, 2026 · CVE-2026-96951

• 2026-016: Critical Vulnerability in GitLab CE and EE

  CERT-EU · CC BY 4.0 · Oct 12, 2026

• CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide

  CISA · Oct 8, 2026

• 2026-015: Critical Vulnerability in Multiple Atlassian Products

  CERT-EU · CC BY 4.0 · Oct 7, 2026

• 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

  CERT-EU · CC BY 4.0 · Sep 27, 2026

• 2026-013: Critical Vulnerability in F5 BIG-IP APM

  CERT-EU · CC BY 4.0 · Sep 22, 2026

Newest 30 headlines across all sources, at most 8 from each. List updated Oct 16, 2026, 20:58 UTC.