Vulnerability news

Today's write-ups

• CISA KEVOct 14, 2026

  Windows Shell Security Feature Bypass Vulnerability

  CVE-2026-96951

  75EVRS

  Urgent CISA KEVEPSS 74.1st percentile

  A command injection flaw in Windows Shell lets attackers bypass Mark of the Web protections using a crafted file sent by email or instant message, and it is being exploited in the wild.

  Affected: Windows 10, Windows 11 and Windows Server 2012 R2 through 2025.

  Fix: Install the October cumulative update and reboot.

  CISA entry ↗NVD entry ↗

  Updated Oct 14, 2026. Changed: Reformatted into summary, affected systems and fix.

  AI-written summary, Oct 14, 2026 Confirm details in the vendor advisory before acting. Source: CISA KEV

All headlines

• MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-22jm-h49p-29qw

• ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-qhcq-9pm2-c9w9

• ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-j5rq-xfvr-p969

• follow-redirects array-form headers bypass cross-origin credential stripping

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-q3jh-wrc6-jgq8

• follow-redirects sensitiveHeaders regex escaping can expose credential headers

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-8r9p-f939-6h3c

• @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-57xq-rjx2-v5xh

• @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-62vg-58rm-qff7

• markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

  GitHub · CC BY 4.0 · Oct 20, 2026 · GHSA-r7fv-28h4-cvq7

• ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8

  Red Hat · CC BY 4.0 · Oct 20, 2026 · CVE-2026-112177

• webkitgtk: WebKitGTK: Arbitrary code execution via type confusion

  Red Hat · CC BY 4.0 · Oct 20, 2026 · CVE-2026-86922

• pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding

  Red Hat · CC BY 4.0 · Oct 19, 2026 · CVE-2026-112897

• pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder

  Red Hat · CC BY 4.0 · Oct 19, 2026 · CVE-2026-112896

• pillow: pillow: Denial of service via crafted PDF during append operations

  Red Hat · CC BY 4.0 · Oct 19, 2026 · CVE-2026-112895

• pillow: pillow: Denial of Service via crafted multi-frame image conversion

  Red Hat · CC BY 4.0 · Oct 19, 2026 · CVE-2026-112894

• pillow: Pillow: Denial of Service via invalid pointer free during font rendering

  Red Hat · CC BY 4.0 · Oct 19, 2026 · CVE-2026-112893

• pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()

  Red Hat · CC BY 4.0 · Oct 19, 2026 · CVE-2026-112405

• BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

  CISA · Oct 16, 2026 · CVE-2026-102764

• Fortinet Multiple Products Path Traversal Vulnerability

  CISA · Oct 16, 2026 · CVE-2025-61624

• 2026-017: Critical Vulnerability in Cisco Secure Email Gateway

  CERT-EU · CC BY 4.0 · Oct 15, 2026

• Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

  CISA · Oct 15, 2026 · CVE-2026-21589

• Ahsay AhsayCBS Command Injection Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-105134

• Cisco Secure Email Gateway Relative Path Traversal Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-76519

• Ahsay AhsayCBS Improper Authentication Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-105133

• Palo Alto Networks PAN-OS Code Injection Vulnerability

  CISA · Oct 14, 2026 · CVE-2026-0322

• October 2026 Security Updates

  Microsoft · Oct 13, 2026

• Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

  CISA · Oct 13, 2026 · CVE-2026-104935

• 2026-016: Critical Vulnerability in GitLab CE and EE

  CERT-EU · CC BY 4.0 · Oct 12, 2026

• 2026-015: Critical Vulnerability in Multiple Atlassian Products

  CERT-EU · CC BY 4.0 · Oct 7, 2026

• 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

  CERT-EU · CC BY 4.0 · Sep 27, 2026

• 2026-013: Critical Vulnerability in F5 BIG-IP APM

  CERT-EU · CC BY 4.0 · Sep 22, 2026

Newest 30 headlines across all sources, at most 8 from each. List updated Oct 20, 2026, 17:32 UTC.