TL;DR The Apache Karaf project has fixed four Apache Karaf vulnerabilities in version 4.4.12. Two are rated important and two moderate. Each lets a user with a low-privilege role, such as “v…

TL;DR Octopus Deploy has fixed a high-severity Octopus Server vulnerability, CVE-2026-101169. An authenticated user who can edit an Environment or Project can run arbitrary code in the server proc…

TL;DR CISA published advisory ICSA-26-272-06 on September 29, 2026, for a critical MikroTik RouterOS vulnerability, CVE-2026-84411. A single crafted HTTP request can give an unauthenticated attack…

TL;DR A JupyterLab Desktop vulnerability, CVE-2026-102530, rated CVSS 9.4, lets a malicious server URL run code on a user’s computer. The app displayed remote server URLs without sanitizing …

TL;DR HPE Networking disclosed 18 HPE Instant ON vulnerabilities on September 29, 2026, in its Instant ON access points. Five are rated Critical, and the two worst score CVSS 9.8 with unauthentica…

TL;DR WatchGuard disclosed 14 Fireware OS vulnerabilities on September 29, 2026, affecting its Firebox firewalls. The worst, CVE-2026-86131, scores CVSS 9.2 and allows remote code execution in cer…

TL;DR Technical details and a working proof-of-concept exploit are now public for CVE-2026-94545, a critical Next.js RCE in the next/og image API. One unauthenticated request can run commands on t…

TL;DR OpenBao maintainers issued security updates to address two critical flaws in the secrets management platform. These OpenBao security vulnerabilities allow attackers to execute arbitrary code…

TL;DR GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970. The GitLab AI Gateway vulnerability scores 9.9 on CVSS 3.1. It lets a logged-in Duo Agent Platform user …

TL;DR The Apache Software Foundation disclosed eight CVEs on October 2, 2026, across three projects. The most urgent is an Apache OpenOffice vulnerability, CVE-2026-59265, that runs attacker code …