TL;DR CERT/CC published a note on October 12, 2026, listing 11 Thelia vulnerabilities in the open-source e-commerce platform. Seven of them can lead to remote code execution by an authenticated ba…

TL;DR IBM published fixes for three IBM critical vulnerabilities rated between CVSS 9.8 and 9.9. The flaws hit IBM i, Db2 Mirror for i and Maximo AI Service. One of them allows remote code executi…

TL;DR Artifex released Ghostscript 10.08.0 on September 8, 2026, fixing a critical heap buffer overflow rated CVSS 9.8. Wordfence found the Ghostscript vulnerability and turned a crafted PDF into …

TL;DR Wazuh 4.14.8 fixes 15 security flaws in the open-source SIEM and XDR platform. Two of these Wazuh vulnerabilities score 9.4 on CVSS 4.0 and can lead to remote code execution as root. Several…

TL;DR CERT/CC disclosed CVE-2026-104937 on October 13, 2026, a stored XSS flaw in Shopware 6.7. The Shopware vulnerability can lead to stolen admin tokens and remote code execution. No patch exist…

TL;DR NVIDIA released six security bulletins on October 13, 2026, fixing 18 flaws in its AI software stack. Eight are NVIDIA AIStore vulnerabilities, including CVE-2026-65162, a maximum-severity C…

TL;DR Microsoft released an October Patch Tuesday update to fix CVE-2026-103572, an Important remote code execution flaw in Visual Studio Copilot. Furthermore, security researcher Johann Rehberger…

TL;DR SuiteCRM published eight security advisories on October 12, 2026, fixing flaws in versions 7 and 8 of the open-source CRM. The worst of these SuiteCRM vulnerabilities, CVE-2026-100358, enabl…

GitLab Patches a Maximum-Severity Flaw GitLab has fixed a critical vulnerability that, under certain conditions, lets attackers run arbitrary code on a server. They need no password and no user in…

TL;DR GitLab patched CVE-2026-97229, a maximum-severity (CVSS 10.0) integer overflow flaw in its CI/CD regular expression compiler. Shortly after the patch, Rapid7 researchers publicly disclosed t…