Daily brief
Tuesday 13 Oct 2026
2 added to CISA's known exploited list, 1 reported exploited and not on CISA's list, 7 supply chain compromises, 8 critical flaws in products attackers have targeted.
Added to CISA's known exploited list
- CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityIvanti Connect Secure · High 8.6 · CISA: check for compromise · Federal deadline 2026-10-16
- CVE-2026-96951 Microsoft Windows Command Injection VulnerabilityMicrosoft Windows · High 8.8 · CISA: check for compromise · Federal deadline 2026-10-16 · Fixed in 20260925.100
Reported exploited, not on CISA's list yet
- CVE-2026-108398 .NET Framework Security Feature Bypass VulnerabilityMicrosoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · High 8.8 · Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 · Zero-day reported by 3 outlets, first by Krebs on Security
Supply chain compromises
- Malicious release brass-common 99.9.1 on npm was a malicious releasebrass-common 99.9.1
- Malicious release yoodan-github-single-ver-pkg 1.0.1 on npm was a malicious releaseyoodan-github-single-ver-pkg 1.0.1
- Malicious release sysdiagd 1.2.1, 1.2.2, 1.2.3 on PyPI was a malicious releasesysdiagd 1.2.1, 1.2.2, 1.2.3
- Malicious release fontcase 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious releasefontcase 0.1.0, 0.1.1, 0.1.2
- Malicious release crelic-bqwheel-52f66a3f1d 0.0.1 on PyPI was a malicious releasecrelic-bqwheel-52f66a3f1d 0.0.1
- Malicious release @accenturecodefoundry/mfe-pot-shared-ui-scds-core 99.99.2, 99.99.4, 99.99.41 on npm was a malicious release@accenturecodefoundry/mfe-pot-shared-ui-scds-core 99.99.2, 99.99.4, 99.99.41, 99.99.43
- Malicious release @flexmr/ui 99.99.99 on npm was a malicious release@flexmr/ui 99.99.99
Critical flaws in products attackers have targeted
- CVE-2026-97229 Integer Overflow or Wraparound in GitLabGitLab GitLab · Critical 10 · Fixed in 19.2.8
- CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium seGoogle Chrome · Critical 9.6 · Fixed in 155.0.8059.79
- CVE-2026-109750 Firefox: Site isolation issue in the DOM: Web Authentication componentMozilla Firefox · Critical 9.6
- CVE-2026-109745 Firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial componentMozilla Firefox · Critical 9.6
- CVE-2026-109740 Firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 componentMozilla Firefox · Critical 9.6
- CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: CritGoogle Chrome · Critical 9.6 · Fixed in 155.0.8059.79
- CVE-2026-109755 Firefox: Sandbox escape in the DOM: Content Processes componentMozilla Firefox · Critical 9.6
- CVE-2026-110136 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)Google Chrome · Critical 9.6 · Fixed in 155.0.8059.79
10-2410-2310-2210-2110-2010-1910-1810-1710-1610-1510-1410-1310-1210-11Atom feedJSON