Daily brief
Wednesday 14 Oct 2026
4 added to CISA's known exploited list, 4 supply chain compromises, 2 critical flaws in products attackers have targeted.
Added to CISA's known exploited list
- CVE-2026-105134 Ahsay AhsayCBS Command Injection VulnerabilityAhsay AhsayCBS · Critical 10 · CISA: check for compromise · Federal deadline 2026-10-17
- CVE-2026-105133 Ahsay AhsayCBS Improper Authentication VulnerabilityAhsay AhsayCBS · Medium 6.9 · Federal deadline 2026-10-17
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCisco Secure Email Gateway · Critical 9.8 · CISA: check for compromise · Federal deadline 2026-10-17
- CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection VulnerabilityPalo Alto Networks PAN-OS · High 8.6 · CISA: check for compromise · Federal deadline 2026-10-17 · Fixed in 12.2.4
Supply chain compromises
- Malicious release @kre64/hello-npm-test 1.0.0 on npm was a malicious release@kre64/hello-npm-test 1.0.0
- Malicious release @xxxfnbs21/hello-demo 0.1.8, 0.1.6, 0.1.5 on npm was a malicious release@xxxfnbs21/hello-demo 0.1.8, 0.1.6, 0.1.5, 0.1.3, 0.1.2, 0.1.1, 0.1.0, 0.0.0-stage
- Malicious release seapy-ops 1.0.0, 1.0.1, 1.0.2 on PyPI was a malicious releaseseapy-ops 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2
- Malicious release @flexmr/utils 1.0.0, 3.0.12, 1.0.12 on npm was a malicious release@flexmr/utils 1.0.0, 3.0.12, 1.0.12, 10.0.12, 2.0.12
Critical flaws in products attackers have targeted
- CVE-2026-59774 Gitea Org-mode file disclosure and code executionGitea Gitea · Critical 9.8 · Fixed in 1.27.1
- CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora Collabora Online – Built-in CODE Server · Critical 9.2 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 26.4.303
10-2410-2310-2210-2110-2010-1910-1810-1710-1610-1510-1410-1310-1210-11Atom feedJSON