https://patchherald.com/c/vulnerabilities/smilecdr-hapi-fhir-vulnerability-cvss-8-1-allows/Patch Heralden2026-10-22T18:11:09ZSmileCDR HAPI FHIR Vulnerability CVSS 8.1 Allows Cross-Tenant Data Accesshttps://patchherald.com/c/vulnerabilities/cve-2026-108359-phpspreadsheet-patch-fixes-high/Patch Heralden2026-10-22T17:55:50ZCVE-2026-108359: PhpSpreadsheet Patch Fixes High-Severity Memory Exhaustion Riskhttps://patchherald.com/c/vulnerabilities/cvss-8-7-youdatasum-cpas-v4-has-unauthenticated/Patch Heralden2026-10-22T12:03:12ZCVSS 8.7: YouDataSum CPAS V4 Has Unauthenticated Path Traversal Flawhttps://patchherald.com/c/vulnerabilities/elated-themes-academist-core-vulnerability/Patch Heralden2026-10-22T10:33:18ZElated-Themes Academist Core Vulnerability Affects Versions Up To 1.4.1https://patchherald.com/c/vulnerabilities/critical-image-flaw-in-roundcube-webmail-requires/Patch Heralden2026-10-22T02:21:16ZCritical Image Flaw in Roundcube Webmail Requires Immediate Patchinghttps://patchherald.com/c/vulnerabilities/8-7-cvss-grav-login-plugin-flaw-lets-authors-grab/Patch Heralden2026-10-22T02:12:17Z8.7 CVSS: Grav Login Plugin Flaw Lets Authors Grab Super User Accesshttps://patchherald.com/c/vulnerabilities/vyper-0-5-0b1-flaw-allows-input-corruption-in/Patch Heralden2026-10-22T02:09:41ZVyper 0.5.0b1 Flaw Allows Input Corruption in Smart Contractshttps://patchherald.com/c/vulnerabilities/cve-2026-114055-vllm-0-31-0-patches-critical/Patch Heralden2026-10-21T23:40:52ZCVE-2026-114055: vLLM 0.31.0 Patches Critical Memory Exhaustion Risk in Multimodal Modelshttps://patchherald.com/c/vulnerabilities/trigger-dev-cve-2026-114069-exposes-root-keys-in/Patch Heralden2026-10-21T23:36:16ZTrigger.dev CVE-2026-114069 Exposes Root Keys in Versions Before 4.6.0https://patchherald.com/c/vulnerabilities/cvss-8-6-trigger-dev-before-4-5-0-rc-3-has/Patch Heralden2026-10-21T23:20:09ZCVSS 8.6: Trigger.dev Before 4.5.0-rc.3 Has Authenticated Path Traversal Flawhttps://patchherald.com/c/vulnerabilities/cve-2026-114089-trigger-dev-users-urged-to-update/Patch Heralden2026-10-21T23:03:49ZCVE-2026-114089: Trigger.dev Users Urged to Update to 4.5.2 to Stop CSRF-Based Account Hijackinghttps://patchherald.com/c/vulnerabilities/cve-2026-114107-hkuds-vibe-trading-0-1-7/Patch Heralden2026-10-21T22:21:48ZCVE-2026-114107: HKUDS Vibe-Trading <0.1.7 vulnerable to remote root command execution via prompt injectionhttps://patchherald.com/c/vulnerabilities/trudesk-1-2-11-flaw-lets-hackers-wipe-data/Patch Heralden2026-10-21T20:06:02ZTrudesk 1.2.11 Flaw Lets Hackers Wipe Data Without Loginhttps://patchherald.com/c/vulnerabilities/high-severity-cve-2026-111805-fixes-available-for/Patch Heralden2026-10-21T19:27:47ZHigh-Severity CVE-2026-111805 Fixes Available for Apache Traffic Serverhttps://patchherald.com/c/vulnerabilities/vaadin-framework-8-32-2-fixes-high-severity/Patch Heralden2026-10-21T18:31:28ZVaadin Framework 8.32.2 Fixes High-Severity Denial of Service Flawhttps://patchherald.com/c/vulnerabilities/virtualenv-21-14-4-fixes-high-severity-command/Patch Heralden2026-10-21T17:58:49Zvirtualenv 21.14.4 Fixes High-Severity Command Injection Flaw for Zsh Usershttps://patchherald.com/c/vulnerabilities/90-of-ai-skills-evade-scanners-creating-blind/Patch Heralden2026-10-21T10:28:28Z90% of AI Skills Evade Scanners, Creating Blind Spots for Credential Theft in JFrog Studyhttps://patchherald.com/c/vulnerabilities/f5-patches-fix-three-critical-nginx-flaws-in-plus/Patch Heralden2026-10-21T09:58:30ZF5 Patches Fix Three Critical NGINX Flaws in Plus and Open Sourcehttps://patchherald.com/c/vulnerabilities/2026-10-19-update-fixes-revoked-emsign-root-in/Patch Heralden2026-10-21T08:31:59Z2026.10.19 Update Fixes Revoked emSign Root in certifi and uv to Block MITMhttps://patchherald.com/c/vulnerabilities/cve-in-argo-cd-2-1-3-6-0-helm-plugin/Patch Heralden2026-10-21T07:46:19ZCVE in Argo CD 2.1-3.6.0: Helm Plugin Vulnerability Allows RCE With Minimal Permissionshttps://patchherald.com/c/vulnerabilities/9-8-cvss-ibm-app-connect-enterprise-13-0-8-2-lets/Patch Heralden2026-10-21T06:58:19Z9.8 CVSS: IBM App Connect Enterprise 13.0.8.2 Lets Attackers Steal Data via Unrestricted Bindinghttps://patchherald.com/c/vulnerabilities/php-patches-two-unconfirmed-9-2-rce-flaws-in-oct/Patch Heralden2026-10-21T06:12:34ZPHP Patches Two Unconfirmed 9.2 RCE Flaws in Oct 21 Update for 8.2-8.5 Brancheshttps://patchherald.com/c/vulnerabilities/two-critical-php-flaws-rated-9-2-get-fix-on/Patch Heralden2026-10-21T04:05:29ZTwo Critical PHP Flaws Rated 9.2 Get Fix on October 21https://patchherald.com/c/vulnerabilities/9-2-cvss-rce-flaws-in-php-5-8-force-urgent/Patch Heralden2026-10-21T02:46:49Z9.2-CVSS RCE flaws in PHP 5-8 force urgent patching before Oct 21 leak deadlinehttps://patchherald.com/c/vulnerabilities/four-plex-media-server-flaws-added-to-federal-kev/Patch Heralden2026-10-20T23:39:49ZFour Plex Media Server Flaws Added to Federal KEV Cataloghttps://patchherald.com/c/vulnerabilities/cve-2026-106931-active-siteguard-command/Patch Heralden2026-10-20T23:17:02ZCVE-2026-106931: Active SiteGuard Command Injection Grants Root Access, Patch Nowhttps://patchherald.com/c/vulnerabilities/aws-kiro-crew-9-9-flaw-lets-whatsapp-users-run/Patch Heralden2026-10-20T21:20:41ZAWS Kiro Crew 9.9 Flaw Lets WhatsApp Users Run Commandshttps://patchherald.com/c/vulnerabilities/high-risk-flaw-in-model-context-protocol-server/Patch Heralden2026-10-20T20:18:48ZHigh-risk flaw in Model Context Protocol server exposes client datahttps://patchherald.com/c/vulnerabilities/wavlink-wl-wn530be1-a-unauthenticated-root/Patch Heralden2026-10-20T19:00:25ZWavlink WL-WN530BE1-A: Unauthenticated Root Command Execution Flaw Lacks Vendor Patch