https://patchherald.com/c/vulnerabilities/four-plex-media-server-flaws-added-to-federal-kev/Patch Heralden2026-10-20T23:39:49ZFour Plex Media Server Flaws Added to Federal KEV Cataloghttps://patchherald.com/c/vulnerabilities/cve-2026-106931-active-siteguard-command/Patch Heralden2026-10-20T23:17:02ZCVE-2026-106931: Active SiteGuard Command Injection Grants Root Access, Patch Nowhttps://patchherald.com/c/vulnerabilities/aws-kiro-crew-9-9-flaw-lets-whatsapp-users-run/Patch Heralden2026-10-20T21:20:41ZAWS Kiro Crew 9.9 Flaw Lets WhatsApp Users Run Commandshttps://patchherald.com/c/vulnerabilities/high-risk-flaw-in-model-context-protocol-server/Patch Heralden2026-10-20T20:18:48ZHigh-risk flaw in Model Context Protocol server exposes client datahttps://patchherald.com/c/vulnerabilities/wavlink-wl-wn530be1-a-unauthenticated-root/Patch Heralden2026-10-20T19:00:25ZWavlink WL-WN530BE1-A: Unauthenticated Root Command Execution Flaw Lacks Vendor Patchhttps://patchherald.com/c/vulnerabilities/patch-available-for-high-severity-credential-leak/Patch Heralden2026-10-20T18:08:57ZPatch available for high-severity credential leak in npm follow-redirectshttps://patchherald.com/c/vulnerabilities/froxlor-9-4-critical-flaw-lets-users-steal-root/Patch Heralden2026-10-20T17:34:10ZFroxlor 9.4 Critical Flaw Lets Users Steal Root Ownershiphttps://patchherald.com/c/vulnerabilities/patch-apache-couchdb-3-5-3-fixes-authenticated/Patch Heralden2026-10-20T17:32:56ZPatch Apache CouchDB 3.5.3 Fixes Authenticated Denial of Service Flawhttps://patchherald.com/c/vulnerabilities/cve-2026-113703-suggestarr-3-0-0-header-spoofing/Patch Heralden2026-10-20T17:17:44ZCVE-2026-113703: SuggestArr <3.0.0 Header Spoofing Grants Admin Rights Without Credentialshttps://patchherald.com/c/vulnerabilities/critical-cve-2026-106173-patched-fortinet/Patch Heralden2026-10-20T16:56:16ZCritical CVE-2026-106173 Patched: Fortinet FortiSIEM Users Must Update Now to Block Unauthenticated RCE via gRPChttps://patchherald.com/c/vulnerabilities/cve-2026-113391-draytek-vigor2960-patch-fixes/Patch Heralden2026-10-20T14:06:25ZCVE-2026-113391: DrayTek Vigor2960 Patch Fixes Critical RCE Flaw (CVSS 9.4)https://patchherald.com/c/vulnerabilities/booz-allen-tests-show-ai-models-can-move/Patch Heralden2026-10-20T13:33:26ZBooz Allen Tests Show AI Models Can Move Industrial Robots in 16 Minuteshttps://patchherald.com/c/vulnerabilities/critical-command-injection-flaw-found-in/Patch Heralden2026-10-20T13:03:05ZCritical Command Injection Flaw Found in Unsupported DrayTek Vigor2960 Firmwarehttps://patchherald.com/c/vulnerabilities/cvss-9-9-red-hat-strimzi-console-vulnerability/Patch Heralden2026-10-20T11:50:00ZCVSS 9.9: Red Hat Strimzi Console Vulnerability Grants Cluster-Wide Access to Attackershttps://patchherald.com/c/vulnerabilities/unblu-spark-critical-flaw-cve-2026-9589-affects/Patch Heralden2026-10-20T11:33:04ZUnblu Spark Critical Flaw CVE-2026-9589 Affects Versions Before 8.37.0https://patchherald.com/c/vulnerabilities/critical-auth-bypass-in-advantech-adam-3600-prior/Patch Heralden2026-10-20T09:13:33ZCritical Auth Bypass in Advantech ADAM-3600 Prior to 2.8.5.0https://patchherald.com/c/vulnerabilities/0-8-2-db-gpt-hardcoded-mysql-root-passwords-grant/Patch Heralden2026-10-20T01:28:48Z0.8.2 DB-GPT: Hardcoded MySQL Root Passwords Grant Attackers Super Privileges via Open Port 3306https://patchherald.com/c/vulnerabilities/4-flaws-chained-in-wild-attacks-on-unpatched-plex/Patch Heralden2026-10-19T23:39:38Z4 Flaws Chained in Wild Attacks on Unpatched Plex Servers Install Cryptominers and Proxy Softwarehttps://patchherald.com/c/vulnerabilities/craft-cms-critical-flaw-lets-tokens-alter-multi/Patch Heralden2026-10-19T22:30:58ZCraft CMS Critical Flaw Lets Tokens Alter Multi-Site Contenthttps://patchherald.com/c/vulnerabilities/15-flaws-in-cpanel-json-xs-perl-module-affect/Patch Heralden2026-10-19T19:03:28Z15 flaws in Cpanel::JSON::XS Perl module affect versions before 4.80https://patchherald.com/c/vulnerabilities/cve-2026-86467-apache-airflow-amazon-provider/Patch Heralden2026-10-19T18:16:57ZCVE-2026-86467: Apache Airflow Amazon provider SAML flaw allows account hijackhttps://patchherald.com/c/vulnerabilities/3-eptura-archibus-flaws-fixed-critical-rce-and/Patch Heralden2026-10-19T17:02:43Z3 Eptura Archibus Flaws Fixed: Critical RCE and Auth Bypass Discovered by Rapid7https://patchherald.com/c/vulnerabilities/crewai-tools-1-15-28-has-high-severity-ssrf-flaw/Patch Heralden2026-10-19T16:47:15Zcrewai-tools 1.15.28 Has High-Severity SSRF Flaw in Selenium Toolhttps://patchherald.com/c/vulnerabilities/high-severity-php-injection-flaw-affects-sqlparse/Patch Heralden2026-10-19T16:26:18ZHigh-Severity PHP Injection Flaw Affects sqlparse Library Through Version 0.6.0https://patchherald.com/c/vulnerabilities/cvss-8-7-flaw-in-picomatch-through-4-0-7-blocks/Patch Heralden2026-10-19T16:08:57ZCVSS 8.7 Flaw in Picomatch Through 4.0.7 Blocks Node.js Event Loopshttps://patchherald.com/c/vulnerabilities/apache-camel-8-2-cvss-ssrf-patch-fixes-as2/Patch Heralden2026-10-19T10:55:21ZApache Camel 8.2 CVSS SSRF Patch Fixes AS2 Componenthttps://patchherald.com/c/vulnerabilities/cve-2026-81376-9-6-score-vs-code-flaw-in-versions/Patch Heralden2026-10-19T08:35:07ZCVE-2026-81376: 9.6-score VS Code flaw in versions before 1.136.2 allows trust bypass via user interactionhttps://patchherald.com/c/cloud-security/3-connectwise-services-offline-oct-18-cloud/Patch Heralden2026-10-19T05:57:23Z3 ConnectWise Services Offline Oct 18: Cloud Backup, SaaS Security, Cloud Management Suspended