https://patchgazette.com/news/vulnerabilities/cve-2026-28763-authenticated-http-attack-enables/Patch Gazetteen2026-10-20T22:08:13ZCVE-2026-28763: Authenticated HTTP Attack Enables RCE on Specific Totolink X2000R Firmwarehttps://patchgazette.com/news/vulnerabilities/totolink-x2000r-firmware-flaw-cvss-9-1-lets/Patch Gazetteen2026-10-20T21:42:56ZTotolink X2000R Firmware Flaw CVSS 9.1 Lets Authenticated Users Run Arbitrary Codehttps://patchgazette.com/news/vulnerabilities/cve-2026-35499-totolink-x2000r-router-cvss-9-1/Patch Gazetteen2026-10-20T21:40:41ZCVE-2026-35499: Totolink X2000R Router CVSS 9.1 Flaw Allows Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/apache-fixes-tomcat-jndi-flaw-allowing-password/Patch Gazetteen2026-10-20T20:07:20ZApache fixes Tomcat JNDI flaw allowing password-free access in versions 7.0 through 11.0https://patchgazette.com/news/vulnerabilities/aapanel-8-25-0-has-remote-code-injection-flaw/Patch Gazetteen2026-10-20T19:07:29ZaaPanel 8.25.0 Has Remote Code Injection Flaw Requiring Loginhttps://patchgazette.com/news/vulnerabilities/wavlink-wl-wn530be1-a-firmware-has-critical/Patch Gazetteen2026-10-20T19:00:25ZWavlink WL-WN530BE1-A Firmware Has Critical Remote Code Execution Flawhttps://patchgazette.com/news/vulnerabilities/apostrophe-cms-patch-fixes-disk-exhaustion-flaw/Patch Gazetteen2026-10-20T18:27:07ZApostrophe CMS patch fixes disk exhaustion flaw in rich text widgethttps://patchgazette.com/news/vulnerabilities/froxlor-2-3-15-patch-fixes-critical-root/Patch Gazetteen2026-10-20T17:54:24ZFroxlor 2.3.15 Patch Fixes Critical Root Escalation Flawhttps://patchgazette.com/news/vulnerabilities/apache-tomcat-tls-1-3-failures-affect-versions-9/Patch Gazetteen2026-10-20T17:46:27ZApache Tomcat TLS 1.3 failures affect versions 9 through 11https://patchgazette.com/news/vulnerabilities/suggestarr-users-face-critical-admin-bypass-in/Patch Gazetteen2026-10-20T17:33:20ZSuggestArr Users Face Critical Admin Bypass in Versions Prior to 3.0.0https://patchgazette.com/news/vulnerabilities/apache-cocoon-xee-vulnerability-exposes-server/Patch Gazetteen2026-10-20T16:45:21ZApache Cocoon XEE Vulnerability Exposes Server Files to External Systemshttps://patchgazette.com/news/vulnerabilities/draytek-releases-patch-for-critical-rce-in-end-of/Patch Gazetteen2026-10-20T14:06:25ZDrayTek Releases Patch for Critical RCE in End-of-Support Vigor2960 Routerhttps://patchgazette.com/news/vulnerabilities/azure-key-vault-ssrf-in-kroxylicious-exposes/Patch Gazetteen2026-10-20T13:28:54ZAzure Key Vault SSRF in Kroxylicious Exposes Bearer Tokenshttps://patchgazette.com/news/vulnerabilities/advantech-adam-3600-login-flaw-rated-critical/Patch Gazetteen2026-10-20T08:50:04ZAdvantech ADAM-3600 Login Flaw Rated Critical, Affects Versions Prior to 2.8.5.0https://patchgazette.com/news/vulnerabilities/ccc-attestation-tls-proof-of-concept-vulnerable/Patch Gazetteen2026-10-20T03:21:48ZCCC Attestation TLS Proof-of-Concept Vulnerable to Relayed Impersonationhttps://patchgazette.com/news/vulnerabilities/opensre-flaw-bypasses-approval-gate-for-shell/Patch Gazetteen2026-10-20T03:01:20ZOpenSRE Flaw Bypasses Approval Gate for Shell Command Executionhttps://patchgazette.com/news/vulnerabilities/grav-cms-critical-flaw-lets-editors-call-static/Patch Gazetteen2026-10-20T02:39:25ZGrav CMS Critical Flaw Lets Editors Call Static Methods Before 2.2.2https://patchgazette.com/news/vulnerabilities/pillow-13-0-0-releases-fix-for-cve-2026-112393/Patch Gazetteen2026-10-20T02:32:15ZPillow 13.0.0 releases fix for CVE-2026-112393 heap overflow in TIFF handlinghttps://patchgazette.com/news/vulnerabilities/asus-router-firmware-vulnerability-allows-local/Patch Gazetteen2026-10-20T02:11:27ZASUS Router Firmware Vulnerability Allows Local Denial of Service Attackhttps://patchgazette.com/news/vulnerabilities/eptura-archibus-users-face-critical-rce-risk/Patch Gazetteen2026-10-20T01:15:54ZEptura Archibus Users Face Critical RCE Risk Before 2025.02 Updatehttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-patch-fixes-high-severity-crash-in/Patch Gazetteen2026-10-19T22:03:28ZPillow 13.0.0 Patch Fixes High-Severity Crash in Python Imaging Libraryhttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-patches-high-severity-double-free/Patch Gazetteen2026-10-19T21:53:38ZPillow 13.0.0 patches high-severity double-free flaw in Python imaging libraryhttps://patchgazette.com/news/vulnerabilities/wso2-patches-high-severity-scim-authorization/Patch Gazetteen2026-10-19T17:49:30ZWSO2 Patches High Severity SCIM Authorization Flaw in Identity Server and IAM Productshttps://patchgazette.com/news/vulnerabilities/node-js-follow-redirects-1-16-1-fixes-credential/Patch Gazetteen2026-10-19T17:46:54ZNode.js follow-redirects 1.16.1 Fixes Credential Leakage in CVE-2026-111755https://patchgazette.com/news/vulnerabilities/kvm-x86-smm-cache-flaw-bypasses-write-tracking-no/Patch Gazetteen2026-10-19T16:40:51ZKVM/x86 SMM cache flaw bypasses write tracking; no fix confirmed yethttps://patchgazette.com/news/vulnerabilities/switch-ai-adds-free-tools-to-inventory-agents/Patch Gazetteen2026-10-19T16:26:18ZSwitch AI adds free tools to inventory agents, block injections, and track ROIhttps://patchgazette.com/news/vulnerabilities/drupal-ships-patches-for-critical-rce-flaws-in/Patch Gazetteen2026-10-19T16:04:00ZDrupal Ships Patches for Critical RCE Flaws in Entity List and Field UI Moduleshttps://patchgazette.com/news/vulnerabilities/camunda-7-authorization-flaw-lets-users-steal/Patch Gazetteen2026-10-19T15:43:07ZCamunda 7 Authorization Flaw Lets Users Steal Task Datahttps://patchgazette.com/news/vulnerabilities/yank-note-path-traversal-flaw-exposes-files/Patch Gazetteen2026-10-19T15:05:11ZYank Note Path Traversal Flaw Exposes Files Before Version 3.93.1https://patchgazette.com/news/vulnerabilities/langbot-4-11-0-flaw-lets-attackers-forge-lark/Patch Gazetteen2026-10-19T14:22:27ZLangBot 4.11.0 Flaw Lets Attackers Forge Lark Events Without Authhttps://patchgazette.com/news/vulnerabilities/eg-secure-solutions-patches-siteguard-cve-2026/Patch Gazetteen2026-10-19T13:15:04ZEG Secure Solutions Patches SiteGuard CVE-2026-106931 Command Injection Root Escalation Flawhttps://patchgazette.com/news/vulnerabilities/broadcom-sdk-wps-flaw-enables-unauthenticated-rce/Patch Gazetteen2026-10-19T11:59:14ZBroadcom SDK WPS Flaw Enables Unauthenticated RCE on Routers Without Password