https://patchgazette.com/news/vulnerabilities/pfsense-rest-api-patch-2-9-0-stops-privilege/Patch Gazetteen2026-10-21T19:55:03ZpfSense REST API Patch 2.9.0 Stops Privilege Escalation for Sync Usershttps://patchgazette.com/news/vulnerabilities/apache-iotdb-2-0-0-2-0-10-auth-bypass-cve-2026/Patch Gazetteen2026-10-21T19:12:33ZApache IoTDB 2.0.0-2.0.10 Auth Bypass CVE-2026-58663 Patchedhttps://patchgazette.com/news/vulnerabilities/apache-traffic-server-patch-fixes-request/Patch Gazetteen2026-10-21T18:31:28ZApache Traffic Server Patch Fixes Request Smuggling Flaw in Versions Up to 10.2.0https://patchgazette.com/news/vulnerabilities/virtualenv-21-14-2-patches-high-severity-command/Patch Gazetteen2026-10-21T18:03:25Zvirtualenv 21.14.2 patches high-severity command injection in activation scriptshttps://patchgazette.com/news/vulnerabilities/python-imaging-library-13-0-0-fixes-out-of-bounds/Patch Gazetteen2026-10-21T09:14:21ZPython Imaging Library 13.0.0 fixes out-of-bounds read in TIFF saving logic to prevent heap disclosurehttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-released-to-patch-cve-2026-112403/Patch Gazetteen2026-10-21T08:24:44ZPillow 13.0.0 Released to Patch CVE-2026-112403 Critical Memory Write in JPEGhttps://patchgazette.com/news/vulnerabilities/eclipse-iofog-3-8-3-9-1-vulnerable-to-websocket/Patch Gazetteen2026-10-21T08:08:35ZEclipse ioFog 3.8-3.9.1 Vulnerable to WebSocket JWT Bypass for Admin Accesshttps://patchgazette.com/news/vulnerabilities/totolink-x2000r-firmware-cve-2026-9827-allows/Patch Gazetteen2026-10-21T05:15:56ZTotolink X2000R Firmware CVE-2026-9827 Allows Authenticated Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/php2shell-leak-prompts-imminent-9-2-rated-php/Patch Gazetteen2026-10-21T04:13:14ZPHP2Shell leak prompts imminent 9.2-rated PHP patches, warning of post-fix mass attackshttps://patchgazette.com/news/vulnerabilities/authenticated-attackers-can-execute-code-on/Patch Gazetteen2026-10-21T03:46:12ZAuthenticated Attackers Can Execute Code on Totolink X2000R via Critical CVE-2026-10139 Buffer Overflowhttps://patchgazette.com/news/vulnerabilities/a2a-java-sdk-1-2-0-final-lacks-authorization/Patch Gazetteen2026-10-21T03:31:05ZA2A Java SDK 1.2.0.Final Lacks Authorization Checks, Leaving Task Data Exposed With No Patch Yethttps://patchgazette.com/news/vulnerabilities/totolink-x2000r-firmware-cve-2026-10131-exposes/Patch Gazetteen2026-10-21T02:30:15ZTOTOLINK X2000R Firmware CVE-2026-10131 Exposes Routers to Critical Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/authenticated-users-can-execute-arbitrary-code-on/Patch Gazetteen2026-10-21T02:02:26ZAuthenticated users can execute arbitrary code on Totolink X2000R via CVSS 9.1 CVE-2026-9814https://patchgazette.com/news/vulnerabilities/oracles-oct-2026-cpu-patches-critical/Patch Gazetteen2026-10-21T00:04:30ZOracle's Oct 2026 CPU Patches Critical Unauthenticated SQLi in E-Business Suite Enabling Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/unauthenticated-users-can-write-to-ibm-datastage/Patch Gazetteen2026-10-21T00:04:00ZUnauthenticated users can write to IBM DataStage Redis stores in critical CVE-2026-81212 vulnerabilityhttps://patchgazette.com/news/vulnerabilities/cisa-flags-plex-server-ssrf-and-file-write-flaws/Patch Gazetteen2026-10-20T23:39:49ZCISA Flags Plex Server SSRF and File Write Flaws on KEV List With Looming Federal Patch Deadlinehttps://patchgazette.com/news/vulnerabilities/cve-2026-28763-authenticated-http-attack-enables/Patch Gazetteen2026-10-20T22:08:13ZCVE-2026-28763: Authenticated HTTP Attack Enables RCE on Specific Totolink X2000R Firmwarehttps://patchgazette.com/news/vulnerabilities/totolink-x2000r-firmware-flaw-cvss-9-1-lets/Patch Gazetteen2026-10-20T21:42:56ZTotolink X2000R Firmware Flaw CVSS 9.1 Lets Authenticated Users Run Arbitrary Codehttps://patchgazette.com/news/vulnerabilities/cve-2026-35499-totolink-x2000r-router-cvss-9-1/Patch Gazetteen2026-10-20T21:40:41ZCVE-2026-35499: Totolink X2000R Router CVSS 9.1 Flaw Allows Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/apache-fixes-tomcat-jndi-flaw-allowing-password/Patch Gazetteen2026-10-20T20:07:20ZApache fixes Tomcat JNDI flaw allowing password-free access in versions 7.0 through 11.0https://patchgazette.com/news/vulnerabilities/aapanel-8-25-0-has-remote-code-injection-flaw/Patch Gazetteen2026-10-20T19:07:29ZaaPanel 8.25.0 Has Remote Code Injection Flaw Requiring Loginhttps://patchgazette.com/news/vulnerabilities/wavlink-wl-wn530be1-a-firmware-has-critical/Patch Gazetteen2026-10-20T19:00:25ZWavlink WL-WN530BE1-A Firmware Has Critical Remote Code Execution Flawhttps://patchgazette.com/news/vulnerabilities/apostrophe-cms-patch-fixes-disk-exhaustion-flaw/Patch Gazetteen2026-10-20T18:27:07ZApostrophe CMS patch fixes disk exhaustion flaw in rich text widgethttps://patchgazette.com/news/vulnerabilities/froxlor-2-3-15-patch-fixes-critical-root/Patch Gazetteen2026-10-20T17:54:24ZFroxlor 2.3.15 Patch Fixes Critical Root Escalation Flawhttps://patchgazette.com/news/vulnerabilities/apache-tomcat-tls-1-3-failures-affect-versions-9/Patch Gazetteen2026-10-20T17:46:27ZApache Tomcat TLS 1.3 failures affect versions 9 through 11https://patchgazette.com/news/vulnerabilities/suggestarr-users-face-critical-admin-bypass-in/Patch Gazetteen2026-10-20T17:33:20ZSuggestArr Users Face Critical Admin Bypass in Versions Prior to 3.0.0https://patchgazette.com/news/vulnerabilities/apache-cocoon-xee-vulnerability-exposes-server/Patch Gazetteen2026-10-20T16:45:21ZApache Cocoon XEE Vulnerability Exposes Server Files to External Systemshttps://patchgazette.com/news/vulnerabilities/draytek-releases-patch-for-critical-rce-in-end-of/Patch Gazetteen2026-10-20T14:06:25ZDrayTek Releases Patch for Critical RCE in End-of-Support Vigor2960 Routerhttps://patchgazette.com/news/vulnerabilities/azure-key-vault-ssrf-in-kroxylicious-exposes/Patch Gazetteen2026-10-20T13:28:54ZAzure Key Vault SSRF in Kroxylicious Exposes Bearer Tokenshttps://patchgazette.com/news/vulnerabilities/advantech-adam-3600-login-flaw-rated-critical/Patch Gazetteen2026-10-20T08:50:04ZAdvantech ADAM-3600 Login Flaw Rated Critical, Affects Versions Prior to 2.8.5.0https://patchgazette.com/news/vulnerabilities/ccc-attestation-tls-proof-of-concept-vulnerable/Patch Gazetteen2026-10-20T03:21:48ZCCC Attestation TLS Proof-of-Concept Vulnerable to Relayed Impersonationhttps://patchgazette.com/news/vulnerabilities/opensre-flaw-bypasses-approval-gate-for-shell/Patch Gazetteen2026-10-20T03:01:20ZOpenSRE Flaw Bypasses Approval Gate for Shell Command Executionhttps://patchgazette.com/news/vulnerabilities/grav-cms-critical-flaw-lets-editors-call-static/Patch Gazetteen2026-10-20T02:39:25ZGrav CMS Critical Flaw Lets Editors Call Static Methods Before 2.2.2https://patchgazette.com/news/vulnerabilities/pillow-13-0-0-releases-fix-for-cve-2026-112393/Patch Gazetteen2026-10-20T02:32:15ZPillow 13.0.0 releases fix for CVE-2026-112393 heap overflow in TIFF handlinghttps://patchgazette.com/news/vulnerabilities/asus-router-firmware-vulnerability-allows-local/Patch Gazetteen2026-10-20T02:11:27ZASUS Router Firmware Vulnerability Allows Local Denial of Service Attackhttps://patchgazette.com/news/vulnerabilities/eptura-archibus-users-face-critical-rce-risk/Patch Gazetteen2026-10-20T01:15:54ZEptura Archibus Users Face Critical RCE Risk Before 2025.02 Updatehttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-patch-fixes-high-severity-crash-in/Patch Gazetteen2026-10-19T22:03:28ZPillow 13.0.0 Patch Fixes High-Severity Crash in Python Imaging Libraryhttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-patches-high-severity-double-free/Patch Gazetteen2026-10-19T21:53:38ZPillow 13.0.0 patches high-severity double-free flaw in Python imaging library