https://patchgazette.com/news/vulnerabilities/pillow-11-1-0-to-12-3-0-patched-to-fix-bundled/Patch Gazetteen2026-10-22T17:17:43ZPillow 11.1.0 to 12.3.0 patched to fix bundled OpenJPEG heap overflowhttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-fixes-high-severity-decompression/Patch Gazetteen2026-10-22T16:17:27ZPillow 13.0.0 Fixes High-Severity Decompression Bomb Bypass in Spider Pluginhttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-fixes-high-severity-heap-overflow/Patch Gazetteen2026-10-22T16:15:37ZPillow 13.0.0 Fixes High-Severity Heap Overflow in JPEG Encoderhttps://patchgazette.com/news/vulnerabilities/intermesh-group-office-path-traversal-flaw-allows/Patch Gazetteen2026-10-22T14:05:15ZIntermesh Group-Office Path Traversal Flaw Allows Unauthenticated File Readhttps://patchgazette.com/news/vulnerabilities/unpatched-sql-injection-in-seacms-8-7-allows/Patch Gazetteen2026-10-22T14:02:35ZUnpatched SQL injection in SeaCMS 8.7 allows remote database extractionhttps://patchgazette.com/news/vulnerabilities/unauthenticated-path-traversal-in-kavita-0-5-2/Patch Gazetteen2026-10-22T12:08:02ZUnauthenticated Path Traversal in Kavita 0.5.2 Lets Attackers Steal Fileshttps://patchgazette.com/news/vulnerabilities/unauthenticated-sql-injection-found-in-i/Patch Gazetteen2026-10-22T12:07:32ZUnauthenticated SQL Injection Found in i-Netsolution MLM Software Buildhttps://patchgazette.com/news/vulnerabilities/netmaker-1-7-0-vulnerable-to-high-severity-auth/Patch Gazetteen2026-10-22T11:32:59ZNetmaker 1.7.0 Vulnerable to High-Severity Auth Bypass in External Client Handlerhttps://patchgazette.com/news/vulnerabilities/shadowserver-sees-exploitation-of-tinymce/Patch Gazetteen2026-10-22T01:50:08ZShadowserver Sees Exploitation of TinyMCE Thumbnail Gallery Path Traversal Bug Affecting WordPress Siteshttps://patchgazette.com/news/vulnerabilities/foxio-researchers-detail-qpack-amplification/Patch Gazetteen2026-10-22T00:51:25ZFoxio Researchers Detail QPACK Amplification Attacks Targeting HTTP/3 Servershttps://patchgazette.com/news/vulnerabilities/sveltekit-preview-server-path-traversal-affects/Patch Gazetteen2026-10-21T23:39:47ZSvelteKit Preview Server Path Traversal Affects Versions Before 3.0.0https://patchgazette.com/news/vulnerabilities/splunk-enterprise-flaw-lets-low-privilege-users/Patch Gazetteen2026-10-21T23:12:04ZSplunk Enterprise flaw lets low-privilege users run OS commandshttps://patchgazette.com/news/vulnerabilities/trigger-dev-patch-fixes-unauthenticated-secret/Patch Gazetteen2026-10-21T22:57:44ZTrigger.dev Patch Fixes Unauthenticated Secret Exposure in Versions Before 4.5.4https://patchgazette.com/news/vulnerabilities/rce-risk-dulwich-path-traversal-bug-lets/Patch Gazetteen2026-10-21T22:47:01ZRCE Risk: Dulwich Path Traversal Bug Lets Attackers Write Files Outside Directories on Windowshttps://patchgazette.com/news/vulnerabilities/emudhra-compromise-risks-bundled-cert-stores-in/Patch Gazetteen2026-10-21T21:49:52ZeMudhra Compromise Risks Bundled Cert Stores in Rust, NixOS, and TeX Livehttps://patchgazette.com/news/vulnerabilities/jupyter-nbconvert-path-traversal-flaw-lets/Patch Gazetteen2026-10-21T20:49:48ZJupyter nbconvert path traversal flaw lets attackers write files anywherehttps://patchgazette.com/news/vulnerabilities/jane-menu-wordpress-plugin-1-5-1-patch-fixes-high/Patch Gazetteen2026-10-21T20:28:36ZJane Menu WordPress Plugin 1.5.1 Patch Fixes High-Severity Cross-Site Scripting Flawhttps://patchgazette.com/news/vulnerabilities/pfsense-rest-api-patch-2-9-0-stops-privilege/Patch Gazetteen2026-10-21T19:55:03ZpfSense REST API Patch 2.9.0 Stops Privilege Escalation for Sync Usershttps://patchgazette.com/news/vulnerabilities/apache-iotdb-2-0-0-2-0-10-auth-bypass-cve-2026/Patch Gazetteen2026-10-21T19:12:33ZApache IoTDB 2.0.0-2.0.10 Auth Bypass CVE-2026-58663 Patchedhttps://patchgazette.com/news/vulnerabilities/apache-traffic-server-patch-fixes-request/Patch Gazetteen2026-10-21T18:31:28ZApache Traffic Server Patch Fixes Request Smuggling Flaw in Versions Up to 10.2.0https://patchgazette.com/news/vulnerabilities/virtualenv-21-14-2-patches-high-severity-command/Patch Gazetteen2026-10-21T18:03:25Zvirtualenv 21.14.2 patches high-severity command injection in activation scriptshttps://patchgazette.com/news/vulnerabilities/python-imaging-library-13-0-0-fixes-out-of-bounds/Patch Gazetteen2026-10-21T09:14:21ZPython Imaging Library 13.0.0 fixes out-of-bounds read in TIFF saving logic to prevent heap disclosurehttps://patchgazette.com/news/vulnerabilities/pillow-13-0-0-released-to-patch-cve-2026-112403/Patch Gazetteen2026-10-21T08:24:44ZPillow 13.0.0 Released to Patch CVE-2026-112403 Critical Memory Write in JPEGhttps://patchgazette.com/news/vulnerabilities/eclipse-iofog-3-8-3-9-1-vulnerable-to-websocket/Patch Gazetteen2026-10-21T08:08:35ZEclipse ioFog 3.8-3.9.1 Vulnerable to WebSocket JWT Bypass for Admin Accesshttps://patchgazette.com/news/vulnerabilities/totolink-x2000r-firmware-cve-2026-9827-allows/Patch Gazetteen2026-10-21T05:15:56ZTotolink X2000R Firmware CVE-2026-9827 Allows Authenticated Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/php2shell-leak-prompts-imminent-9-2-rated-php/Patch Gazetteen2026-10-21T04:13:14ZPHP2Shell leak prompts imminent 9.2-rated PHP patches, warning of post-fix mass attackshttps://patchgazette.com/news/vulnerabilities/authenticated-attackers-can-execute-code-on/Patch Gazetteen2026-10-21T03:46:12ZAuthenticated Attackers Can Execute Code on Totolink X2000R via Critical CVE-2026-10139 Buffer Overflowhttps://patchgazette.com/news/vulnerabilities/a2a-java-sdk-1-2-0-final-lacks-authorization/Patch Gazetteen2026-10-21T03:31:05ZA2A Java SDK 1.2.0.Final Lacks Authorization Checks, Leaving Task Data Exposed With No Patch Yethttps://patchgazette.com/news/vulnerabilities/totolink-x2000r-firmware-cve-2026-10131-exposes/Patch Gazetteen2026-10-21T02:30:15ZTOTOLINK X2000R Firmware CVE-2026-10131 Exposes Routers to Critical Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/authenticated-users-can-execute-arbitrary-code-on/Patch Gazetteen2026-10-21T02:02:26ZAuthenticated users can execute arbitrary code on Totolink X2000R via CVSS 9.1 CVE-2026-9814https://patchgazette.com/news/vulnerabilities/oracles-oct-2026-cpu-patches-critical/Patch Gazetteen2026-10-21T00:04:30ZOracle's Oct 2026 CPU Patches Critical Unauthenticated SQLi in E-Business Suite Enabling Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/unauthenticated-users-can-write-to-ibm-datastage/Patch Gazetteen2026-10-21T00:04:00ZUnauthenticated users can write to IBM DataStage Redis stores in critical CVE-2026-81212 vulnerabilityhttps://patchgazette.com/news/vulnerabilities/cisa-flags-plex-server-ssrf-and-file-write-flaws/Patch Gazetteen2026-10-20T23:39:49ZCISA Flags Plex Server SSRF and File Write Flaws on KEV List With Looming Federal Patch Deadlinehttps://patchgazette.com/news/vulnerabilities/cve-2026-28763-authenticated-http-attack-enables/Patch Gazetteen2026-10-20T22:08:13ZCVE-2026-28763: Authenticated HTTP Attack Enables RCE on Specific Totolink X2000R Firmwarehttps://patchgazette.com/news/vulnerabilities/totolink-x2000r-firmware-flaw-cvss-9-1-lets/Patch Gazetteen2026-10-20T21:42:56ZTotolink X2000R Firmware Flaw CVSS 9.1 Lets Authenticated Users Run Arbitrary Codehttps://patchgazette.com/news/vulnerabilities/cve-2026-35499-totolink-x2000r-router-cvss-9-1/Patch Gazetteen2026-10-20T21:40:41ZCVE-2026-35499: Totolink X2000R Router CVSS 9.1 Flaw Allows Remote Code Executionhttps://patchgazette.com/news/vulnerabilities/apache-fixes-tomcat-jndi-flaw-allowing-password/Patch Gazetteen2026-10-20T20:07:20ZApache fixes Tomcat JNDI flaw allowing password-free access in versions 7.0 through 11.0https://patchgazette.com/news/vulnerabilities/aapanel-8-25-0-has-remote-code-injection-flaw/Patch Gazetteen2026-10-20T19:07:29ZaaPanel 8.25.0 Has Remote Code Injection Flaw Requiring Loginhttps://patchgazette.com/news/vulnerabilities/wavlink-wl-wn530be1-a-firmware-has-critical/Patch Gazetteen2026-10-20T19:00:25ZWavlink WL-WN530BE1-A Firmware Has Critical Remote Code Execution Flawhttps://patchgazette.com/news/vulnerabilities/apostrophe-cms-patch-fixes-disk-exhaustion-flaw/Patch Gazetteen2026-10-20T18:27:07ZApostrophe CMS patch fixes disk exhaustion flaw in rich text widgethttps://patchgazette.com/news/vulnerabilities/froxlor-2-3-15-patch-fixes-critical-root/Patch Gazetteen2026-10-20T17:54:24ZFroxlor 2.3.15 Patch Fixes Critical Root Escalation Flawhttps://patchgazette.com/news/vulnerabilities/apache-tomcat-tls-1-3-failures-affect-versions-9/Patch Gazetteen2026-10-20T17:46:27ZApache Tomcat TLS 1.3 failures affect versions 9 through 11https://patchgazette.com/news/vulnerabilities/suggestarr-users-face-critical-admin-bypass-in/Patch Gazetteen2026-10-20T17:33:20ZSuggestArr Users Face Critical Admin Bypass in Versions Prior to 3.0.0