Microsoft Exchange Server Elevation of Privilege Flaw Is October's Only Patch Tuesday Fix (CVE-2026-96940)

Scope: Microsoft Exchange Server, all supported on-premises versions

Severity: Amber

Read More

Ninja Forms and WPC Product Bundles Flaws Being Used to Plant Backdoors on WordPress Sites (CVE-2026-94504 / CVE-2026-93836)

Scope: Ninja Forms WordPress plugin versions 3.15.3 and earlier, and WPC Product Bundles for WooCommerce versions 8.6.6 and earlier

Severity: Amber

Read More

Atlassian Patches Unauthenticated File Access Flaw Across Eight Data Center Products (CVE-2026-21589)

Scope: Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, FishEye, and Crucible, all versions before the fixed releases

Severity: Red

Read More

Citrix NetScaler Gets Another Exploited Zero-Day, and Last Week's Patches Do Not Cover It (CVE-2026-88779)

Scope: Citrix NetScaler ADC and NetScaler Gateway appliances using SAML authentication with Gateway or AAA functionality, including devices already updated for CVE-2026-88771 through CVE-2026-88778

Severity: Red

Read More

Rejetto HFS Weak Session Key Flaw Lets Attackers Forge Admin Sessions and Run Code, Scanning Has Started (CVE-2026-61500)

Scope: Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0

Severity: Red

Read More

TeamViewer Patches Five Flaws Including a Remote Access Control Bypass That Can Lead to Code Execution (CVE-2026-92370 and Others)

Scope: TeamViewer Full Client and Host for Windows, Linux, and macOS, versions before 15.82 and supported maintenance and legacy releases before their fixed builds

Severity: Amber

Read More