Wildcard Watch: act nowhttps://watch.wildcardgroup.be/Only the items that need action this week.enSat, 24 Oct 2026 10:46:08 +000060Patch now: Collabora Online – Built-in CODE Server: OS Command Injectionhttps://watch.wildcardgroup.be/?i=2026-10-23-collabora-collabora-online-built-in-code-serverwgw:2026-10-23-collabora-collabora-online-built-in-code-serverFri, 23 Oct 2026 00:00:00 +0000collaboracollabora:collabora-online-built-in-code-serverAttackers can run their own code, over the internet, without logging in.

What to do: Update Collabora Online – Built-in CODE Server to 26.4.303 or later.

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Critical · Fix available · CVE-2026-110447

]]>Patch now: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Imagehttps://watch.wildcardgroup.be/?i=2026-10-23-craftedwgw:2026-10-23-craftedFri, 23 Oct 2026 00:00:00 +0000What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

Pillow is a Python imaging library.

Critical · Check vendor · CVE-2026-112900

]]>Patch now: Arista VeloCloud Orchestrator: SQL Injectionhttps://watch.wildcardgroup.be/?i=2026-10-23-arista-velocloud-orchestratorwgw:2026-10-23-arista-velocloud-orchestratorThu, 22 Oct 2026 00:00:00 +0000aristaarista:velocloud-orchestratorAttackers can read or change the database, over the internet.

What to do: Update Arista VeloCloud Orchestrator to the fixed version for your release line (for example 5.2.3.18, 6.1.3.10 or 6.4.2.12).

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Critical · Fix available · CVE-2026-114625, CVE-2026-110447

]]>Check now: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attackhttps://watch.wildcardgroup.be/?i=2026-10-22-artexwgw:2026-10-22-artexThu, 22 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Check now: eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Updatehttps://watch.wildcardgroup.be/?i=2026-10-22-cdwgw:2026-10-22-cdThu, 22 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch now: Critical Unauthenticated Remote Code Execution in GitLabhttps://watch.wildcardgroup.be/?i=2026-10-22-ccb-gitlabwgw:2026-10-22-ccb-gitlabThu, 22 Oct 2026 00:00:00 +0000gitlabAttackers can run their own code.

What to do: Install the security update for GitLab from the vendor advisory.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available · CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212

]]>Patch now: Fortinet Releases Critical Security Hardening Updates for Multiple Productshttps://watch.wildcardgroup.be/?i=2026-10-22-ccb-fortinet-releases-critical-security-hardening-updates-for-multiple-productswgw:2026-10-22-ccb-fortinet-releases-critical-security-hardening-updates-for-multiple-productsThu, 22 Oct 2026 00:00:00 +0000fortinet-releases-critical-security-hardening-updates-for-multiple-productsWhat to do: Install the security update for Fortinet Releases Critical Security Hardening Updates for Multiple Products. The CCB advisory lists the affected and fixed versions.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available

]]>Patch now: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixeshttps://watch.wildcardgroup.be/?i=2026-10-22-ksmbdwgw:2026-10-22-ksmbdThu, 22 Oct 2026 00:00:00 +0000What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

Critical · Fix available

]]>Patch now: Multiple Critical vulnerabilities in PHP that can lead to Remote Code Executionhttps://watch.wildcardgroup.be/?i=2026-10-22-ccb-phpwgw:2026-10-22-ccb-phpWed, 21 Oct 2026 00:00:00 +0000phpAttackers can run their own code.

What to do: Install the security update for PHP from the vendor advisory.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560

]]>Check now: LiteLLM Compromised in Fresh Supply Chain Attackhttps://watch.wildcardgroup.be/?i=2026-10-21-litellmwgw:2026-10-21-litellmWed, 21 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch now: Cisco Expressway Series Remote Code Execution Vulnerabilityhttps://watch.wildcardgroup.be/?i=2026-10-21-expresswaywgw:2026-10-21-expresswayWed, 21 Oct 2026 00:00:00 +0000ciscocisco:cisco-telepresence-video-communication-server-vcs-expresswayAttackers can run their own code, over the internet, without logging in.

What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.

Critical · Check vendor · CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476

]]>Patch now: Plex Media Server: 4 flaws exploited togetherhttps://watch.wildcardgroup.be/?i=2026-10-20-plex-media-serverwgw:2026-10-20-plex-media-serverTue, 20 Oct 2026 00:00:00 +0000plexplex:media-serverAttackers can make the server send requests on their behalf, over the internet, with an admin account.

What to do: Update Plex Media Server to 1.43.3.10861 or later.

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

High · Fix available · CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

]]>Patch now: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAhttps://watch.wildcardgroup.be/?i=2026-10-20-incwgw:2026-10-20-incTue, 20 Oct 2026 00:00:00 +0000palo-alto-networkspalo-alto-networks:cloud-ngfwpalo-alto-networks:pan-ospalo-alto-networks:prisma-accessAttackers can get past the login, over the internet, without logging in.

What to do: Update the affected Palo Alto Networks products to the fixed version for your release line (for example 12.1.4-h6, 11.2.4-h17 or 11.1.4-h33).

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.

High · Fix available · CVE-2026-0257

]]>Patch now: Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Executionhttps://watch.wildcardgroup.be/?i=2026-10-20-fortisiemwgw:2026-10-20-fortisiemTue, 20 Oct 2026 00:00:00 +0000Attackers can run their own code, over the internet, without logging in.

What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

Critical · Fix available · CVE-2026-106173

]]>Check now: OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respondhttps://watch.wildcardgroup.be/?i=2026-10-18-aiwgw:2026-10-18-aiSun, 18 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch now: BeyondTrust Remote Support: Authentication Bypass by Spoofinghttps://watch.wildcardgroup.be/?i=2026-10-16-beyondtrust-remote-supportwgw:2026-10-16-beyondtrust-remote-supportFri, 16 Oct 2026 00:00:00 +0000beyondtrustbeyondtrust:remote-supportAttackers can get past the login, over the internet, without logging in.

What to do: Follow the vendor advisory for BeyondTrust Remote Support: install the update or apply the mitigation it lists.

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

Critical · Check vendor · CVE-2026-102764

]]>Patch now: Multiple Critical Vulnerabilities in Juniper Networks Junos OShttps://watch.wildcardgroup.be/?i=2026-10-16-ccb-juniper-networks-junos-oswgw:2026-10-16-ccb-juniper-networks-junos-osFri, 16 Oct 2026 00:00:00 +0000juniper-networks-junos-osWhat to do: Install the security update for Juniper Networks Junos OS. The CCB advisory lists the affected and fixed versions.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available

]]>Patch now: Atlassian (multiple products): Files or Directories Accessible to External Partieshttps://watch.wildcardgroup.be/?i=2026-10-15-atlassian-multiple-productswgw:2026-10-15-atlassian-multiple-productsThu, 15 Oct 2026 00:00:00 +0000atlassianatlassian:multiple-productsAttackers can read files they should not reach, over the internet, without logging in.

What to do: Update the affected Atlassian products to the fixed version for your release line (for example 10.2.24, 12.1.12 or 10.2.8).

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Critical · Fix available · CVE-2026-21589

]]>Patch now: AhsayCBS: 2 flaws exploited togetherhttps://watch.wildcardgroup.be/?i=2026-10-14-ahsay-ahsaycbswgw:2026-10-14-ahsay-ahsaycbsWed, 14 Oct 2026 00:00:00 +0000ahsayahsay:ahsaycbsAttackers can get past the login, over the internet, without logging in.

What to do: Update AhsayCBS to 10.3.4 or later.

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

Critical · Fix available · CVE-2026-105133, CVE-2026-105134

]]>Patch now: Cisco Secure Email Gateway: Relative Path Traversalhttps://watch.wildcardgroup.be/?i=2026-10-14-cisco-secure-email-gatewaywgw:2026-10-14-cisco-secure-email-gatewayWed, 14 Oct 2026 00:00:00 +0000ciscocisco:secure-email-gatewayAttackers can read or write files they should not reach, over the internet, without logging in.

What to do: Follow the vendor advisory for Cisco Secure Email Gateway: install the update or apply the mitigation it lists.

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

Critical · Check vendor · CVE-2026-76519, CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442

]]>Patch now: Palo Alto Networks PAN-OS: Code Injectionhttps://watch.wildcardgroup.be/?i=2026-10-14-palo-alto-networks-pan-oswgw:2026-10-14-palo-alto-networks-pan-osWed, 14 Oct 2026 00:00:00 +0000palo-alto-networkspalo-alto-networks:pan-osAttackers can run their own code, over the internet, with an admin account.

What to do: Update Palo Alto Networks PAN-OS to the fixed version for your release line (for example 12.2.4, 12.1.10-h2 or 11.2.16).

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

High · Fix available · CVE-2026-0322, CVE-2026-0307, CVE-2026-0312, CVE-2026-0313, CVE-2026-0314

]]>Patch now: Ivanti Connect Secure: Authentication Bypass by Spoofinghttps://watch.wildcardgroup.be/?i=2026-10-13-ivanti-connect-securewgw:2026-10-13-ivanti-connect-secureTue, 13 Oct 2026 00:00:00 +0000ivantiivanti:connect-secureAttackers can get past the login, over the internet, without logging in.

What to do: Update Ivanti Connect Secure to the fixed version for your release line (for example 25.1.3.0, 25.1.3.1 or 22.8R2.5).

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

High · Fix available · CVE-2026-104935

]]>Upgrade or isolate: Strapi: Cleartext Storage of Sensitive Informationhttps://watch.wildcardgroup.be/?i=2026-10-08-strapi-strapiwgw:2026-10-08-strapi-strapiThu, 08 Oct 2026 00:00:00 +0000strapistrapi:strapiAttackers can read sensitive data, over the internet, with an admin account.

What to do: This version of Strapi may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

High · Unsupported · CVE-2023-22894

]]>Mitigate now: F5 BIG-IP APM: Heap-based Buffer Overflowhttps://watch.wildcardgroup.be/?i=2026-09-22-f5-big-ip-apmwgw:2026-09-22-f5-big-ip-apmTue, 22 Sep 2026 00:00:00 +0000f5f5:big-ip-apmMemory corruption that can let attackers run code, over the internet, without logging in.

What to do: Only engineering hotfixes exist, through F5 support. Ask for the hotfix or apply the vendor's mitigation, and restrict who can reach F5 BIG-IP APM until a regular release is out.

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

Critical · Partial fix · CVE-2026-94127

]]>Upgrade or isolate: Linux Kernel: 3 flaws exploited togetherhttps://watch.wildcardgroup.be/?i=2026-09-18-linux-kernelwgw:2026-09-18-linux-kernelFri, 18 Sep 2026 00:00:00 +0000linuxlinux:kernelMemory corruption that can let attackers run code, over the internet, without logging in.

What to do: This version of Linux Kernel may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.

Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA lists 2 more flaws in Linux Kernel as exploited on the same day (CVE-2025-39964, CVE-2026-53266).

Critical · Unsupported · CVE-2025-39682, CVE-2025-39964, CVE-2026-53266

]]>Upgrade or isolate: Ajax.NET Professional: Deserialization of Untrusted Datahttps://watch.wildcardgroup.be/?i=2026-08-26-ajax-net-professional-ajax-net-professionalwgw:2026-08-26-ajax-net-professional-ajax-net-professionalWed, 26 Aug 2026 00:00:00 +0000ajax-net-professionalajax-net-professional:ajax-net-professionalAttackers can run their own code, over the internet, without logging in.

What to do: This version of Ajax.NET Professional may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.

Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

High · Unsupported · CVE-2021-23758

]]>Upgrade or isolate: Red Hat Automatic Bug Reporting Tool: Privilege Escalationhttps://watch.wildcardgroup.be/?i=2026-08-26-red-hat-automatic-bug-reporting-toolwgw:2026-08-26-red-hat-automatic-bug-reporting-toolWed, 26 Aug 2026 00:00:00 +0000red-hatred-hat:automatic-bug-reporting-toolAttackers can gain higher privileges, once they have access to the device.

What to do: This version of Red Hat Automatic Bug Reporting Tool may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.

Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

High · Unsupported · CVE-2015-5287

]]>