Wildcard Watch: exploited right now

Wildcard Watch: exploited right nowhttps://watch.wildcardgroup.be/Vulnerabilities attackers are using now, breaches and supply-chain attacks: whether a fix exists, and what to do. By Wildcard Group.enSat, 24 Oct 2026 10:46:08 +000060Patch now: Collabora Online – Built-in CODE Server: OS Command Injectionhttps://watch.wildcardgroup.be/?i=2026-10-23-collabora-collabora-online-built-in-code-serverwgw:2026-10-23-collabora-collabora-online-built-in-code-serverFri, 23 Oct 2026 00:00:00 +0000collaboracollabora:collabora-online-built-in-code-serverAttackers can run their own code, over the internet, without logging in.

What to do: Update Collabora Online – Built-in CODE Server to 26.4.303 or later.

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

Critical · Fix available · CVE-2026-110447

]]>Patch now: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Imagehttps://watch.wildcardgroup.be/?i=2026-10-23-craftedwgw:2026-10-23-craftedFri, 23 Oct 2026 00:00:00 +0000What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

Pillow is a Python imaging library.

Critical · Check vendor · CVE-2026-112900

]]>Check exposure: Quest Diagnostics warns of potential data theft after attack on lab service systemhttps://watch.wildcardgroup.be/?i=2026-10-23-diagnosticswgw:2026-10-23-diagnosticsFri, 23 Oct 2026 00:00:00 +0000What to do: If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.

Unrated ·

]]>Check exposure: Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentialshttps://watch.wildcardgroup.be/?i=2026-10-23-vpnswgw:2026-10-23-vpnsFri, 23 Oct 2026 00:00:00 +0000What to do: If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.

Unrated ·

]]>Check exposure: 11 Million Impacted by Capcom Data Breachhttps://watch.wildcardgroup.be/?i=2026-10-23-capcomwgw:2026-10-23-capcomFri, 23 Oct 2026 00:00:00 +0000What to do: If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.

Unrated ·

]]>Patch now: Arista VeloCloud Orchestrator: SQL Injectionhttps://watch.wildcardgroup.be/?i=2026-10-23-arista-velocloud-orchestratorwgw:2026-10-23-arista-velocloud-orchestratorThu, 22 Oct 2026 00:00:00 +0000aristaarista:velocloud-orchestratorAttackers can read or change the database, over the internet.

What to do: Update Arista VeloCloud Orchestrator to the fixed version for your release line (for example 5.2.3.18, 6.1.3.10 or 6.4.2.12).

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Critical · Fix available · CVE-2026-114625, CVE-2026-110447

]]>Check now: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attackhttps://watch.wildcardgroup.be/?i=2026-10-22-artexwgw:2026-10-22-artexThu, 22 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Check now: eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Updatehttps://watch.wildcardgroup.be/?i=2026-10-22-cdwgw:2026-10-22-cdThu, 22 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch now: Critical Unauthenticated Remote Code Execution in GitLabhttps://watch.wildcardgroup.be/?i=2026-10-22-ccb-gitlabwgw:2026-10-22-ccb-gitlabThu, 22 Oct 2026 00:00:00 +0000gitlabAttackers can run their own code.

What to do: Install the security update for GitLab from the vendor advisory.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available · CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212

]]>Patch now: Fortinet Releases Critical Security Hardening Updates for Multiple Productshttps://watch.wildcardgroup.be/?i=2026-10-22-ccb-fortinet-releases-critical-security-hardening-updates-for-multiple-productswgw:2026-10-22-ccb-fortinet-releases-critical-security-hardening-updates-for-multiple-productsThu, 22 Oct 2026 00:00:00 +0000fortinet-releases-critical-security-hardening-updates-for-multiple-productsWhat to do: Install the security update for Fortinet Releases Critical Security Hardening Updates for Multiple Products. The CCB advisory lists the affected and fixed versions.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available

]]>Patch now: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixeshttps://watch.wildcardgroup.be/?i=2026-10-22-ksmbdwgw:2026-10-22-ksmbdThu, 22 Oct 2026 00:00:00 +0000What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

Critical · Fix available

]]>Patch this month: Multiple High Severity Vulnerabilities in Node.jshttps://watch.wildcardgroup.be/?i=2026-10-22-ccb-node-jswgw:2026-10-22-ccb-node-jsThu, 22 Oct 2026 00:00:00 +0000node-jsWhat to do: Install the security update for Node.js from the vendor advisory.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

High · Fix available · CVE-2026-111497

]]>Check exposure: Toronto crime tips org freezes operations after details of data breach come to lighthttps://watch.wildcardgroup.be/?i=2026-10-22-torontowgw:2026-10-22-torontoThu, 22 Oct 2026 00:00:00 +0000What to do: If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.

Unrated ·

]]>Patch now: Multiple Critical vulnerabilities in PHP that can lead to Remote Code Executionhttps://watch.wildcardgroup.be/?i=2026-10-22-ccb-phpwgw:2026-10-22-ccb-phpWed, 21 Oct 2026 00:00:00 +0000phpAttackers can run their own code.

What to do: Install the security update for PHP from the vendor advisory.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available · CVE-2026-109618, CVE-2026-109619, CVE-2026-115560

]]>Check now: LiteLLM Compromised in Fresh Supply Chain Attackhttps://watch.wildcardgroup.be/?i=2026-10-21-litellmwgw:2026-10-21-litellmWed, 21 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch now: Cisco Expressway Series Remote Code Execution Vulnerabilityhttps://watch.wildcardgroup.be/?i=2026-10-21-expresswaywgw:2026-10-21-expresswayWed, 21 Oct 2026 00:00:00 +0000ciscocisco:cisco-telepresence-video-communication-server-vcs-expresswayAttackers can run their own code, over the internet, without logging in.

What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.

Critical · Check vendor · CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476

]]>Check exposure: State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Webhttps://watch.wildcardgroup.be/?i=2026-10-21-confirmswgw:2026-10-21-confirmsWed, 21 Oct 2026 00:00:00 +0000What to do: If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.

Unrated ·

]]>Patch now: Plex Media Server: 4 flaws exploited togetherhttps://watch.wildcardgroup.be/?i=2026-10-20-plex-media-serverwgw:2026-10-20-plex-media-serverTue, 20 Oct 2026 00:00:00 +0000plexplex:media-serverAttackers can make the server send requests on their behalf, over the internet, with an admin account.

What to do: Update Plex Media Server to 1.43.3.10861 or later.

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

High · Fix available · CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

]]>Patch now: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAhttps://watch.wildcardgroup.be/?i=2026-10-20-incwgw:2026-10-20-incTue, 20 Oct 2026 00:00:00 +0000palo-alto-networkspalo-alto-networks:cloud-ngfwpalo-alto-networks:pan-ospalo-alto-networks:prisma-accessAttackers can get past the login, over the internet, without logging in.

What to do: Update the affected Palo Alto Networks products to the fixed version for your release line (for example 12.1.4-h6, 11.2.4-h17 or 11.1.4-h33).

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.

High · Fix available · CVE-2026-0257

]]>Patch now: Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Executionhttps://watch.wildcardgroup.be/?i=2026-10-20-fortisiemwgw:2026-10-20-fortisiemTue, 20 Oct 2026 00:00:00 +0000Attackers can run their own code, over the internet, without logging in.

What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

Critical · Fix available · CVE-2026-106173

]]>Patch this month: EG Secure Solutions SiteGuard Server Edition: OS Command Injectionhttps://watch.wildcardgroup.be/?i=2026-10-20-eg-secure-solutions-siteguard-server-editionwgw:2026-10-20-eg-secure-solutions-siteguard-server-editionTue, 20 Oct 2026 00:00:00 +0000eg-secure-solutionseg-secure-solutions:siteguard-server-editionAttackers can run their own code, once they have access to the device.

What to do: Update EG Secure Solutions SiteGuard Server Edition to the fixed version for your release line (for example Ver8.00 Update 5, Ver3.10 or Ver7.00 Update 6).

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

High · Fix available · CVE-2026-106931

]]>Patch this month: Multiple High Severity Vulnerabilities in Apache Camelhttps://watch.wildcardgroup.be/?i=2026-10-20-ccb-apache-camelwgw:2026-10-20-ccb-apache-camelTue, 20 Oct 2026 00:00:00 +0000apache-camelWhat to do: Install the security update for Apache Camel. The CCB advisory lists the affected and fixed versions.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

High · Fix available

]]>Check exposure: Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Siteshttps://watch.wildcardgroup.be/?i=2026-10-20-aiwgw:2026-10-20-aiTue, 20 Oct 2026 00:00:00 +0000What to do: If you have an account or data there: expect phishing that uses the leaked details, change any password you reused, and watch for fraud. If they are your supplier, ask them what of yours was involved.

Unrated ·

]]>Patch this month: Siemens Software Center: Uncontrolled Search Path Elementhttps://watch.wildcardgroup.be/?i=2026-10-20-siemens-software-centerwgw:2026-10-20-siemens-software-centerMon, 19 Oct 2026 00:00:00 +0000siemenssiemens:software-centerAttackers can run their own code, once they have access to the device, with an admin account.

What to do: Update Siemens Software Center to V4.0.9.8 or later.

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Medium · Fix available · CVE-2026-110936

]]>Patch this month: Heap-Based Buffer Overflows in NGINX Plus and NGINX Open Source Can Be Exploited to Cause Denial of Service or Code Executionhttps://watch.wildcardgroup.be/?i=2026-10-19-ccb-nginx-plus-and-nginx-open-sourcewgw:2026-10-19-ccb-nginx-plus-and-nginx-open-sourceMon, 19 Oct 2026 00:00:00 +0000nginx-plusnginx-open-sourceMemory corruption that can let attackers run code.

What to do: Install the security update for NGINX Plus and NGINX Open Source. The CCB advisory lists the affected and fixed versions.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

High · Fix available

]]>Patch this month: Template Injection Vulnerability in Adobe Commerce and Magento Open Source Can Be Exploited to Execute Arbitrary Codehttps://watch.wildcardgroup.be/?i=2026-10-19-ccb-adobe-commerce-and-magento-open-sourcewgw:2026-10-19-ccb-adobe-commerce-and-magento-open-sourceMon, 19 Oct 2026 00:00:00 +0000adobe-commercemagento-open-sourceAttackers can run their own code.

What to do: Install the security update for Adobe Commerce and Magento Open Source. The CCB advisory lists the affected and fixed versions.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

High · Fix available

]]>Check now: OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respondhttps://watch.wildcardgroup.be/?i=2026-10-18-aiwgw:2026-10-18-aiSun, 18 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch now: BeyondTrust Remote Support: Authentication Bypass by Spoofinghttps://watch.wildcardgroup.be/?i=2026-10-16-beyondtrust-remote-supportwgw:2026-10-16-beyondtrust-remote-supportFri, 16 Oct 2026 00:00:00 +0000beyondtrustbeyondtrust:remote-supportAttackers can get past the login, over the internet, without logging in.

What to do: Follow the vendor advisory for BeyondTrust Remote Support: install the update or apply the mitigation it lists.

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.

Critical · Check vendor · CVE-2026-102764

]]>Patch now: Multiple Critical Vulnerabilities in Juniper Networks Junos OShttps://watch.wildcardgroup.be/?i=2026-10-16-ccb-juniper-networks-junos-oswgw:2026-10-16-ccb-juniper-networks-junos-osFri, 16 Oct 2026 00:00:00 +0000juniper-networks-junos-osWhat to do: Install the security update for Juniper Networks Junos OS. The CCB advisory lists the affected and fixed versions.

The Centre for Cybersecurity Belgium (CCB) warns about this and advises to patch immediately. The CCB advisory lists the affected versions and the fix.

Critical · Fix available

]]>Patch this month: Fortinet (multiple products): Path Traversalhttps://watch.wildcardgroup.be/?i=2026-10-16-fortinet-multiple-productswgw:2026-10-16-fortinet-multiple-productsFri, 16 Oct 2026 00:00:00 +0000fortinetfortinet:multiple-productsAttackers can read or write files they should not reach, once they have access to the device, with an admin account.

What to do: Install the security update for the affected Fortinet products from the vendor advisory.

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Medium · Fix available · CVE-2025-61624

]]>Patch now: Atlassian (multiple products): Files or Directories Accessible to External Partieshttps://watch.wildcardgroup.be/?i=2026-10-15-atlassian-multiple-productswgw:2026-10-15-atlassian-multiple-productsThu, 15 Oct 2026 00:00:00 +0000atlassianatlassian:multiple-productsAttackers can read files they should not reach, over the internet, without logging in.

What to do: Update the affected Atlassian products to the fixed version for your release line (for example 10.2.24, 12.1.12 or 10.2.8).

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

Critical · Fix available · CVE-2026-21589

]]>Patch now: AhsayCBS: 2 flaws exploited togetherhttps://watch.wildcardgroup.be/?i=2026-10-14-ahsay-ahsaycbswgw:2026-10-14-ahsay-ahsaycbsWed, 14 Oct 2026 00:00:00 +0000ahsayahsay:ahsaycbsAttackers can get past the login, over the internet, without logging in.

What to do: Update AhsayCBS to 10.3.4 or later.

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.

Critical · Fix available · CVE-2026-105133, CVE-2026-105134

]]>Patch now: Cisco Secure Email Gateway: Relative Path Traversalhttps://watch.wildcardgroup.be/?i=2026-10-14-cisco-secure-email-gatewaywgw:2026-10-14-cisco-secure-email-gatewayWed, 14 Oct 2026 00:00:00 +0000ciscocisco:secure-email-gatewayAttackers can read or write files they should not reach, over the internet, without logging in.

What to do: Follow the vendor advisory for Cisco Secure Email Gateway: install the update or apply the mitigation it lists.

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

Critical · Check vendor · CVE-2026-76519, CVE-2026-20353, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442

]]>Patch now: Palo Alto Networks PAN-OS: Code Injectionhttps://watch.wildcardgroup.be/?i=2026-10-14-palo-alto-networks-pan-oswgw:2026-10-14-palo-alto-networks-pan-osWed, 14 Oct 2026 00:00:00 +0000palo-alto-networkspalo-alto-networks:pan-osAttackers can run their own code, over the internet, with an admin account.

What to do: Update Palo Alto Networks PAN-OS to the fixed version for your release line (for example 12.2.4, 12.1.10-h2 or 11.2.16).

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

High · Fix available · CVE-2026-0322, CVE-2026-0307, CVE-2026-0312, CVE-2026-0313, CVE-2026-0314

]]>Patch now: Ivanti Connect Secure: Authentication Bypass by Spoofinghttps://watch.wildcardgroup.be/?i=2026-10-13-ivanti-connect-securewgw:2026-10-13-ivanti-connect-secureTue, 13 Oct 2026 00:00:00 +0000ivantiivanti:connect-secureAttackers can get past the login, over the internet, without logging in.

What to do: Update Ivanti Connect Secure to the fixed version for your release line (for example 25.1.3.0, 25.1.3.1 or 22.8R2.5).

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

High · Fix available · CVE-2026-104935

]]>Patch this month: Microsoft Windows: Command Injectionhttps://watch.wildcardgroup.be/?i=2026-10-13-microsoft-windowswgw:2026-10-13-microsoft-windowsTue, 13 Oct 2026 00:00:00 +0000microsoftmicrosoft:windowsAttackers can run their own code, over the internet, without logging in, once a user opens a file or link.

What to do: Update Microsoft Windows to the fixed version for your release line (for example 20260925.100, 10.0.14393.9612 or 10.0.17763.9376).

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

High · Fix available · CVE-2026-96951

]]>Check your dependencies: GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Historieshttps://watch.wildcardgroup.be/?i=2026-10-09-ghostactionwgw:2026-10-09-ghostactionFri, 09 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Upgrade or isolate: Strapi: Cleartext Storage of Sensitive Informationhttps://watch.wildcardgroup.be/?i=2026-10-08-strapi-strapiwgw:2026-10-08-strapi-strapiThu, 08 Oct 2026 00:00:00 +0000strapistrapi:strapiAttackers can read sensitive data, over the internet, with an admin account.

What to do: This version of Strapi may be end of life and gets no more fixes. Move to a supported version, or cut it off from the internet until you can.

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

High · Unsupported · CVE-2023-22894

]]>Patch this month: ONLYOFFICE Docs: Server Path Traversalhttps://watch.wildcardgroup.be/?i=2026-10-08-onlyoffice-docswgw:2026-10-08-onlyoffice-docsThu, 08 Oct 2026 00:00:00 +0000onlyofficeonlyoffice:docsAttackers can read or write files they should not reach, over the internet, without logging in.

What to do: Follow the vendor advisory for ONLYOFFICE Docs: install the update or apply the mitigation it lists.

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

Critical · Check vendor · CVE-2021-3199

]]>Patch this month: ProFTPD: Improper Access Controlhttps://watch.wildcardgroup.be/?i=2026-10-08-proftpd-proftpdwgw:2026-10-08-proftpd-proftpdThu, 08 Oct 2026 00:00:00 +0000proftpdproftpd:proftpdAttackers can reach functions they should not have access to, over the internet, without logging in.

What to do: Follow the vendor advisory for ProFTPD: install the update or apply the mitigation it lists.

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Critical · Check vendor · CVE-2015-3306

]]>Patch this month: ISC BIND: Data Processing Errorshttps://watch.wildcardgroup.be/?i=2026-10-08-isc-bindwgw:2026-10-08-isc-bindThu, 08 Oct 2026 00:00:00 +0000iscisc:bindAttackers can crash or block the service, over the internet, without logging in.

What to do: Follow the vendor advisory for ISC BIND: install the update or apply the mitigation it lists.

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

High · Check vendor · CVE-2015-5477

]]>Patch this month: Apache Struts: Command Injectionhttps://watch.wildcardgroup.be/?i=2026-10-08-apache-strutswgw:2026-10-08-apache-strutsThu, 08 Oct 2026 00:00:00 +0000apacheapache:strutsAttackers can run their own code, over the internet, without logging in.

What to do: Follow the vendor advisory for Apache Struts: install the update or apply the mitigation it lists.

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

High · Check vendor · CVE-2016-3081

]]>Check your dependencies: Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke Ithttps://watch.wildcardgroup.be/?i=2026-10-08-tensorlakewgw:2026-10-08-tensorlakeThu, 08 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch this month: Cisco NX-OS Software Python Sandbox Escape Vulnerabilityhttps://watch.wildcardgroup.be/?i=2026-10-07-nx-oswgw:2026-10-07-nx-osWed, 07 Oct 2026 00:00:00 +0000ciscocisco:cisco-nx-os-softwareAttackers can crash or block the service, once they have access to the device.

What to do: Look up the vendor's advisory (linked on this item) and install the fix, or apply the mitigation it lists, now.

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device.

Critical · Check vendor · CVE-2026-20032, CVE-2026-20038, CVE-2026-20173, CVE-2026-76453, CVE-2026-76455

]]>Check your dependencies: SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoorshttps://watch.wildcardgroup.be/?i=2026-10-05-subquerywgw:2026-10-05-subqueryMon, 05 Oct 2026 00:00:00 +0000What to do: Check whether you use this package, extension or tool, and which version. If you installed an affected version: remove it, and rotate every credential and token that machine or pipeline could reach.

Unrated · Check vendor

]]>Patch this month: Citrix NetScaler: Improper Restriction of Operations within the Bounds of a Memory Bufferhttps://watch.wildcardgroup.be/?i=2026-10-04-citrix-netscalerwgw:2026-10-04-citrix-netscalerFri, 02 Oct 2026 00:00:00 +0000citrixcitrix:netscalerAttackers can crash or block the service, over the internet, without logging in.

What to do: Update Citrix NetScaler to the fixed version for your release line (for example 14.1-73.41, 13.1-64.28 or 14.1-73.41 FIPS).

Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.

High · Fix available · CVE-2026-88779

]]>Patch this month: GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1https://watch.wildcardgroup.be/?i=2026-10-02-gitlabwgw:2026-10-02-gitlabFri, 02 Oct 2026 00:00:00 +0000gitlabgitlab:gitlab-ai-gatewayWhat to do: Update GitLab AI Gateway to the fixed version for your release line (for example 19.2.4, 19.3.2 or 19.4.1).

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the…

Critical · Fix available · CVE-2026-90970

]]>Patch this month: Fortinet FortiMail: Path Traversalhttps://watch.wildcardgroup.be/?i=2026-10-01-fortinet-fortimailwgw:2026-10-01-fortinet-fortimailThu, 01 Oct 2026 00:00:00 +0000fortinetfortinet:fortimailAttackers can read or write files they should not reach, over the internet, without logging in.

What to do: Install the security update for Fortinet FortiMail from the vendor advisory.

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

Critical · Fix available · CVE-2026-104286

]]>Patch this month: Cisco Catalyst SD-WAN Manager: Hex Encodinghttps://watch.wildcardgroup.be/?i=2026-09-30-cisco-catalyst-sd-wan-managerwgw:2026-09-30-cisco-catalyst-sd-wan-managerWed, 30 Sep 2026 00:00:00 +0000ciscocisco:catalyst-sd-wan-managerWhat to do: Follow the vendor advisory for Cisco Catalyst SD-WAN Manager: install the update or apply the mitigation it lists.

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

Critical · Check vendor · CVE-2026-76504

]]>Patch this month: Zammad: 2 flaws exploited togetherhttps://watch.wildcardgroup.be/?i=2026-10-02-zammad-gmbh-zammadwgw:2026-10-02-zammad-gmbh-zammadWed, 30 Sep 2026 00:00:00 +0000zammadzammad:zammadAttackers can gain higher privileges, over the internet, without logging in, once a user opens a file or link.

What to do: Update Zammad to 6.5.4 or 7.2.2 or later.

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.

High · Fix available · CVE-2026-102489, CVE-2026-102490

]]>