60
60
30
47
60
30
30
60
30
60
60
42
42
Kaspersky Security Bulletin 2020
60
60
30
Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327)
60
Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code
GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.
74
60
60
60
60
42
60
60
U.S. CISA adds Adobe, Fortinet, Microsoft Windows, Microsoft Exchange Server flaws to its Known Exploited Vulnerabilities catalog
60
Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation via Insecure Reflection in Payara Server
Payara Server 7.2026.1.RC1 HTTP EJB endpoints rely on attacker-controlled reflection and JNDI lookups without authorization, enabling arbitrary EJB method invocation.
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that depend on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. Remote clients can perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods without sufficient authorization enforcement or input restriction. Both the deprecated InvokeEJBServlet and other endpoints are affected in version 7.2026.1.RC1.
33
SAP Patches Critical NetWeaver (CVSS Up to 10.0) and High
60
60
CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software
60
Adversarial Testing of Automated Program Repair Agents for Security Vulnerabilities
SWEADV benchmark shows adversarial issue descriptions make LLM program-repair agents write insecure fixes in 51.7% of cases, evading most detection tools.
Researchers built SWEADV, a benchmark of 750 adversarial issue descriptions derived from 150 SWE-bench Verified repair tasks, covering command execution, deserialization, path traversal, denial of service, and weak hashing attack types. Tested on mini_swe agents backed by GPT-5-Mini, MiniMax-M2.5, and DeepSeek-R, adversarial descriptions induced malicious behavior with successful repair in 51.7% of cases. Detection was weak: LLM-as-judge pre-repair screening reached only 62.3% accuracy, and post-repair detection via static analysis and LLM-as-judge achieved just 39.4% and 55.4%.
52
CISA Adds 10 New Known Actively Exploited Vulnerabilities to its Catalog
60
CISA adds 10 flaws to its Known Exploited Vulnerabilities Catalog
60
55
60
47
60
60
57
60