Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical remote code execution flaws and warned exploits could appear within hours or days.
Stories per day · 30 days
36 RSS
Relatedadvisory16canada12rce12cve5gitlab5use-after-free5apache-kylin4chrome4cve-2026-972294f54google4nginx4ci-cd3drupal3privilege-escalation3adobe2apache2authentication-bypass2
362 stories, newest first · one card per story
Stories tagged #patch
Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries
X.Org patched multiple security flaws in five X client libraries, with releases now available.
Google security advisory (AV26-1060)
Canada's Cyber Centre urges updates for vulnerable Chrome builds before 155.0.8059.84.
BMC Helix security advisory (AV26-1059)
Canada's Cyber Centre says BMC Helix Network Management before 26.3.01 is vulnerable and urges updates.
Progress security advisory (AV26-1058)
Canada’s Cyber Centre urges updates for critical MOVEit Transfer flaws fixed in 2025.1.6 and 2026.0.4.
AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764
BeyondTrust Remote Support CVE-2026-102764 is being exploited for unauthenticated file upload and full appliance compromise.
6
CVE-2026-104715: cifs-utils 4.2-7.8 mount-option injection in mount.cifs
cifs-utils 7.9 fixes CVE-2026-104715, a mount.cifs option-injection flaw enabling local privilege escalation.
Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation
Progress patched 12 MOVEit Transfer flaws, including authentication bypass, with no exploitation reported.
4
Mozilla security advisory (AV26-1057)
Canada’s Cyber Centre urges updates for Firefox, Firefox ESR, and Thunderbird flaws fixed in October 2026 releases.
F5 addressed critical RCE flaws in NGINX
F5 patched three critical NGINX flaws that can allow unauthenticated remote code execution.
Palo Alto Networks security advisory (AV26-1056)
Canada’s Cyber Centre flags a Palo Alto Idira Secrets Manager flaw fixed in version 13.9.1.
Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs
Google patched ten Chrome 155 flaws, including critical Prerender use-after-free CVE-2026-110922, with no known exploitation.
F5, Juniper Networks Patch Critical Vulnerabilities
F5 and Juniper patched critical NGINX and Junos flaws that can lead to remote code execution.
Critical Collabora Online Flaw Lets Attackers Execute Commands on Nextcloud Servers
Unauthenticated command injection CVE-2026-110447 in Nextcloud's built-in Collabora CODE Server can run commands as the web user.
Microsoft Patches Two Dozen RCE Flaws in Office
Microsoft patched about two dozen high-severity Office remote-code-execution flaws, none known exploited.
CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion
Apache Kylin 4.0.0–5.0.4 lets project admins exhaust computed-column resources through a cache API.
CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF
Apache Kylin 4.0.0 through 5.0.4 has a moderate job-driver SSRF flaw, fixed in 5.0.5.
Critical Adobe Acrobat Flaw Lets Malicious PDFs Trigger One-Click Memory Corruption
Adobe patched Acrobat CVE-2026-81983, a PDF memory-corruption flaw with no known exploitation.
JetBrains security advisory (AV26-1050)
Canada’s Cyber Centre urged patches for vulnerabilities in JetBrains Datalore, Junie CLI, TeamCity, and YouTrack.
F5 security advisory (AV26-1049)
Canada’s Cyber Centre urges updates for multiple NGINX and F5 products affected by three new CVEs.
Drupal security advisory (AV26-1047)
Canada's Cyber Centre warns of critical remote code execution in unpatched Drupal core releases.
Google security advisory (AV26-1045)
Canada's Cyber Centre urges updates for desktop Chrome before 155.0.8059.79 after Google's October advisory.
USN-8922-2: Linux kernel (Azure) vulnerabilities
Ubuntu patched multiple Azure Linux kernel flaws that could let an attacker compromise the system.
Update Chrome: Google fixes 37 security flaws, including seven critical bugs
Google patched 37 Chrome flaws, including seven critical bugs that can enable remote code execution.