{
  "schemaVersion": 1,
  "updatedOn": "2026-10-22",
  "dateConvention": "Each entry uses the primary advisory's publication or coordinated-disclosure date, rather than the date an attacker acted. Later guidance is dated separately. Checked dates record editorial source review, not a guarantee that no subsequent update exists.",
  "editorialBoundary": "A security update is not evidence of a breach. Confirmed compromise, possible exposure and observed exploitation are labeled separately. Affected products, versions and configurations vary. These sources do not endorse this site or Motoko; migration does not replace immediate patching, credential rotation or incident response.",
  "entries": [
    {
      "id": "php",
      "product": "PHP",
      "layer": "Application runtime",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "PHP security advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Two critical runtime flaws",
      "summary": "PHP's emergency release fixes two critical vulnerabilities that can allow unauthenticated remote code execution in web-request deployments.",
      "action": "Apply the PHP security update or your vendor's equivalent immediately; the maintainers say there are no complete mitigations.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "PHP security advisory",
        "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
      },
      "additionalSources": [
        {
          "label": "NetScaler affected-management-interface guidance",
          "url": "https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/",
          "date": "2026-10-21"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/php.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "nodejs",
      "product": "Node.js",
      "layer": "Application runtime",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "Node.js security-release publication",
      "checkedOn": "2026-10-22",
      "title": "Security fixes across supported releases",
      "summary": "Node.js security updates for the 22.x, 24.x and 26.x lines include a high-severity Brotli decoder flaw that can permit remote code execution.",
      "action": "Update to the fixed release for your supported Node.js line and review the advisory for the features your application uses.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Node.js security release",
        "url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
      },
      "logo": {
        "file": "/assets/logos/advisories/nodedotjs.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "litellm",
      "product": "LiteLLM",
      "layer": "AI software supply chain",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "Vendor incident-report publication; report updated 21 October at 20:30 UTC",
      "checkedOn": "2026-10-22",
      "title": "Compromised release artifacts",
      "summary": "LiteLLM confirms that its compromised release pipeline published malicious 1.107.0 PyPI wheels and container images; private enterprise releases were not affected.",
      "action": "Follow the incident-response guidance, replace affected artifacts with a verified clean release and rotate credentials reachable from affected hosts.",
      "evidenceLabel": "Confirmed compromise",
      "evidenceKind": "confirmed-compromise",
      "source": {
        "label": "LiteLLM incident report",
        "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
      },
      "logo": {
        "file": "/assets/logos/advisories/litellm.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "railway",
      "product": "Railway",
      "layer": "Hosting platform / credentials",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "Initial disclosure publication; credential-response guides published 22 October",
      "checkedOn": "2026-10-22",
      "title": "Possible exposure of stored secrets",
      "summary": "Railway says an unauthorized party may have accessed customer environment variables and decrypted some contents; the scope remains under investigation.",
      "action": "Rotate secrets stored in Railway, review service logs and follow the additional AWS or Google Cloud guidance where those credentials were used.",
      "evidenceLabel": "Possible exposure",
      "evidenceKind": "possible-exposure",
      "source": {
        "label": "Railway disclosure",
        "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st"
      },
      "additionalSources": [
        {
          "label": "AWS credential-response guidance",
          "url": "https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access",
          "date": "2026-10-22"
        },
        {
          "label": "Google Cloud credential-response guidance",
          "url": "https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-gcp-access",
          "date": "2026-10-22"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/railway.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "gitlab",
      "product": "GitLab",
      "layer": "Development infrastructure",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "Critical patch-release publication",
      "checkedOn": "2026-10-22",
      "title": "Critical server code-execution fix",
      "summary": "GitLab's patch release fixes a critical regular-expression compiler flaw and other security issues in affected self-managed Community and Enterprise Edition installations.",
      "action": "Upgrade affected self-managed installations to a fixed supported release; GitLab.com already includes the fixes.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "GitLab critical patch release",
        "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"
      },
      "logo": {
        "file": "/assets/logos/advisories/gitlab.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "traefik",
      "product": "Traefik",
      "layer": "Proxy authentication",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "Maintainer advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Identity could cross client connections",
      "summary": "Traefik's ForwardAuth middleware could pass another user's identity when authentication used connection-bound schemes such as NTLM or Negotiate.",
      "action": "Update affected deployments to a fixed release and review the advisory if your authentication server uses a connection-bound scheme.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Traefik maintainer advisory",
        "url": "https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8"
      },
      "logo": {
        "file": "/assets/logos/advisories/traefikproxy.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "emudhra",
      "product": "eMudhra",
      "layer": "Certificate trust / WebPKI",
      "date": "2026-10-20",
      "dateLabel": "20 Oct 2026",
      "dateBasis": "Cloudflare report publication; Cloudflare learned of the incident on 19 October around 17:00 UTC",
      "checkedOn": "2026-10-22",
      "title": "Eight intermediate certificate keys compromised",
      "summary": "Cloudflare reports compromised private keys for eight eMudhra intermediate certificates; its security review found no active exploitation on Cloudflare services.",
      "action": "Apply the relevant software and trust-store updates, and review configured certificate authorities as directed in the report.",
      "evidenceLabel": "Confirmed key compromise",
      "evidenceKind": "confirmed-compromise",
      "source": {
        "label": "Cloudflare response report",
        "url": "https://blog.cloudflare.com/emudhra-certificate-compromise/"
      }
    },
    {
      "id": "mysql",
      "product": "Oracle / Java / MySQL",
      "layer": "Database and enterprise software",
      "date": "2026-10-20",
      "dateLabel": "20 Oct 2026",
      "dateBasis": "Quarterly Critical Patch Update publication",
      "checkedOn": "2026-10-22",
      "title": "Quarterly patches across enterprise products",
      "summary": "Oracle's quarterly update includes 98 security patches across MySQL products and 55 for Java SE; exposure varies by product, component and version.",
      "action": "Use the product-specific risk matrices and patch instructions to update affected installations.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Oracle MySQL patch matrix",
        "url": "https://www.oracle.com/security-alerts/cpuoct2026.html#AppendixMSQL"
      },
      "additionalSources": [
        {
          "label": "Oracle quarterly update and other product matrices",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ]
    },
    {
      "id": "mcp-typescript-sdk",
      "product": "MCP TypeScript SDK",
      "layer": "Agent server isolation",
      "date": "2026-10-15",
      "dateLabel": "15 Oct 2026",
      "dateBasis": "Maintainer advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Shared HTTP instances could leak messages",
      "summary": "Affected @modelcontextprotocol/server HTTP deployments could deliver one client's messages to another when clients shared a server or transport instance.",
      "action": "Upgrade to version 2.3.0 or later and use the documented request or session isolation pattern.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "MCP SDK maintainer advisory",
        "url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp"
      },
      "logo": {
        "file": "/assets/logos/advisories/model-context-protocol.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "nginx",
      "product": "NGINX",
      "layer": "Web server and proxy",
      "date": "2026-10-14",
      "dateLabel": "14 Oct 2026",
      "dateBasis": "Security-fix release publication",
      "checkedOn": "2026-10-22",
      "title": "Five configuration-dependent security fixes",
      "summary": "NGINX fixed five medium-severity vulnerabilities involving specific rewrite, expression-evaluation, HTTP/3, TLS session-ticket and asynchronous-I/O configurations.",
      "action": "Update affected installations to a fixed supported release and check the feature-specific conditions in the advisories.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "NGINX security advisories",
        "url": "https://nginx.org/en/security_advisories.html"
      },
      "additionalSources": [
        {
          "label": "14 October release announcement",
          "url": "https://nginx.org/news.html"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/nginx.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "linux",
      "product": "Linux",
      "layer": "Operating system / virtualization",
      "date": "2026-10-14",
      "dateLabel": "14 Oct 2026",
      "dateBasis": "Coordinated oss-sec disclosure; linked research write-up is dated 12 October",
      "checkedOn": "2026-10-22",
      "title": "vhost flaw permits privilege escalation",
      "summary": "A Linux vhost cache flaw can give a local user with vhost-device access root privileges, with a guest-escape path under specific virtualization conditions.",
      "action": "Install the fixed kernel or vendor backport and reboot; apply the advisory's device-access restrictions while unpatched.",
      "evidenceLabel": "Research disclosure",
      "evidenceKind": "security-disclosure",
      "source": {
        "label": "Researcher's coordinated disclosure",
        "url": "https://seclists.org/oss-sec/2026/q4/153"
      },
      "logo": {
        "file": "/assets/logos/advisories/linux.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "nextjs-react",
      "product": "Next.js / React",
      "layer": "Application framework",
      "date": "2026-10-14",
      "dateLabel": "14 Oct 2026",
      "dateBasis": "Next.js security-update publication",
      "checkedOn": "2026-10-22",
      "title": "Critical flaws in server-side features",
      "summary": "Next.js fixed two critical remote-code-execution paths and a high-severity denial-of-service issue affecting particular server-side features and dependencies.",
      "action": "Upgrade to a fixed Next.js release and review the advisory for the affected App Router, image-optimization and Server Actions configurations.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Next.js security update",
        "url": "https://nextjs.org/blog/nextjs-security-update-october-14-2026"
      },
      "logo": {
        "file": "/assets/logos/advisories/nextdotjs.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "palo-alto",
      "product": "Palo Alto Networks",
      "layer": "Firewall management interface",
      "date": "2026-10-14",
      "dateLabel": "14 Oct 2026",
      "dateBasis": "Initial advisory publication; updated 15 October",
      "checkedOn": "2026-10-22",
      "title": "PAN-OS management flaw exploited",
      "summary": "Palo Alto Networks reports very limited exploitation of a PAN-OS management-interface flaw that lets an authenticated attacker execute code as root.",
      "action": "Install the fixed release for your PAN-OS branch and restrict management-interface access to trusted systems.",
      "evidenceLabel": "Observed exploitation",
      "evidenceKind": "observed-exploitation",
      "source": {
        "label": "Palo Alto Networks advisory",
        "url": "https://security.paloaltonetworks.com/CVE-2026-0322"
      },
      "logo": {
        "file": "/assets/logos/advisories/paloaltonetworks.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "dotnet-framework",
      "product": ".NET Framework",
      "layer": "Application runtime",
      "date": "2026-10-13",
      "dateLabel": "13 Oct 2026",
      "dateBasis": "Microsoft cumulative-update release date",
      "checkedOn": "2026-10-22",
      "title": "Runtime security updates",
      "summary": "Microsoft's cumulative update fixes multiple security issues in .NET Framework, including remote code execution, denial of service and privilege escalation.",
      "action": "Apply the update appropriate to your installed .NET Framework and Windows versions using Microsoft's product-specific links.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Microsoft .NET Framework update",
        "url": "https://learn.microsoft.com/en-us/dotnet/framework/release-notes/2026/10-13-october-cumulative-update"
      },
      "logo": {
        "file": "/assets/logos/advisories/dotnet.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "drupal-field-ui",
      "product": "Drupal core",
      "layer": "Content management system",
      "date": "2026-10-14",
      "dateLabel": "14 Oct 2026",
      "dateBasis": "Drupal security advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Critical code-execution flaw in Field UI",
      "summary": "Drupal's Field UI vulnerability is not directly exploitable with core alone, but contributed modules or custom code can expose exploit paths, including one requiring no authentication.",
      "action": "Update supported installations to Drupal 10.6.19, 11.3.19 or 11.4.10 as appropriate; uninstalling Field UI provides temporary protection while updating.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Drupal SA-CORE-2026-014",
        "url": "https://www.drupal.org/sa-core-2026-014"
      },
      "logo": {
        "file": "/assets/logos/advisories/drupal.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "apache-camel-spring-redis",
      "product": "Apache Camel / Spring Redis",
      "layer": "Application integration / data serialization",
      "date": "2026-10-15",
      "dateLabel": "15 Oct 2026",
      "dateBasis": "Apache Camel CVE-2026-78165 advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Redis messages could reach an unsafe deserializer",
      "summary": "Camel's default Spring Redis serializer could deserialize untrusted Java objects before route processing. An actor able to publish to a subscribed Redis channel could reach code execution.",
      "action": "Upgrade to Camel 4.18.5, 4.22.1 or 4.23.0 for your supported line. If upgrading is delayed, follow Apache's serializer-filter guidance and restrict Redis publishers.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Apache Camel CVE-2026-78165",
        "url": "https://camel.apache.org/security/CVE-2026-78165.html"
      },
      "logo": {
        "file": "/assets/logos/advisories/apache.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "keycloak-token-exchange",
      "product": "Keycloak",
      "layer": "Identity and token exchange",
      "date": "2026-10-13",
      "dateLabel": "13 Oct 2026",
      "dateBasis": "Keycloak 26.8.1 security-fix release publication; the underlying CVE issue was opened 25 September",
      "checkedOn": "2026-10-22",
      "title": "Token exchange could bypass required certificate binding",
      "summary": "A Standard Token Exchange V2 request could bypass a confidential client's required mTLS certificate binding when the requester already held its credentials and a valid subject token.",
      "action": "Use a supported release containing the CVE-2026-97846 fix, including 26.8.1, and review the upgrade guide and your token-exchange configuration.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Keycloak 26.8.1 security release",
        "url": "https://www.keycloak.org/2026/10/keycloak-2681-released"
      },
      "additionalSources": [
        {
          "label": "Keycloak CVE-2026-97846 issue and conditions",
          "url": "https://github.com/keycloak/keycloak/issues/53187",
          "date": "2026-09-25"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/keycloak.svg",
        "kind": "symbol",
        "link": "https://www.keycloak.org/"
      }
    },
    {
      "id": "postgresql-odbc",
      "product": "PostgreSQL ODBC driver",
      "layer": "Database connector",
      "date": "2026-10-14",
      "dateLabel": "14 Oct 2026",
      "dateBasis": "psqlODBC 18.00.0005 security release publication",
      "checkedOn": "2026-10-22",
      "title": "Large parameter lists could corrupt driver memory",
      "summary": "psqlODBC versions 08.01.0102 through 18.00.0004 could corrupt application memory when binding an excessive number of statement parameters. Exposure depends on how applications construct parameter lists.",
      "action": "Upgrade to psqlODBC 18.00.0005. Until then, cap parameter counts built from external input or use an array parameter as described by the maintainer.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "psqlODBC CVE-2026-109448 release advisory",
        "url": "https://www.postgresql.org/about/news/psqlodbc-18000005-released-with-security-fix-for-cve-2026-109448-3404/"
      },
      "logo": {
        "file": "/assets/logos/advisories/postgresql.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "cisco-expressway",
      "product": "Cisco Expressway",
      "layer": "Communications appliance / database service",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "Cisco CVE-2026-76466 advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Clustered Expressway devices could expose root commands",
      "summary": "Cisco reports a critical database-service flaw in vulnerable clustered Expressway-C and Expressway-E deployments. A remote attacker with network access and the relevant cookies could execute operating-system commands as root.",
      "action": "Update affected Expressway deployments to a fixed release, including X15.5.20 for the listed X15 line; Cisco lists no workaround.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Cisco Expressway CVE-2026-76466 advisory",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t"
      }
    },
    {
      "id": "postgresql-jdbc",
      "product": "PostgreSQL JDBC driver",
      "layer": "Database connector / authentication",
      "date": "2026-10-07",
      "dateLabel": "7 Oct 2026",
      "dateBasis": "pgJDBC 42.7.14 release and maintainer advisories; PostgreSQL news announcement followed 9 October",
      "checkedOn": "2026-10-22",
      "title": "Driver fixes authentication-policy and data-leak flaws",
      "summary": "pgJDBC 42.7.14 fixes a fail-open authentication-policy configuration and a separate flaw that could store earlier statement bytes when an application supplied a value shorter than its declared length.",
      "action": "Upgrade to pgJDBC 42.7.14. Review requireAuth settings and use the maintainer's documented authentication-policy workaround if an immediate upgrade is unavailable.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "PostgreSQL JDBC 42.7.14 security release",
        "url": "https://jdbc.postgresql.org/changelogs/2026-10-07-42.7.14-release/"
      },
      "additionalSources": [
        {
          "label": "CVE-2026-107314 authentication-policy advisory",
          "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h",
          "date": "2026-10-07"
        },
        {
          "label": "CVE-2026-107315 statement-data disclosure advisory",
          "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3",
          "date": "2026-10-07"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/postgresql.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "wordpress-7-1-3-20261006",
      "product": "WordPress core",
      "layer": "Application / CMS",
      "date": "2026-10-06",
      "dateLabel": "6 October 2026",
      "dateBasis": "WordPress maintenance and security release publication date",
      "checkedOn": "2026-10-22",
      "title": "WordPress 7.1.3 fixes seven security issues",
      "summary": "WordPress's release includes stored cross-site scripting, denial of service, WXR-export SQL injection and private-comment disclosure fixes. This is a core security update, separate from the PHP runtime update.",
      "action": "Install WordPress 7.1.3 or the applicable backported security release for your deployed branch. Confirm the installed version; maintainers identify only the latest major release as actively supported.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "WordPress: 7.1.3 maintenance and security release",
        "url": "https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/"
      },
      "additionalSources": [
        {
          "label": "WordPress release versions",
          "url": "https://wordpress.org/documentation/article/wordpress-versions/"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/wordpress.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "adobe-commerce-apsb26-153-20261013",
      "product": "Adobe Commerce / Magento Open Source",
      "layer": "Application / commerce",
      "date": "2026-10-13",
      "dateLabel": "13 October 2026",
      "dateBasis": "APSB26-153 publication date",
      "checkedOn": "2026-10-22",
      "title": "Commerce security update includes unauthenticated code-execution fixes",
      "summary": "APSB26-153 addresses critical, high and medium issues in affected Commerce and Magento releases, including arbitrary code execution. Adobe explicitly says it is not aware of in-the-wild exploits for these issues.",
      "action": "Apply the October security update for your supported product and release line, using Adobe's version table. Adobe also requires the separate CVE-2026-75650 hotfix; do not assume the monthly update includes it.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Adobe security bulletin APSB26-153",
        "url": "https://www.adobe.com/trust/security/products/commerce/apsb26-153.html"
      },
      "additionalSources": [],
      "logo": {
        "file": "/assets/logos/advisories/magento.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "laravel-tokenguard-cve-2026-114509",
      "product": "Laravel framework",
      "layer": "Application / authentication",
      "date": "2026-10-19",
      "dateLabel": "19 October 2026",
      "dateBasis": "Maintainer GitHub security advisory publication date",
      "checkedOn": "2026-10-22",
      "title": "Laravel TokenGuard authentication bypass under affected database configurations",
      "summary": "CVE-2026-114509 affects Laravel's built-in token-based API guard with certain MySQL/MariaDB configurations. Crafted non-string credentials can authenticate as an existing user without that user's API token; it does not describe every Laravel authentication setup.",
      "action": "Update laravel/framework to at least 13.29.0 or 12.68.0 on the corresponding release line. Inventory routes using the built-in TokenGuard and verify the deployed Composer version.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Laravel: Token-based API guard auth bypass",
        "url": "https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6"
      },
      "additionalSources": [],
      "logo": {
        "file": "/assets/logos/advisories/laravel.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "tomcat-october-disclosures-20261020",
      "product": "Apache Tomcat",
      "layer": "Retained service / Java application server",
      "date": "2026-10-20",
      "dateLabel": "20 October 2026",
      "dateBasis": "Public disclosure date stated in Apache's advisories; fixed-version releases are dated 12 October",
      "checkedOn": "2026-10-22",
      "title": "Tomcat discloses request mix-up and conditional authentication-bypass fixes",
      "summary": "Apache discloses HTTP/2 request/response mix-ups in asynchronous servlets and a JNDIRealm password-validation bypass when non-GSSAPI SASL is configured. Tomcat 11 also has an AJP response mix-up. Scope depends on connector, version and realm configuration.",
      "action": "Upgrade affected deployments to at least Tomcat 11.0.27, 10.1.61 or 9.0.123 on their respective branches, and compare each CVE's affected range with deployed connectors and authentication settings.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Apache Tomcat 11 vulnerabilities: October fixes",
        "url": "https://tomcat.apache.org/security-11.html"
      },
      "additionalSources": [
        {
          "label": "Apache Tomcat 10 vulnerabilities",
          "url": "https://tomcat.apache.org/security-10"
        },
        {
          "label": "Apache Tomcat 9 vulnerabilities",
          "url": "https://tomcat.apache.org/security-9.html"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/apachetomcat.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "apache-httpd-2-4-69-20261001",
      "product": "Apache HTTP Server",
      "layer": "Web server",
      "date": "2026-10-01",
      "dateLabel": "1 October 2026",
      "dateBasis": "Apache HTTP Server 2.4.69 security release date",
      "checkedOn": "2026-10-22",
      "title": "Apache HTTP Server 2.4.69 fixes module-specific security flaws",
      "summary": "Apache's October release fixes multiple module and configuration-specific issues, including CGI redirect handler confusion, WebDAV crashes and data corruption, and HTTP/2 memory handling. These are security fixes, not evidence that every Apache deployment was compromised.",
      "action": "Upgrade affected httpd 2.4 installations to 2.4.69 or the vendor's fixed package. Review enabled CGI, DAV, HTTP/2 and proxy modules against the individual advisories rather than treating every CVE as universally reachable.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Apache HTTP Server 2.4 vulnerabilities: fixed in 2.4.69",
        "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
      },
      "additionalSources": [
        {
          "label": "Apache HTTP Server 2.4.69 release announcement",
          "url": "https://downloads.apache.org/httpd/Announcement2.4.html"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/apache.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "vite",
      "product": "Vite",
      "layer": "Development tooling",
      "date": "2026-10-21",
      "dateLabel": "21 Oct 2026",
      "dateBasis": "Maintainer advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Development-server file restrictions bypassed",
      "summary": "Vite 6.4.4 can expose files blocked by server.fs.deny when its development server is explicitly exposed to the network and the files sit within allowed directories. The maintainer rates the issue moderate.",
      "action": "Update the affected Vite 6 installation to 6.4.5 and avoid exposing development servers unnecessarily.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Vite maintainer advisory",
        "url": "https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj"
      },
      "logo": {
        "file": "/assets/logos/advisories/vite.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "openssh-ubuntu",
      "product": "OpenSSH on Ubuntu",
      "layer": "Server administration / retained tooling",
      "date": "2026-10-19",
      "dateLabel": "19 Oct 2026",
      "dateBasis": "Ubuntu security-notice publication; upstream OpenSSH 10.6 was released 6 October",
      "checkedOn": "2026-10-22",
      "title": "SSH client and server security fixes",
      "summary": "Ubuntu issued fixes covering OpenSSH path handling, authentication state, compression and forwarding restrictions. The notice applies to Ubuntu 26.10 packages, rather than every OpenSSH installation.",
      "action": "Install Ubuntu 26.10 package version 1:10.5p1-1ubuntu3.1 or a later security update. Other distributions should use their own vendor guidance.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Ubuntu OpenSSH security notice",
        "url": "https://ubuntu.com/security/notices/USN-8937-1"
      },
      "additionalSources": [
        {
          "label": "OpenSSH 10.6 release notes",
          "url": "https://www.openssh.org/txt/release-10.6",
          "date": "2026-10-06"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/ubuntu.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "pillow-openjpeg",
      "product": "Pillow / OpenJPEG",
      "layer": "Image-processing dependency",
      "date": "2026-10-17",
      "dateLabel": "17 Oct 2026",
      "dateBasis": "Maintainer advisory publication; fixed Pillow 13.0.0 release dated 16 October",
      "checkedOn": "2026-10-22",
      "title": "Bundled image decoder permits heap writes",
      "summary": "Pillow wheels from 11.1.0 through 12.3.0 bundle an OpenJPEG decoder with a heap-buffer-overflow write reachable while loading crafted JPEG 2000 images. Updating only the host operating system does not replace the wheel’s bundled library.",
      "action": "Upgrade to Pillow 13.0.0 or later and restrict accepted image formats in upload and preview pipelines.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Pillow maintainer advisory",
        "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8"
      },
      "additionalSources": [
        {
          "label": "Pillow 13.0.0 security release notes",
          "url": "https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html",
          "date": "2026-10-16"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/pillow.png",
        "kind": "wordmark"
      }
    },
    {
      "id": "pypdf-jpeg",
      "product": "pypdf",
      "layer": "Document-processing dependency",
      "date": "2026-10-17",
      "dateLabel": "17 Oct 2026",
      "dateBasis": "Maintainer advisory and fixed-release publication; later CVE indexing is not the disclosure date",
      "checkedOn": "2026-10-22",
      "title": "PDF images could reach unintended decoders",
      "summary": "Before pypdf 6.21.1, a crafted PDF image labeled as JPEG could invoke other Pillow image parsers. This issue affects environments with the optional Pillow dependency installed; it does not establish code execution by itself.",
      "action": "Upgrade pypdf to 6.21.1 or later; maintainers also link the patch for installations that cannot yet upgrade.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "pypdf maintainer advisory",
        "url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv"
      },
      "additionalSources": [
        {
          "label": "pypdf 6.21.1 release",
          "url": "https://github.com/py-pdf/pypdf/releases/tag/6.21.1",
          "date": "2026-10-17"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/pypdf.png",
        "kind": "wordmark"
      }
    },
    {
      "id": "aiohttp-resource-use",
      "product": "aiohttp",
      "layer": "Application HTTP dependency",
      "date": "2026-10-07",
      "dateLabel": "7 Oct 2026",
      "dateBasis": "Maintainer advisory publication; fixed 3.14.4 release was published 5 October",
      "checkedOn": "2026-10-22",
      "title": "Crafted requests could exhaust resources",
      "summary": "The aiohttp maintainers disclosed multiple cases of excessive or unbounded memory and CPU consumption on attacker-controlled requests. Versions through 3.14.3 are affected.",
      "action": "Update to aiohttp 3.14.4 or later and review the advisory against the request-handling features the service uses.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "aiohttp maintainer advisory",
        "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5"
      },
      "additionalSources": [
        {
          "label": "aiohttp 3.14.4 release",
          "url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4",
          "date": "2026-10-05"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/aiohttp.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "atlassian-october-2026",
      "product": "Atlassian Data Center",
      "layer": "Enterprise application dependencies",
      "date": "2026-10-20",
      "dateLabel": "20 Oct 2026",
      "dateBasis": "Vendor monthly security-bulletin publication",
      "checkedOn": "2026-10-22",
      "title": "Monthly dependency and application fixes",
      "summary": "Atlassian's October bulletin fixes third-party dependency and application vulnerabilities across its Data Center products. The vendor assesses the listed issues as non-critical risk in the affected products; upstream severity ratings do not describe each product's risk. The bulletin does not report observed exploitation.",
      "action": "Use the product-specific fixed-version table. For example, Confluence Data Center fixes are 11.0.0, 10.2.19 LTS or 9.2.26 LTS; Bitbucket fixes are 10.5.1, 10.2.8 LTS or 9.4.26 LTS. Review the affected branch and supported upgrade path.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Atlassian October bulletin",
        "url": "https://confluence.atlassian.com/security/security-bulletin-october-20-2026-1874690162.html"
      },
      "logo": {
        "file": "/assets/logos/advisories/atlassian.svg",
        "kind": "symbol",
        "alt": "Atlassian"
      }
    },
    {
      "id": "atlassian-file-access",
      "product": "Atlassian Data Center products",
      "layer": "Enterprise web applications",
      "date": "2026-10-05",
      "dateLabel": "5 Oct 2026",
      "dateBasis": "Vendor critical-advisory publication; outside the preferred 7–22 October window",
      "checkedOn": "2026-10-22",
      "title": "Unauthenticated access to web-root files",
      "summary": "CVE-2026-21589 permits access to specific files beneath affected application roots when the attacker knows their exact names and paths. It does not enumerate directories. Atlassian says its patched Cloud products showed no evidence of exploitation; that statement must not be generalized to customer-managed instances.",
      "action": "Patch affected installations to the vendor-listed fixed version: Confluence 9.2.26 or 10.2.19; Jira Software 9.12.40, 10.3.26 or 11.3.12; other products have separate fixes. If patching is delayed, restrict external access and apply the vendor-tested proxy or rewrite mitigation.",
      "evidenceLabel": "Security disclosure",
      "evidenceKind": "security-disclosure",
      "source": {
        "label": "Atlassian critical file-access advisory",
        "url": "https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html"
      },
      "logo": {
        "file": "/assets/logos/advisories/atlassian.svg",
        "kind": "symbol",
        "alt": "Atlassian"
      }
    },
    {
      "id": "netscaler-saml",
      "product": "NetScaler ADC and Gateway",
      "layer": "Retained enterprise access infrastructure",
      "date": "2026-10-08",
      "dateLabel": "8 Oct 2026",
      "dateBasis": "Vendor bulletin CTX697191 initial publication",
      "checkedOn": "2026-10-22",
      "title": "SAML memory overflow needs a further update",
      "summary": "CVE-2026-107406 can cause remote code execution or denial of service in customer-managed SAML SP/IdP configurations. Version-specific preconditions apply: newer affected builds require SAML IdP, while older builds can also be exposed as SAML SP. Citrix said it knew of no unmitigated exploits at publication.",
      "action": "Apply 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 FIPS/NDcPP, or a later supported fixed release for that branch. Earlier September/October fixes do not cover this issue. Review the bulletin configuration matrix; Citrix-managed cloud services are updated by Citrix.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "NetScaler SAML security bulletin",
        "url": "https://support.citrix.com/external/article/CTX697191/"
      },
      "additionalSources": [
        {
          "label": "Vendor publication and exploitation context",
          "url": "https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/"
        }
      ]
    },
    {
      "id": "sharepoint-october-2026",
      "product": "SharePoint Server Subscription Edition",
      "layer": "Enterprise web applications",
      "date": "2026-10-13",
      "dateLabel": "13 Oct 2026",
      "dateBasis": "Microsoft cumulative security-update publication",
      "checkedOn": "2026-10-22",
      "title": "Cumulative fixes include code execution",
      "summary": "KB5002927 addresses SharePoint code execution, disclosure, spoofing, privilege and security-feature bypass issues, alongside a Word code-execution issue. It applies to the on-premises Subscription Edition release, not SharePoint Online. The update article does not establish exploitation of the listed issues.",
      "action": "Install KB5002927, build 16.0.20326.20190, following the SharePoint deployment instructions. Farms using SharePoint Workflow Manager require KB5002799 first. Classic Workflow Manager needs the documented debug-flag step. The package replaces KB5002908.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Microsoft SharePoint security update",
        "url": "https://support.microsoft.com/en-us/servicing/office/hotfix/sharepoint/5002927"
      }
    },
    {
      "id": "django",
      "product": "Django",
      "layer": "Application framework",
      "date": "2026-10-06",
      "dateLabel": "6 Oct 2026",
      "dateBasis": "Django security-release publication",
      "checkedOn": "2026-10-22",
      "title": "Framework security fixes and a stronger geometry mitigation",
      "summary": "Django fixes denial-of-service, spatial-lookup request forgery and model-formset privilege issues. The affected features and input conditions differ; default auto-increment model primary keys are not affected by the formset issue.",
      "action": "Upgrade supported installations to Django 6.1.2, 6.0.9 or 5.2.18, or a later security release in the same supported line.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Django security releases",
        "url": "https://www.djangoproject.com/weblog/2026/oct/06/security-releases/"
      },
      "logo": {
        "file": "/assets/logos/advisories/django.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "go",
      "product": "Go",
      "layer": "Application runtime and standard library",
      "date": "2026-10-08",
      "dateLabel": "8 Oct 2026",
      "dateBasis": "Go security-release publication; later certificate guidance dated separately",
      "checkedOn": "2026-10-22",
      "title": "Fifteen toolchain and standard-library security fixes",
      "summary": "Go fixes HTTP/2 denial-of-service, HTTP request and response handling, template escaping and other issues. Exposure depends on which standard-library features a program uses.",
      "action": "Use the current supported security release, Go 1.27.3 or 1.26.10 as checked on 22 October, and rebuild and redeploy affected applications. These include the 8 October fixes and a separate 19 October certificate-trust mitigation.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Go team: 1.27.2 and 1.26.9 security release",
        "url": "https://groups.google.com/g/golang-dev/c/DaXYwdKVkRA"
      },
      "additionalSources": [
        {
          "label": "Go team: later certificate-trust security update",
          "url": "https://groups.google.com/g/golang-announce/c/66pojueaQek",
          "date": "2026-10-19"
        },
        {
          "label": "Go release history",
          "url": "https://go.dev/doc/devel/release#go1.27.2"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/go.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "craft-cms",
      "product": "Craft CMS",
      "layer": "Content management system",
      "date": "2026-10-05",
      "dateLabel": "5 Oct 2026",
      "dateBasis": "Craft CMS maintainer advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Authenticated code execution through component rendering",
      "summary": "A malicious or compromised account with basic Control Panel access can trigger operating-system command execution as the PHP/web-server account through the render-components action when an entry type and entry already exist. The advisory affects Craft CMS 5.0.0 through versions before 5.11.0.",
      "action": "Update affected Craft CMS 5 installations to 5.11.0 or later and review Control Panel account access. This is an authenticated flaw, not anonymous code execution.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Craft CMS maintainer security advisory",
        "url": "https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv"
      },
      "logo": {
        "file": "/assets/logos/advisories/craftcms.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "roundcube",
      "product": "Roundcube Webmail",
      "layer": "Webmail application",
      "date": "2026-10-19",
      "dateLabel": "19 Oct 2026",
      "dateBasis": "Roundcube security-release publication",
      "checkedOn": "2026-10-22",
      "title": "Webmail security fixes across supported branches",
      "summary": "Roundcube fixes IMAP and mail-header injection, server-side request forgery filtering, session deserialization and other webmail issues. Each issue has its own affected feature and prerequisites.",
      "action": "Update production Roundcube 1.6.x installations to 1.6.20 and 1.7.x installations to 1.7.5, or later security releases in the same supported line.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Roundcube security updates 1.6.20 and 1.7.5",
        "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"
      },
      "logo": {
        "file": "/assets/logos/advisories/roundcube.svg",
        "kind": "symbol"
      }
    },
    {
      "id": "symfony",
      "product": "Symfony",
      "layer": "PHP application framework",
      "date": "2026-10-15",
      "dateLabel": "15 Oct 2026",
      "dateBasis": "Symfony component security-advisory publication",
      "checkedOn": "2026-10-22",
      "title": "Request parsing and untrusted-input denial of service",
      "summary": "Symfony fixes costly parsing of a crafted Cache-Control request header, plus process crashes when applications parse untrusted expressions or deeply nested YAML. The header flaw needs no authentication; the other paths depend on application features.",
      "action": "Update affected components to the fixed versions in the advisories. The current follow-up fixes are included in Symfony 5.4.54, 6.4.48, 7.4.21 and 8.1.9.",
      "evidenceLabel": "Security update",
      "evidenceKind": "security-update",
      "source": {
        "label": "Symfony: Cache-Control header parsing advisory",
        "url": "https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"
      },
      "additionalSources": [
        {
          "label": "Symfony: ExpressionLanguage nesting advisory",
          "url": "https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process",
          "date": "2026-10-15"
        },
        {
          "label": "Symfony: YAML inline lexer recursion advisory",
          "url": "https://symfony.com/blog/cve-2026-109413-unbounded-recursion-in-the-yaml-inline-lexer-lets-a-single-document-crash-the-process",
          "date": "2026-10-15"
        }
      ],
      "logo": {
        "file": "/assets/logos/advisories/symfony.svg",
        "kind": "symbol"
      }
    }
  ]
}