This entry is a daily update from the SANS Internet Storm Center (ISC) Stormcast podcast dated October 21, 2026. It provides general information about the ISC handlers and links to educational content but does not describe any specific security threat or vulnerability.

The provided content is a routine ISC Stormcast podcast announcement referencing the date and links to classes taught by a handler. There are no technical details, vulnerability information, or threat indicators included in the source content.

SANS ISC Handlers Diary

Original Source

ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st)

The Duplicator and Duplicator Pro WordPress plugins are vulnerable to PHP Object Injection via deserialization of untrusted data in versions up to 1.5.17 and 4.6.10 respectively. This vulnerability allows unauthenticated attackers to store malicious serialized objects in public site content, which are later deserialized during migration or import operations performed by an administrator. Exploitation can lead to remote code execution or file deletion, including critical files like wp-config.php, potentially resulting in site takeover. The vulnerability requires an administrator to perform a migration action after the malicious payload is stored.

CVE-2026-82814 is a deserialization of untrusted data vulnerability (CWE-502) affecting the Duplicator and Duplicator Pro WordPress plugins. Attackers can inject serialized PHP objects into public site content without authentication. When an administrator later builds a package and performs a migration or import, the plugin unserializes this data in the DUPX_UpdateEngine::unserializeTest() function. Duplicator Free includes a Requests 1.7 PHP Object Injection chain allowing attacker-controlled callbacks that lead to direct OS command execution. Duplicator Pro includes a gadget enabling deletion of attacker-selected files if the directory is writable by the PHP process, including wp-config.php, which can expose the setup wizard and enable site takeover if the attacker controls a reachable database. The attack requires the malicious payload to be stored first and a subsequent administrator migration action.

CVE Database V5

The Duplicator and Duplicator Pro WordPress plugins are vulnerable to PHP Object Injection via deserialization of untrusted data in versions up to 1.5.17 and 4.6.10 respectively. This vulnerability allows unauthenticated attackers to store malicious serialized objects in public site content, which a

CVE-2026-82814: CWE-502 Deserialization of Untrusted Data in smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More

CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service component, triggered by manipulation of the firewallEn argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed, increasing the risk of exploitation.

This vulnerability involves a stack-based buffer overflow in the formSetFirewallCfg function within the /goform/SetFirewallCfg endpoint of the Tenda AC19 router firmware version 16.03.10.07. The issue arises from improper handling of the firewallEn argument, allowing an attacker to overwrite the stack. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 base score is 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability. Public exploit code is available, though no active exploitation in the wild has been reported.

CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service component, triggered by manipulation of the firewallEn argument. This vulnerability ca

CVE-2026-113744: Stack-based Buffer Overflow in Tenda AC19

tt-metal

CVE-2026-113743 is a path traversal vulnerability in Tenstorrent tt-metal versions up to 0.80.0. The flaw exists in the function load_hf_state_dict_filtered within the file models/tt_transformers/tt/load_checkpoints.py. This vulnerability allows remote attackers to manipulate the weight_map argument to perform path traversal. A public exploit is available. Upgrading to version 0.81.0-dev20261016 addresses the issue.

This vulnerability in Tenstorrent tt-metal affects the load_hf_state_dict_filtered function, where improper handling of the weight_map argument enables path traversal attacks. This can be triggered remotely, potentially allowing attackers to access unauthorized file system locations. The vulnerability is fixed in version 0.81.0-dev20261016, with the patch identified by commit 4851ccf347f6903c3d819eed60705600386e52c3. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-113743 is a path traversal vulnerability in Tenstorrent tt-metal versions up to 0.80.0. The flaw exists in the function load_hf_state_dict_filtered within the file models/tt_transformers/tt/load_checkpoints.py. This vulnerability allows remote attackers to manipulate the weight_map argument

CVE-2026-113743: Path Traversal in Tenstorrent tt-metal

CVE-2026-113741 is a cross-site scripting (XSS) vulnerability in the itsourcecode Online Cake Ordering System version 1.0. The issue exists in the /404.php file where manipulation of the useruid argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. The CVSS 4.0 score rates this as a medium severity issue.

The vulnerability in itsourcecode Online Cake Ordering System 1.0 involves improper sanitization of the useruid parameter in the /404.php file, allowing an attacker to inject malicious scripts via cross-site scripting (XSS). This can be triggered remotely without privileges but requires user interaction to exploit. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported.

CVE-2026-113741 is a cross-site scripting (XSS) vulnerability in the itsourcecode Online Cake Ordering System version 1.0. The issue exists in the /404.php file where manipulation of the useruid argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. The 

CVE-2026-113741: Cross Site Scripting in itsourcecode Online Cake Ordering System

acrobat-for-edge

CVE-2026-48279 is an out-of-bounds write vulnerability in Adobe Acrobat for Edge that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 up to and including 154.0.4258.37. No patch information is currently provided, and no known exploits are reported in the wild.

Adobe Acrobat for Edge contains an out-of-bounds write vulnerability (CWE-787) that allows an attacker to execute arbitrary code in the context of the current user. This vulnerability requires the victim to open a specially crafted malicious file to trigger the flaw. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. The affected versions are from 0 up to and including 154.0.4258.37. No vendor patch or remediation details are currently available, and no active exploitation has been reported.

CVE-2026-48279 is an out-of-bounds write vulnerability in Adobe Acrobat for Edge that can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Exploitation requires user interaction by opening a malicious file. The vulnerability affects versions from 0 u

CVE-2026-48279 has been rejected

Official rejection reason