Microsoft fixed a known issue causing black screens, desktop loading problems, and Windows Explorer crashes after installing Windows 11 updates released since August 2026. The problem primarily affected Azure Virtual Desktop hosts using FSLogix for profile management. Microsoft released cumulative updates on October 13, 2026, that resolve the issue. A temporary workaround involves manually launching Windows Explorer via Task Manager. Enterprise customers can also apply Known Issue Rollback group policies to mitigate the problem until the update is installed.
CVE-2026-79824 is a directory traversal vulnerability in Hewlett Packard Enterprise HPE NonStop Python 3.x. It allows attackers to overwrite arbitrary files by using a '..' sequence in filenames within a TAR archive. This can lead to high impact on confidentiality, integrity, and availability of the affected system.
CVE-2026-18661 is a high-severity vulnerability in Eclipse Jetty affecting multiple versions of jetty-annotations and jetty-eeN-annotations. The issue arises when a servlet has multiple url-patterns defined in web.xml, and security constraints apply only to some of those patterns. In this case, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotations and web.xml security-constraints are not properly enforced, potentially leading to incomplete security coverage for certain url-patterns.
CVE-2026-79823 is a stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop EMS Distributor. This vulnerability may cause undesirable behavior due to improper handling of buffer boundaries. It has a medium severity rating with a CVSS score of 4.0. There is no information about affected versions or available patches. No known exploits are reported in the wild.
The Slican IPx telephone exchange's WebCTI service stored temporary subscriber passwords in plaintext within its database. This vulnerability allows an attacker with database access to retrieve user passwords and potentially log into subscriber accounts. The issue was resolved in version 6.62.0100 of the IPx series.
Slican IPx telephone exchanges' WebCTI service is vulnerable to SQL Injection via the /webcti/admin_json.php endpoint. This vulnerability allows an authenticated attacker to execute SQL Injection attacks due to improper neutralization of input. The issue affects versions prior to 6.62.0100 and has been fixed in version 6.62.0100.
Slican IPx telephone exchanges use symmetric encryption with a hardcoded secret key in multiple binary files, allowing attackers with access to these files to decrypt TCP/IP communications. This vulnerability is fixed in IPx series version 6.62.0100. End-of-life products CCT-1668 (CCT1CPU), MAC-6400, and CXS-0424 remain vulnerable and will not receive updates due to hardware upgrade requirements. Users of these discontinued devices should contact the vendor's service department for upgrade options.
CVE-2026-101287 is a critical authentication bypass vulnerability in Diaple Stela versions prior to 1.60.1. The application relies on a cookie named “authProcess” that contains userId and validSteps values without validating their integrity. An attacker can manipulate this cookie to bypass authentication and impersonate any user, including those with SUPER_ADMIN privileges, thereby obtaining a valid JWT token with administrative access.
CVE-2026-101290 is a high-severity vulnerability in the SICK AG Sick_Safetyscanners_Base CPP Driver. A remote attacker can send a specially crafted network packet that triggers an out-of-bounds memory read due to improper validation of packet length. This flaw can cause the application to crash, resulting in a denial-of-service condition. No confidentiality or integrity impact is indicated. The affected versions are from 0 up to and including 1.0.4.
CVE-2026-77711 is a high-severity information exposure vulnerability in Eclipse Jetty's HttpClient. When making requests through a forward proxy, if the server responds with a 407 Proxy Authentication Required status, the client incorrectly treats this as a proxy challenge and resends the request with proxy authentication headers. This causes the proxy credentials to be sent to the server, exposing sensitive authentication information.
CVE-2026-76184 is a high-severity vulnerability in Eclipse Jetty's HttpClient where improper path normalization in redirects can cause authentication credentials to be sent to unintended paths. Specifically, if a redirect contains a path like '/secure/../evil', HttpClient matches credentials against '/secure' instead of normalizing to '/evil', potentially exposing the Authorization header to an attacker-controlled path on the same domain.
CVE-2026-104618 is a vulnerability in SUSE Linux Enterprise Server 16.1 where the sdbootutil script creates a debug log file (/var/log/sdbootutil.log) with world-readable permissions. This incorrect permission assignment allows any low-privileged user on the system to read potentially sensitive information from the log file.
CVE-2026-76182 is a medium severity vulnerability in Eclipse Jetty where the TryPathsHandler and TryFilesFilter components improperly handle URI path characters when forwarding requests to template URIs. This causes reserved characters in URI queries to be misinterpreted as multiple query parameters instead of a single parameter value.
CVE-2026-104617 is a medium severity vulnerability in SUSE Linux Enterprise Server 16.1 where private data such as $pin and $key are leaked via the /proc filesystem due to insufficient protection in the use of the qrencode utility. This allows low-privileged users to access sensitive credentials. The vulnerability has a CVSS score of 5.1 and does not have a known exploit in the wild. No patch or remediation information is currently provided.
CVE-2026-16438 is an incorrect privilege assignment vulnerability affecting Mitsubishi Electric GENESIS64 and related products up to version 10.97.3, as well as all versions of MC Works64. The issue arises because installers grant default DCOM permissions to administrator accounts unnecessarily, allowing those accounts to launch and operate DCOM objects locally or remotely without required UAC elevation. This can lead to unauthorized disclosure, tampering, destruction, or deletion of internal information, or cause denial-of-service conditions.
CVE-2026-16437 is a high-severity vulnerability in Mitsubishi Electric Corporation GENESIS and related products. It involves a weak password recovery mechanism that allows an authenticated local administrator to tamper with the management file storing the challenge response. This file is protected by Windows, but administrators can read and write it, enabling potential disclosure, tampering, destruction, or deletion of internal information, or causing a denial-of-service condition. The vulnerability affects multiple GENESIS product versions and related software. A patch is available to address this issue.
"Handmade Marketplace App - Creema" for Android contains an open redirect vulnerability that allows an attacker to craft URLs which redirect users to attacker-controlled websites within the app. This can facilitate phishing attacks by displaying malicious sites inside the app's interface.
CVE-2026-16436 is a critical vulnerability in Mitsubishi Electric Corporation's GENESIS and related products involving a weak password recovery mechanism. The challenge response used to unlock the system is fixed and common to all users, allowing a remote attacker to bypass authentication. This vulnerability affects multiple versions of GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. Exploitation could lead to unauthorized disclosure, tampering, destruction, or deletion of internal information, or cause a denial-of-service condition. A patch is available, and the affected products are cloud services with vendor-managed remediation.
The Android application 'Vehicle Inspection Certificate Viewer' by the Ministry of Land, Infrastructure, Transport and Tourism has a vulnerability where sensitive information, including API integration credentials like access ID and access key, may be included in data sent by the app. This could lead to exposure of these credentials. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or remediation information is currently provided.
CVE-2026-102477 is a high-severity vulnerability in Eclipse Vert.x affecting versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and version 5.2.0. The issue arises because the gRPC endpoint's configurable maximum message size limit applies only to the compressed message size, not the uncompressed content size. This discrepancy allows an attacker to exploit compression bomb attacks, causing the endpoint to allocate more memory than intended.