Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-76001) that allows a low-privileged attacker to potentially escalate privileges by accessing internal resources. The vulnerability does not require user interaction but depends on conditions outside the attacker's control. It affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating.
Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-75748) that allows an attacker with high privileges to escalate access to internal resources without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating with a CVSS score of 7.6.
Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that can be exploited to cause an application denial-of-service (DoS). This vulnerability allows an attacker to crash the application without requiring any user interaction. The issue affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.
Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that may allow an attacker to disclose sensitive memory information without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue has a high severity with a CVSS score of 7.5, indicating a significant confidentiality impact but no integrity or availability impact.
CVE-2026-107370 is a vulnerability in the Auth0 auth0-lock library where, under certain conditions involving Active Directory usernames formatted as domains without a local part, authentication requests use the GET method instead of POST. This causes sensitive user form data to be included in the URL query string, potentially exposing it in logs or browser history. The issue affects versions from 10.9.0 up to but not including 13.2.1, and from 14.0.0 up to but not including 15.0.2. The CVSS score is 5.3, indicating a medium severity impact primarily due to confidentiality concerns. There is no information provided about patches or vendor advisories. No known exploits are reported in the wild.
A Cross-Site Scripting (XSS) vulnerability exists in Broadcom Symantec Endpoint Detection and Response (SEDR) Console versions 4.12 and prior to 4.13. This vulnerability allows an attacker to inject malicious scripts that execute in the context of another user's session, potentially leading to unauthorized access to restricted functionality or information.
Microsoft released patches addressing 1,417 vulnerabilities on October 13, 2026, including 76 critical issues. Among these, seven critical vulnerabilities require no customer action. One vulnerability was publicly disclosed before the patch release, and one is already exploited in the wild. Notable vulnerabilities include a Windows Shell security feature bypass (CVE-2026-96951) that allows bypassing the "Mark of the Web" feature, facilitating code execution if a user opens a malicious file, and a .NET Framework security feature bypass (CVE-2026-108398) that could bypass application control. Additionally, Windows DHCP Server and Microsoft Exchange Server have multiple critical remote code execution vulnerabilities. The update also addresses numerous Office vulnerabilities. Microsoft has released patches for these issues, and customers should apply updates promptly.
Microsoft has announced that Windows 11 version 24H2 Home and Pro editions have reached end of support as of October 13, 2026. These editions will no longer receive monthly security or non-security updates, including protections against the latest security threats. Users are advised to upgrade to Windows 11 version 26H2, which is currently rolling out and will be supported until October 2029. Enterprise and Education editions of Windows 11 24H2 remain supported until October 12, 2027. The end of support means devices running these Home and Pro editions will not receive further security patches, potentially increasing exposure to vulnerabilities if not upgraded.
Elio file manager versions up to 1.13.0 have an insecure temporary file vulnerability that allows local users to overwrite files owned by other users by creating symbolic links at predictable temporary file paths. This can lead to truncation and overwriting of victim-owned files when previewing media, fonts, or archives. The vulnerability requires knowledge of the victim's Elio process ID and local access to the system. The CVSS 4.0 base score is 4.1, indicating medium severity.
Misskey, an open source federated social media platform, has a vulnerability in versions from 12.0.0 through 13.14.2, from 2023.9.0-beta.1 up to but not including 2025.4.1, and from 2025.5.0 up to but not including 2026.7.0. The issue involves incomplete cleanup during file uploads, which can lead to exhaustion of storage or file descriptors, causing a denial of service. This vulnerability is fixed in version 2026.7.0.
Misskey versions from 12.0.0 through 13.14.2 and from 2023.9.0-beta.1 up to but not including 2026.7.0 have a vulnerability in the unauthenticated fetch-rss API. This API lacks rate limiting and response size restrictions and performs synchronous XML parsing. An attacker can exploit this to cause unbounded outbound HTTP requests and synchronous parsing, leading to resource exhaustion on the instance, amplification of requests toward third-party servers, or probing of network-reachable services even if federation is disabled. The issue is fixed in version 2026.7.0.
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.13, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.
CVE-2026-33374 is a vulnerability in Grafana Enterprise affecting the Prometheus rule conversion API endpoints. These endpoints do not limit the size of the request body, allowing authenticated users to cause unbounded memory allocations. This can lead to out-of-memory conditions that crash the server. The vulnerability affects multiple versions of Grafana Enterprise from 12.0.0 through versions prior to 12.3.12, 12.4.0 through prior to 12.4.13, 13.0.0 through prior to 13.0.11, 13.1.0 through prior to 13.1.8, and 13.2.0 through prior to 13.2.4. The CVSS score is 6.5, indicating a medium severity impact focused on availability disruption.
CVE-2026-104004 is a high-severity vulnerability in MongoDB Server affecting certain versions. It involves a NULL pointer dereference in the collection validation feature, which can cause the server process to crash when a document is inserted. This issue affects authenticated users with write access. The vulnerability exists in MongoDB Server versions >=8.0 and <8.0.34, >=8.3.0 and <8.3.13, and >=9.0 and <9.0.4.
A middleware bypass vulnerability exists in hono versions from 4.12.4 up to but not including 4.13.11. This flaw in the serveStatic middleware allows unauthenticated attackers to bypass prefix middleware by exploiting double decoding of percent-encoded paths, enabling access to static files without authentication checks.
A vulnerability in Siemens SIMATIC IPC BX-21A and related models allows bypassing UEFI Secure Boot protections due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. This affects all versions prior to V31.01.13 for IPC BX-21A, prior to V1.1.4 for IPC RW-543A, and prior to V28.01.15 for IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G. An attacker with local physical or administrative access could exploit this to boot unauthorized operating systems or UEFI applications, potentially compromising device confidentiality, integrity, and availability.
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
CVE-2026-108954 is a buffer overflow vulnerability in the OfflineTransducerGreedySearchDecoder::Decode function of k2-fsa sherpa-onnx versions 1.13.0 through 1.13.8. The issue arises from improper handling of the vocab_size argument, which can be exploited remotely by supplying malformed or tampered model metadata. While using only official model packs with consistent metadata may prevent exploitation in normal usage, the underlying vulnerability remains due to lack of validation.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-13. It is categorized as OSINT related to network activity and payload delivery but lacks detailed technical information or specific malware signatures.
Shaark versions 1.2.13 through 1.2.44 have an authorization bypass vulnerability in several API controllers. Authenticated non-admin users can exploit this flaw by sending PUT or DELETE requests with numeric IDs to overwrite or delete content owned by other users, including private items. This occurs due to missing ownership checks in the Link, Story, Chest, and Album API controllers.