Apple released security patches on October 26, 2026, addressing 304 vulnerabilities across multiple products including iOS, iPadOS, macOS, tvOS, watchOS, and Safari. The update includes fixes for several critical issues such as a previously exploited CoreGraphics vulnerability, unauthorized camera access by malicious apps, and local attacks on the Keychain. Other vulnerabilities allow privilege escalation, denial-of-service, memory corruption, arbitrary code execution, and bypass of security controls like Gatekeeper and Privacy preferences. The patches cover a wide range of components including Spotlight, Kernel, Mail, AppleAVD, Model I/O, and Screen Sharing Server. No new vulnerabilities are reported as already exploited in the wild in this update. The affected versions include recent releases of iOS, iPadOS, macOS Golden Gate, Tahoe, Sequoia, tvOS, watchOS, visionOS, and Safari.
CVE-2026-88781 is a vulnerability in certain ASUS motherboard firmware involving untrusted pointer dereference. A user with kernel-level privileges can supply an arbitrary memory address via an I/O command, potentially leading to system information tampering or a system crash. The vulnerability has a medium severity score of 6.8. No specific affected versions or patch information are provided in the available data.
CVE-2026-116640 is a cross-site scripting (XSS) vulnerability in the Saruf-Ratul HR-Payroll-Management-System. The flaw exists in an unknown functionality of the file chat.php, where manipulation of the argument ID allows remote attackers to execute XSS attacks. The product uses rolling releases, so specific affected or fixed versions are not available. The vendor has been informed but has not yet responded or issued a fix. Exploit code has been published, increasing the risk of exploitation.
A cybersecurity incident at the University of New Mexico Health System forced the diversion of patients from its main hospital and the cancellation of appointments at over 30 clinics. The incident disrupted emergency services, including the state's only Level 1 trauma center, and led to a phased resumption of operations. The nature and extent of the cybersecurity issue remain unclear, and the matter is under active law enforcement investigation.
CVE-2026-111497, known as Brotli2Shell, is a critical out-of-bounds write vulnerability in Google's Brotli C decoder library. It affects many widely used software projects that decompress Brotli data, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow, ClickHouse, and PHP for Windows. The flaw can be triggered by decompressing crafted Brotli data, potentially leading to process crashes, memory leaks, or remote code execution. The vulnerability has a high CVSSv4.0 score of 9.2 assigned by Google. Patches have been released for the Brotli library and major runtimes, but some projects had not shipped fixed releases as of late October 2026. Applications bundling their own Brotli decoder require individual updates.
CVE-2026-116639 is a cross-site scripting (XSS) vulnerability in the MD-MAFUJUL-HASAN Online-Payroll-Management-System affecting an unknown function in chat.php. The vulnerability arises from manipulation of the 'ID' argument and can be exploited remotely. The product uses a rolling release model, so no specific affected or fixed versions are available. The issue was reported early to the project, but no response or fix has been provided yet. Public exploit code is available. The CVSS 4.0 score is 5.1, indicating medium severity.
CVE-2026-116839 is a Cross-Site Request Forgery (CSRF) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker can trick an authenticated user into visiting a malicious page, causing unauthorized changes and potentially triggering a Denial of Service (DoS) on the device. The vulnerability affects versions prior to 6.3.26. A fix is available in version 6.3.26.
CVE-2026-116838 is a Cross-Site Request Forgery (CSRF) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker can trick an authenticated user into visiting a malicious page, which could then execute a command injection on the device. This vulnerability affects versions prior to 6.3.26 and has been assigned a high severity score of 8.8. A fix is available in version 6.3.26.
CVE-2026-116623 is a vulnerability in code-projects Simple Content Management System version 1.0. It involves missing authorization in the admin interface component, specifically in the /web/admin/welcome.php file. The flaw arises from manipulation of the 'addnews' argument, allowing remote attackers to exploit the system without proper authorization. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-116837 is a heap-based buffer overflow vulnerability affecting Ubiquiti Inc's airMAX M, LTU, SolarPoint, and SolarSwitch devices. An attacker with access to the adjacent network can exploit this flaw to execute arbitrary code on the affected devices. The vulnerability has a high severity with a CVSS score of 8.8. Fixed versions are available for all affected products.
fclairamb ftpserverlib versions up to 0.32.4 have a vulnerability where sensitive information such as file contents and directory listings can be transmitted in cleartext. This occurs because the software only checks a transferTLS flag set by the PROT command, not whether the actual data connection uses TLS. As a result, even with mandatory encryption configured, data can be sent unencrypted if the client sends PROT P after PASV or PORT commands, exposing data to on-path attackers.
Mistral Vibe versions before 3.0.3 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by defining git filter drivers in an untrusted repository's .git/config file. When the application is started with the --worktree option, git worktree add applies .gitattributes and runs filter commands before verifying the trusted folder, leading to execution of attacker-controlled commands with user privileges. The vulnerability is fixed in version 3.0.3.
DevilutionX versions 1.4.0 through 1.5.5 contain a heap buffer overflow vulnerability in the bundled libmpq library. The flaw occurs in the libmpq__archive_dup routine when opening specially crafted MPQ archives with a block table count exceeding the hash table count. This causes a heap overflow via memcpy during game startup, leading to a crash.
DevilutionX versions 1.4.0 through 1.5.5 contain an out-of-bounds read vulnerability in the bundled libmpq library. This flaw occurs in the libmpq__file_number_from_hash function due to unchecked block_table_index values, allowing attackers to read heap memory. Exploitation requires placing a crafted .mpq archive, such as a mod, in the game's data path, which can trigger reads beyond the intended memory bounds and cause the game to crash.
An integer overflow vulnerability exists in llama.cpp versions from b5854 before b11275 (including versions >=0.1.0 <0.6.0). The flaw occurs in the gguf_init_from_reader function, allowing crafted GGUF files to bypass size checks by padding tensor sizes near the maximum integer value. This results in an undersized data blob and out-of-bounds reads by consumers.
An integer overflow vulnerability exists in llama.cpp versions from 0.1.0 up to but not including 0.6.0. The flaw occurs in the gguf_init_from_reader function, where attackers can supply tensor shapes whose product wraps to zero, bypassing tensor element-count validation. This allows crafting GGUF files with extremely large tensor extents that overflow internal byte count calculations, leading to out-of-bounds memory access.
A heap out-of-bounds write vulnerability exists in llama.cpp before commit b10261 in the function llm_tokenizer_plamo2::build. This flaw allows attackers to corrupt heap memory by supplying crafted GGUF models with BYTE-typed token text containing negative parsed values. The vulnerability can cause crashes or potentially enable code execution during model loading.
CVE-2025-71439 is a heap out-of-bounds read vulnerability in llama.cpp before commit b5649. The flaw exists in the function llama_vocab::impl::print_info(), where supplying a crafted GGUF model with an undersized tokenizer.ggml.tokens array and oversized special token IDs can cause the software to read beyond allocated memory and crash during model loading. This affects llama-cli and llama-server components.
CVE-2024-58400 is an out-of-bounds read vulnerability in llama.cpp before version b3701. It occurs in the functions llama_decode_internal and llama_encode_internal due to improper validation of array indices. Remote unauthenticated attackers can exploit this by sending integer-array prompts with token IDs outside the valid range to the llama-server /completion endpoint, potentially reading memory beyond the intended embedding array or causing a crash.