October 13, 2026-KB5128924 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2

October 13, 2026-KB5128924 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2 Applies To .NET Note Release Date: October 13, 2026 Version: .NET Framework 3.5, 4.8 and 4.8.1 Summary This article describes the security and cumulative update for 3.5, 4.8 and 4.8.1 fo...

October 13, 2026-Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 (KB5128927)

October 13, 2026-Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 KB5128927 Applies To .NET Note Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.6.2 Microsoft .NET Framework 4.7 Microsoft .NET Framework 4.7.1 Microsof...

October 13, 2026-KB5128925 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2

October 13, 2026-KB5128925 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 22H2 Applies To .NET Note Release Date: October 13, 2026 Version: .NET Framework 3.5, 4.8 and 4.8.1 Summary This article describes the security and cumulative update for 3.5, 4.8 and 4.8.1 fo...

October 13, 2026-Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB5128926)

October 13, 2026-Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 KB5128926 Applies To .NET Note Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.6.2 Microsoft .NET Framework 4.7 Microsoft .NET Framework 4.7.1 Microsoft...

October 13, 2026-KB5128928 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows Server 2022

October 13, 2026-KB5128928 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows Server 2022 Applies To .NET Note Release Date: October 13, 2026 Version: .NET Framework 3.5, 4.8 and 4.8.1 Summary This article describes the security and cumulative update for 3.5, 4.8 and 4.8.1 for...

CLSA-2026-1791825473 python3.9: Fix of CVE-2026-19553

CVE-2026-19553: ssl: SSLObject.create, used by SSLContext.wrapbio, now emits a DeprecationWarning when checkhostname is enabled and serverhostname is None, and rejects serverhostname or session in server mode with ValueError, as wrapsocket does...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Authentication Bypass.

Summary proxy-addr is used by IBM Storage Fusion Data Foundation, which could cause Authentication Bypass. CVE-2026-90711. Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Samba Cluster Export Services (CES) layer are now addressed in 6.0.1.2 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the Samba Cluster Export Services CES layer and could provide weaker-than-expected security, are now addressed in Storage Scale 6.0.1.2 or higher. Vulnerability Details CVEID:CVE-2026-58216 DESCRIPTION: An out-of-bounds...

K000163675: libssh vulnerability CVE-2026-59848

Security Advisory Description A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. CVE-2026-59848 Impact An attacker could cause SFTP client...

Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for September 2026.

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the Data Insight DI component with a Service Pack update. Please understand that the new use of security bulletins represents a change in our communication process, not an increase in security...

CVE-2026-81498

Summary Impact The "nvidia.driver.capabilities" instance configuration key in Incus uses "validate.IsAny" at "internal/instance/config.go:744", which accepts any input without filtering. The value is subsequently written to the generated "lxc.conf" file at...

CVE-2026-81500

Summary The "incus" CLI, when exporting or copying an image from a remote server into a directory target, takes the local filename verbatim from the server-controlled "Content-Disposition: filename=" for UNIFIED images and passes it into "os.Renametmp, filepath.Jointarget, resp.MetaName" with no...

CVE-2026-81496

Summary "POST /1.0/instances" with an "application/octet-stream" body instance backup import reads the instance name from the tarball's "backup/index.yaml" verbatim and uses it as an on-disk path segment. A project user with the "cancreateinstances" entitlement can set "name:...

CVE-2026-81497

Summary The fix for CVE-2026-48752 "GHSA-vxp5-584q-c479", template-traversal to host read/write, addressed in 7.2.0 was applied to the LXC container driver only. The sibling QEMU/VM driver's template path "driverqemu.go" → "templateApplyNow" never received the same guard, so its template read and...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION:...

CVE-2026-60010

Summary "PUT /api/v1/repos/owner/repo/teams/team" allows a non-owner repository admin to attach organization teams to a repository even when the organization has disabled that behaviour with "RepoAdminChangeTeamAccess=false". An earlier advisory fixed the corresponding team-side endpoint; the...

Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by a vulnerability

Summary The apnotify utility was used by IBM Sterling Connect:Direct for UNIX in asset protection and may be seen in some IBM Connect:Direct for UNIX installation locations that have been upgraded in place since 2017 or earlier. IBM Sterling Connect:Direct for UNIX is impacted by a vulnerability ...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale System and the Management GUI are now fixed in 6.2.3.6 or higher and 7.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale System and the Management GUI and could provide weaker-than-expected security, are now fixed in Storage Scale 6.2.3.6 or higher and 7.0.1.1 or higher. Vulnerability Details CVEID:CVE-2026-13460 DESCRIPTION: IBM Storage Scal...

CVE-2026-77363

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch route confusion + SQL injection leading to unauthorized admin creation → Remote Code Execution RCE complete exploit chain PoC. For authorized security testing, vulnerability reproduction, and research only. Do not use against unauthorized targets...