TL;DR SnappyMail's maintainer published advisory, rating a SnappyMail RCE chain critical. The advisory includes full technical details, step-by-step logs and downloadable proof-of-concept exploit scripts. However, the flaw sits in code that never shipped in an official release. A trusted-header patch let attackers fake admin access and then install a malicious plugin. Researcher furkank1337 published working exploit scripts with the advisory. Only development builds that merged the patch and set an admin panel host are affected.

TL;DR The Apache OFBiz project has disclosed 46 security flaws in its open-source ERP suite. The advisory says the list includes "some critical issues." These Apache OFBiz vulnerabilities affect all versions before 24.09.08. Several allow remote code execution without logging in. OFBiz 24.09.08 fixes pre-authentication RCE, authentication bypass, SQL injection, XXE and SSRF bugs. A hard-coded JWT key can also hand out admin access.

TL;DR CERT/CC published a vulnerability note on October 27, 2026, disclosing an unpatched Xerj authentication bypass tracked as CVE-2026-97406. This flaw allows attackers with existing bearer tokens to mint persistent credentials without required passkey verifications. Consequently, unauthorized users can maintain permanent administrative access even after administrators revoke the initial token. Why It Matters Xerj serves as an open-source search engine tailored for artificial intelligence agents using the Elasticsearch API.

TL;DR CERT/CC published a vulnerability note on October 27, 2026, disclosing an unpatched Xerj authentication bypass tracked as CVE-2026-97406. This flaw allows attackers with existing bearer tokens to mint persistent credentials without required passkey verifications. Consequently, unauthorized users can maintain permanent administrative access even after administrators revoke the initial token. Why It Matters Xerj serves as an open-source search engine tailored for artificial intelligence agents using the Elasticsearch API.

TL;DR On October 20, 2026, the Apache Software Foundation disclosed eight Apache Tomcat vulnerabilities. Three rate Important, including a JNDIRealm authentication bypass and two flaws that can mix up responses between users. Tomcat 11.0.27, 10.1.61 and 9.0.123 fix them. Why It Matters Tomcat runs a large share of Java web applications, from internal portals to public APIs. Response mix-ups can hand one user's data to another.

TL;DR Laravel published two security advisories on October 19, 2026. The more serious one is a critical Laravel authentication bypass in TokenGuard, rated CVSS 9.2, that can lead to account takeover. A second, moderate flaw lets read-only users wipe related database tables. Why It Matters Laravel is one of the most widely used PHP frameworks, and many APIs rely on its token guard.

TL;DR Fortinet released 10 advisories on October 13, 2026, fixing 13 Fortinet vulnerabilities across eight product lines. Two are critical: an authentication bypass in FortiSandbox (CVSS 9.6) and an unauthenticated code execution flaw in FortiSIEM (CVSS 9.4). Neither requires a login. Why It Matters Fortinet gear sits at the heart of many corporate networks. FortiSandbox analyzes suspicious files, while FortiSIEM collects security logs.

Authlib fundamentally exists to distinguish authenticated, trusted data from malicious forgery. However, a meticulously crafted JSON Web Signature (JWS) enables attackers to bypass this critical verification process entirely without necessitating any cryptographic signature. The vulnerability, designated CVE-2026-96760, critically afflicts Authlib versions 1.7.2 and prior. This prominent Python library assists developers in seamlessly integrating OAuth, OpenID Connect, JWT, JWS, and JWE protocols.

TL;DR Cisco has patched CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco SD-WAN Manager. Attackers already exploit the flaw in the wild to gain admin access to the API. No workarounds exist, so upgrading is the only real fix. Why It Matters Cisco confirms the attacks are real and recent. The advisory states: "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."

TL;DR wolfSSL shipped version 5.9.4 on September 25, 2026, fixing 10 wolfSSL vulnerabilities. Three are rated High, and each lets a malicious peer bypass TLS authentication or forge certificates in certain builds. Several flaws were found through the Anthropic OSS program. Why These wolfSSL Vulnerabilities Matter wolfSSL is a lightweight TLS library built for embedded systems, IoT devices, and cloud software.

TL;DR Pega disclosed a Pega Platform SAML authentication bypass on September 18, 2026. It covers two flaws, one Critical (CVSS 9.5) and one High (CVSS 7.0). Pega has released patches and hotfixes. No compromise has been reported so far. Why This Pega Platform SAML Bypass Matters Pega Platform runs core workflows at many large enterprises, banks, and government agencies. SSO ties those apps to a single sign-on layer.

TL;DR A flaw in pgAdmin 4 allows remote actors to bypass authentication when Webserver mode is active. Specifically, attackers can forge identity headers to log in as administrators without passwords. Therefore, organizations must deploy version 9.18 immediately to secure their database environments. Why This Threat Matters Sourced industry estimates indicate that millions of developers and administrators use pgAdmin to manage PostgreSQL deployments.

🚨 CRITICAL VULNERABILITY ALERT — Network Edge / Remote Access Infrastructure: MikroTik shipped a silent, no-detail patch for RouterOS on September 3, 2026, hoping to buy administrators time before attackers reverse-engineered the flaw. CERT Polska has now confirmed the exploited chain — nicknamed MikroTrick — was already running in the wild since September 2, a full day before the patch existed…