CVE

Cenovus Energy, the Canadian oil and gas producer listed on the TSX under ticker CVE, is being discussed for its strategies to improve efficiency and capture synergies across its operations. Coverage, including from Kalkine Media, examines how the company is targeting cost savings and integration gains as it works to strengthen returns for investors.

Apple has released patches for CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics affecting older versions of iOS, iPadOS and macOS. Processing a maliciously crafted file could allow arbitrary code execution. Apple says the flaw may already have been exploited in targeted attacks, prompting users of older devices to update promptly.

The Global CVE Allocation System (GCVE) has published version 3.0 of its BCP-07 guidance, extending it beyond Known Exploited Vulnerability (KEV) assessments to a new No Known Exploitable Vulnerability (NKEV) format. An NKEV assessment provides a product-level, time-bounded technical evaluation of whether known exploitable vulnerabilities affect a product, giving vendors and users a standardized way to state exposure status.

ASUS has released firmware updates fixing two critical vulnerabilities in its routers, tracked as CVE-2026-14157 and CVE-2026-13313. The flaws allow authenticated attackers to execute arbitrary commands and gain root privileges by exploiting malicious VPN files. Users are urged to update their routers promptly.

Progress Software has disclosed CVE-2026-92931, a server-side request forgery vulnerability in the Sitefinity Next.js SDK npm package. According to the advisory, a remote attacker could trick the server into making requests to an attacker-controlled host, potentially exposing sensitive information. Affected versions reportedly begin with 15.1.8326, and developers using the package are being urged to review their installations.

GitLab has fixed a critical vulnerability, tracked as CVE-2026-90970, affecting its AI Gateway component. Security outlets are urging users to update their deployments promptly, as flaws in AI gateway infrastructure could expose sensitive data or allow unauthorized access. Administrators are advised to review the advisory and apply the patch as soon as possible.

MediaTek has released its October 2026 security bulletin, fixing 31 vulnerabilities across its chipsets. The most serious is a critical flaw in the company's modem, tracked as CVE-2026-20519, which could be exploited remotely. Security researchers are urging users of MediaTek-powered Android phones to install the latest patches as soon as possible.

A vulnerability, tracked as CVE-2026-105134, has been reported in AhsayCBS, the backup software from Ahsay, affecting versions up to 10.3.2. The flaw was published on a threat-tracking service and is circulating among infosec communities, with security professionals flagging it for administrators who run Ahsay backup infrastructure. Details on severity and exploitation remain limited so far.

Kit, the email marketing service formerly known as ConvertKit, has patched a missing authorization vulnerability tracked as CVE-2026-105421 in its Kit for WooCommerce WordPress plugin. Versions through 2.2.0 are affected, and the fix is available in version 2.2.1. No exploitation in the wild has been confirmed, but security researchers are urging users of the plugin to update promptly.

Zammad has issued a security alert for CVE-2026-102489, a session hijacking vulnerability that can lead to remote code execution as the Zammad service account on affected older installations. DIVD reports that the flaw has already been exploited in a real-world incident, prompting urgent calls for administrators to update their systems.

A newly disclosed vulnerability, CVE-2026-105238, affects NextChat and carries a CVSS score of 7.3. Security researchers report a server-side request flaw that lets a single unauthenticated request make the server fetch arbitrary internal URLs or cloud metadata endpoints, bypassing access-code protection. No patched version has been confirmed; mitigations include blocking the x-base-url header at reverse proxies and restricting server egress.

The EU's upcoming cybersecurity reporting requirements are set to expose long-standing weaknesses in how Linux vulnerabilities are tracked and patched. The number of published CVEs has grown sharply, and sprawling deployments make it harder for organisations to prove which systems are affected. Under the new rules, patching alone may not suffice: teams will need documented evidence of their vulnerability handling, turning compliance into a pressing operational challenge for Linux users across Europe.

Fortra has released a fix for a command injection vulnerability, tracked as CVE-2026-9862, in its BoKS Core privileged access management product. The flaw sits in the autoregistration service and allows unauthenticated remote code execution, potentially leading to full system compromise. Security professionals are circulating the advisory and urging administrators to patch affected deployments promptly.

A critical vulnerability tracked as CVE-2026-103922, with a CVSS score of 9.3, has been disclosed in Capacitor, the Ionic framework package with around 5.5 million weekly downloads used to build Android and iOS apps. Security researchers urge developers to update to a patched release immediately, warning that affected apps could be at serious risk until remediated.

GitLab has disclosed CVE-2026-90970, a critical remote code execution vulnerability in its AI Gateway service. The flaw allows authenticated users with Duo Agent Platform access to escape the prompt sandbox and execute arbitrary commands. Self-hosted instances are affected, and security teams are being urged to patch promptly.

A new vulnerability tracked as CVE-2026-88779 has been disclosed affecting Citrix NetScaler ADC and NetScaler Gateway, with a high severity rating of 8.7 on the CVSS scale. The finding is circulating among cybersecurity professionals, who are monitoring the flaw for details on exploitation and the availability of patches from Citrix.

A high-severity memory corruption vulnerability, CVE-2026-88779 (CVSS 8.7), in Citrix NetScaler ADC and Gateway can be exploited unauthenticated over the network to cause denial of service. The flaw was attacked as a zero-day and has been added to CISA's Known Exploited Vulnerabilities catalog. Citrix has issued emergency fixes, and security teams are urged to patch immediately.

A headline circulating among security professionals suggests a recent kernel update itself caused denial-of-service and privilege escalation attacks. Security engineers are pushing back, clarifying that the update actually patches vulnerabilities that could enable such attacks. Since 2024 the Linux kernel project acts as its own CVE Numbering Authority, assigning identifiers for flaws directly, which has changed how fixes and disclosures are labeled and reported.

CISA has added CVE-2026-88779, a vulnerability in Citrix NetScaler appliances, to its Known Exploited Vulnerabilities list after evidence of active exploitation. Federal agencies must apply patches by October 7. Security practitioners are urging admins to prioritise patching internet-facing NetScaler devices immediately, as such appliances have historically been frequent targets for attackers.

A critical vulnerability, tracked as CVE-2026-59265, has been found in Apache OpenOffice's Java integration. Opening a crafted untrusted document can allow arbitrary code execution on the affected machine. Versions 4.1.16 and earlier are affected, and no exploitation has been confirmed so far. A fix is expected in version 4.1.17; users are advised to disable the Java runtime as an interim measure.

A missing-authorization vulnerability, CVE-2026-104991, has been disclosed in Alanaktion Phproject. Authenticated users with API keys can bypass restricted-issue controls to read issue contents, comments and email addresses, and post unauthorized comments. Versions 1.1.6 through 1.8.6 are affected. Security communities are sharing the advisory as administrators assess whether their deployments need patching.

A security vulnerability in SourceHut, tracked as CVE-2026-92973, reportedly allowed account takeover through malicious build logs. The flaw involved cross-site scripting in the ansi2html.py script used to render logs, letting attackers inject code that could hijack sessions. Developers and security researchers are discussing the disclosure and how the issue was handled.

Microsoft is tracking CVE-2026-73570, a newly disclosed vulnerability that allows unauthenticated command injection on internet-facing mail servers. Because the flaw can be exploited without credentials and targets exposed systems, security teams are watching for signs of exploitation and awaiting patch guidance. Admins of mail infrastructure are being urged to assess exposure while details and fixes are confirmed.

GitLab has released emergency security patches addressing two critical vulnerabilities: a remote code execution flaw in its AI Gateway, tracked as CVE-2026-90970, and a maximum-severity path traversal issue. Both flaws are reportedly being actively exploited, prompting the unusually urgent rollout. Security teams are being urged to apply the updates immediately, with the disclosures fueling renewed discussion about securing AI infrastructure.