The CyberSec Intelligence specialist team presents the daily security bulletin for October 10, 2026. Today’s analysis covers vulnerabilities recently added to the CISA KEV catalog as being actively exploited, alongside new critical security breaches identified in various software and hardware products used in the enterprise environment.
Actively exploited vulnerabilities
- CVE-2015-5477 (ISC BIND): A data processing error allows remote attackers to cause a denial of service (Denial of Service) attack via TKEY queries. Details: NVD CVE-2015-5477.
- CVE-2016-3081 (Apache Struts): A command injection vulnerability allows remote arbitrary code execution when the Dynamic Method Invocation option is enabled, via the method prefix. Details: NVD CVE-2016-3081.
- CVE-2023-22894 (Strapi): Cleartext storage of sensitive information in the database allows users with access to the admin panel to discover confidential details through query filters. This breach can be chained with CVE-2023-22621 to run code remotely. Details: NVD CVE-2023-22894.
- CVE-2021-3199 (ONLYOFFICE Docs): A Path Traversal vulnerability associated with the use of JWT allows remote code execution via the image upload parameter. Details: NVD CVE-2021-3199.
- CVE-2015-3306 (ProFTPD): Improper access control allows remote attackers to read and write to arbitrary files using ‘site cpfr’ and ‘site cpto’ commands. Details: NVD CVE-2015-3306.
- CVE-2026-88779 (Citrix NetScaler): An improper limitation of operations within the bounds of a memory buffer in NetScaler ADC and Gateway can lead to a denial of service (DoS) attack. Details: NVD CVE-2026-88779.
New critical vulnerabilities
- CVE-2026-107699 (ppt2png): An OS command injection vulnerability in ppt2png (up to version 0.0.6) allows attackers to execute commands in the operating system by adding shell metacharacters to file paths processed by child_process.exec(). Details: NVD CVE-2026-107699.
- CVE-2026-104075 (TVU Networks Receiver/Transceiver Devices): Authentication bypass in the web login endpoint (/tvu/Login) for firmware versions prior to version 7.9, allowing attackers to obtain an administrator session by transmitting an empty UserName parameter. Details: NVD CVE-2026-104075.
- CVE-2026-82334, CVE-2026-82335, CVE-2026-82344 (IBM Guardium Data Protection): Multiple buffer overflow and out-of-bounds read vulnerabilities in protocol parsers (TDS7, MongoDB, S-TAP TrafficTap) that can cause information disclosure or remote code execution. Details: CVE-2026-82334, CVE-2026-82335 and CVE-2026-82344.
- CVE-2026-107779 and CVE-2026-107780 (Dromara Skyeye): Identifies the lack of authentication in xxl-job-admin administration endpoints and an OS command injection vulnerability in TtsController through the format parameter, facilitating the execution of unauthorized scripts on the host server. Details: CVE-2026-107779 and CVE-2026-107780.
- CVE-2026-85531 and CVE-2026-86405 (Sipay Electronic Money Virtual POS Module for OpenCart and PrestaShop): Improper validation of the cryptographic signature in payment modules allows attackers to perform “Signature Spoofing” attacks. Details: CVE-2026-85531 and CVE-2026-86405.
- CVE-2026-108107 (PHPNuxBill): A SQL injection vulnerability in the radius.php endpoint allows the extraction of customer data and credentials through time-based “blind SQL injection” queries. Details: NVD CVE-2026-108107.
- CVE-2026-104732 (WordPress Advanced IP Blocker Plugin): Complete authentication bypass in the 2FA process in versions up to 8.13.13, allowing attackers to take over administrator accounts by forcing the TOTP code due to the lack of server-side validation. Details: NVD CVE-2026-104732.
- CVE-2026-107645 (WordPress Blocksy Companion Plugin): Unauthorized privilege escalation (up to and including version 2.1.58) by disabling nonce verification for Dokan, granting seller rights and the possibility of unauthorized publishing. Details: NVD CVE-2026-107645.
From the security press
- Working exploit for AnyDesk Linux (no CVE): Security researchers have published a fully functional exploit that allows obtaining root access on Linux systems before the connection is approved. The vulnerability was patched in version 8.0.3, but without being transparently documented under a CVE identifier. Details: The Hacker News.
- CVE-2026-107406 (Citrix NetScaler): Citrix has issued patches for a critical security flaw in NetScaler ADC and Gateway that targets SAML implementations and can lead to remote code execution or DoS attacks. Details: The Hacker News.
What we recommend
- Prioritized Patch Management: Immediately apply updates for Citrix NetScaler, ONLYOFFICE, the targeted WordPress modules, and systems based on AnyDesk Linux, prioritizing active vulnerabilities identified in the CISA KEV catalog.
- Asset Inventory: Identify all active instances of services directly exposed to the internet (such as BIND, ProFTPD, AnyDesk) to quickly assess exposure to pre-authentication exploits.
- Network and Web Traffic Monitoring: Configure rules in intrusion detection systems (IDS/IPS) to detect exploitation attempts targeting SQL injection, Path Traversal, or 2FA authentication flow manipulation errors.
- Review Default Configurations: Ensure that insecure features (such as Dynamic Method Invocation in Apache Struts or unauthenticated permissions in various APIs) are disabled if they are not strictly necessary in the operational workflow.
Security News, in your inbox
New News articles, with their full text and a link to the website. One daily email at 09:00 Romania time. No new articles in your chosen language, no email.
