Patch/Configuration Management

The vulnerability affects Zimbra Collaboration Suite versions 8.8.15, 9.0, 10.0, and 10.1.

The SSRF vulnerability resides within LMDeploy's vision-language module, specifically in the load_image() function, which fails to validate internal or private IP addresses when fetching URLs.

The Pack2TheRoot vulnerability resides within the PackageKit daemon, a package management abstraction layer used across multiple Linux distributions.

CrowdStrike issued an advisory for CVE-2026-40050, a critical unauthenticated path traversal vulnerability impacting its LogScale product.

Attacks weaponizing the Cisco Adaptive Security Appliance vulnerabilities, tracked as CVE-2025-20333 and CVE-2025-20362, were reported by the Cybersecurity and Infrastructure Security Agency to have successfully compromised a federal civilian executive branch agency with the FIRESTARTER malware in September, according to The Record, a news site by cybersecurity firm Recorded Future.

The coalition includes major players like Accenture, Ernst & Young, IBM, Kroll, and OpenAI, with support from Anthropic.

The vulnerability, with a critical severity score of 9.8 out of 10, stems from a missing file-type validation in the "fetch_gravatar_from_remote" function.

More than 1,300 internet-exposed Microsoft SharePoint servers remain vulnerable to ongoing intrusions weaponizing the zero-day spoofing flaw, tracked as CVE-2026-32201, while fewer than 200 online SharePoint instances have been fixed since last week's Patch Tuesday release, BleepingComputer reports.