Weekly Security Bulletin #1: 37 Chromium flaws and Ivanti under active exploitation

· Security

Weekly Security Bulletin #1: 37 Chromium flaws and Ivanti under active exploitation

The Weekly Security Bulletin scans four sources each week: the Red Hat CVE database, CVE.org, OpenCVE and the GitHub Advisory Database. Whether a flaw is really being exploited comes from the CISA KEV list.

In short

stats

Urgent items first

Ivanti Connect Secure: CVE-2026-104935

Windows Shell: CVE-2026-96951

compare

“No data” means the sources hold no exploitation record. It is not proof that nothing is happening. The CVSS scores come from the issuing CNA (Ivanti, Microsoft, Inductive Automation) or from Red Hat, and the two can differ.

The week in numbers

Severity of Red Hat records
Oct 7 to 14, 2026, 345 records in total
Records
Critical1
Important99
Moderate199
Low46
Source: Red Hat Security Data API
New records per day
Oct 14 covers only part of the day.
Records
Oct 773
Oct 884
Oct 938
Oct 102
Oct 118
Oct 1267
Oct 1366
Oct 147
Source: Red Hat Security Data API
Heat map of new CVE records by day and severity
Records rated “important” jumped to 43 on Oct 13, mostly from Chromium.
Packages with the most records
Records per package; one package can hold many flaws.
Records
ImageMagick60
Chromium37
FreeRDP18
kernel13
xorg-x11-server11
pydantic-ai10
ffmpeg9
MariaDB8
busybox7
Source: Red Hat Security Data API

Which areas do the records fall into?

How do the records split by severity?

Most common weakness types (CWE)

Chrome and Chromium

On Oct 13 Red Hat published 37 Chromium records in a single day. Seven are scored 9.6, and most are use-after-free (CWE-416). The first CVE.org record (CVE-2026-110148) says the SVG flaw affects Chrome before 155.0.8059.79 and that Chromium rates it “Critical”. An attacker can run code inside the sandbox through a crafted HTML page. No exploitation record exists.

Update Chrome

GitHub Advisory Database: a .NET week

All 25 records on the first page of GitHub’s reviewed advisories are NuGet packages dated Oct 13. Most are .NET and ASP.NET Core entries that Microsoft released on its monthly update day. Two are rated critical:

  • CVE-2026-88092 (GHSA-rv87-ccxw-8ggf): HTTP request/response smuggling in ASP.NET Core, with tampering impact. CVSS 9.4. The 10.0 line is affected before 10.0.13 and the 11.0 line before 11.0.0-rc.2.
  • CVE-2026-70188 (GHSA-fpq8-4vhr-rcxx): Same class of bug, leading to a security-feature bypass. CVSS 9.1; same affected versions.

In Microsoft’s own scoring, neither has proven exploit code yet. If you run ASP.NET Core behind a reverse proxy, this class of bug matters most, because the exploit relies on the proxy and the app reading the same request differently.

Other notable items

Libraries and application servers
  • async-http-client (CVE-2026-107282): Red Hat’s only “critical” record this week. On a cross-host replay, the original request’s Host header and Authorization credentials can go to the new target. CVSS 4.0: 9.4 (Red Hat’s CVSS 3 score is 6.5). Fixed in 3.0.13 and 2.16.1.
  • Quarkus REST Data Panache (CVE-2026-87744): If an operation is customized with @MethodProperties without re-declaring roles, the generated code silently drops the class-level security requirement and the endpoint is left open without authentication. Red Hat: Important, 9.1.
  • Ignition (CVE-2026-92817): Industrial control software. A user with a Vision session can use the session ID to gain Designer privileges and run code in the Gateway process. CVSS 8.8. Fixed in 8.1.55 and 8.3.9. CISA published it as ICSA-26-286-01.
  • pydantic-ai (10 records): One example is unauthorized tool execution because Content-Type validation is missing, 7.6.
  • Trilium Notes (CVE-2026-77438): 7.5 on OpenCVE. The public share search can leak titles, paths and content of password-protected notes without authentication. Versions up to and including 0.103.0 are affected; the record names no fixed version.
Linux distributions and desktop components
  • kernel (13 records): Most are scored 7.0. Use-after-free and out-of-bounds read fixes in bpf, netfilter, tcp, vlan, sched and mm.
  • xorg-x11-server (11 records): The highest is 7.8, a use-after-free in passive grab handling that allows code execution.
  • ImageMagick (60 records): The busiest package of the week. The highest score is 7.0, code execution through a crafted PICT file. Most are moderate or low.
  • FreeRDP (18 records): One is “important”, the rest moderate and low. Example: a double-free in NSCodec causing denial of service, 5.9.
Old flaws added to CISA KEV (Oct 8)
  • ISC BIND: CVE-2015-5477
  • Apache Struts: CVE-2016-3081
  • Strapi: CVE-2023-22894
  • ONLYOFFICE Docs Server: CVE-2021-3199
  • ProFTPD: CVE-2015-3306

All five were published years ago and entered the list on Oct 8. That means an old flaw still works against unpatched, internet-facing systems. The due date was Oct 11.

Flaws added to the KEV list per month
October counts until the 14th.
Added flaws
May21
June23
July26
Aug31
Sept43
Oct*11
Source: CISA KEV

What to do this week

Priority order

How to read the sources

Method and limits
  • Period: Oct 7, 2026 to Oct 14, 2026. Oct 14 is a partial day.
  • Red Hat counts come from the Red Hat Security Data API after=2026-10-07 query, using each record’s public_date.
  • The treemap grouping and shortened package names are specific to this post.
  • Fixed versions come from the vendor’s CVE.org record. Where there is none, the table says “follow the record”.
  • This post is not a security audit and does not replace checking your own environment.

faq

CISA Known Exploited Vulnerabilities Catalog

button

features