IT security 2026-10-06

Level Calm — 38/100 — 2026-10-06

Calm day: 10 stories ranked, 0 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: CVE-2026-106218 — In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was po… (39/100).

  1. CVE-2026-106218 — In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was po… — 39/100 (CVE-2026-106218)
  2. CVE-2026-82162 — Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vu… — 38/100 (CVE-2026-82162)
  3. CVE-2026-106237 — Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass s… — 37/100 (CVE-2026-106237)
  4. CVE-2026-63691 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in… — 37/100 (CVE-2026-63691)
  5. CVE-2026-67273 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special El… — 37/100 (CVE-2026-67273)
  6. payloadcms payload: Payload is a free and open source headless content management system. — 35/100 (CVE-2026-105863)
  7. CVE-2026-106195 — Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote atta… — 35/100 (CVE-2026-106195)
  8. CVE-2026-102428 — Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order c… — 28/100 (CVE-2026-102428)
  9. payloadcms payload: Payload is a free and open source headless content management system. — 25/100 (CVE-2026-105848)
  10. techfry tf content: Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content… — 21/100 (CVE-2026-102780)