IT security 2026-10-14

Level Critical — 95/100 — 2026-10-14

Critical day: 12 stories ranked, 6 of the top 10 reported as actively exploited, 6 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Cisco Secure Email Gateway Relative Path Traversal Vulnerability (86/100).

1. Cisco Secure Email Gateway Relative Path Traversal Vulnerability — 86/100 (CVE-2026-76519)
2. Palo Alto Networks PAN-OS Code Injection Vulnerability — 82/100 (CVE-2026-0322)
3. Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability — 79/100 (CVE-2026-104935)
4. Ahsay AhsayCBS Command Injection Vulnerability — 68/100 (CVE-2026-105134)
5. Microsoft Windows Command Injection Vulnerability — 66/100 (CVE-2026-96951)
6. Ahsay AhsayCBS Improper Authentication Vulnerability — 60/100 (CVE-2026-105133)
7. CVE-2026-89068 — Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). — 38/100 (CVE-2026-89068)
8. CVE-2026-89073 — Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-89073)
9. CVE-2020-37282 — office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execut… — 36/100 (CVE-2020-37282)
10. CVE-2026-110635 — webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers th… — 36/100 (CVE-2026-110635)