IT security 2026-10-15

Level Critical — 83/100 — 2026-10-15

Critical day: 15 stories ranked, 5 of the top 10 reported as actively exploited, 5 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Ahsay AhsayCBS Command Injection Vulnerability (70/100).

  1. Ahsay AhsayCBS Command Injection Vulnerability — 70/100 (CVE-2026-105134)
  2. Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability — 69/100 (CVE-2026-21589)
  3. Cisco Secure Email Gateway Relative Path Traversal Vulnerability — 69/100 (CVE-2026-76519)
  4. Palo Alto Networks PAN-OS Code Injection Vulnerability — 65/100 (CVE-2026-0322)
  5. Ahsay AhsayCBS Improper Authentication Vulnerability — 60/100 (CVE-2026-105133)
  6. CVE-2026-111094 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the… — 38/100 (CVE-2026-111094)
  7. BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability — 36/100 (CVE-2026-102764)
  8. nodejs undici: undici is an HTTP client library for Node.js. — 35/100 (CVE-2026-109383)
  9. nodejs undici: undici is an HTTP client library for Node.js. — 35/100 (CVE-2026-109829)
  10. CVE-2020-37282 — office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execut… — 33/100 (CVE-2020-37282)