IT security 2026-10-16

Level Critical — 78/100 — 2026-10-16

Critical day: 10 stories ranked, 3 of the top 10 reported as actively exploited, 3 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (76/100).

1. Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability — 76/100 (CVE-2026-21589)
2. BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability — 66/100 (CVE-2026-102764)
3. Fortinet Multiple Products Path Traversal Vulnerability — 60/100 (CVE-2025-61624)
4. CVE-2026-111643 — Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated… — 36/100 (CVE-2026-111643)
5. CVE-2026-111693 — DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauth… — 36/100 (CVE-2026-111693)
6. CVE-2026-111094 — In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the… — 30/100 (CVE-2026-111094)
7. nodejs undici: undici is an HTTP client library for Node.js. — 27/100 (CVE-2026-109383)
8. nodejs undici: undici is an HTTP client library for Node.js. — 27/100 (CVE-2026-109829)
9. freebsd freebsd: When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. — 25/100 (CVE-2026-101307)
10. CVE-2026-111375 — FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that… — 19/100 (CVE-2026-111375)