High-signal AI/security/automation notes.
Fourteen CVE records published 14 October 2026 cover n8n 2.41.4, 2.42.1 and 1.123.83 — fixes that shipped 30 September. The batch reads as an audit of every trust boundary an agent platform has: agent chat resume, MCP validation, the Git node as an agent tool, credential scoping, and webhook identity. We read all fourteen NVD records first-hand.
Vercel shipped Next.js 16.4.1 and 15.5.28 on 14 October 2026 with three advisories: an unauthenticated use-cache RCE, an Image Optimization SVG RCE via upstream librsvg CVE-2026-96889, and a Server Actions DoS. We read the Vercel advisory, the NVD record and the npm registry first-hand: the 15.x line can silently keep a vulnerable sharp, and the GHSA records were still absent from the global database at publication.
Five OPNsense CVE records landed at NVD on 15 October 2026, all patched on 1 July. The headline is CVE-2026-57155 (CVSS 9.9): the Firewall Alias GeoIP importer downloads a database from a user-supplied URL, unpacks it as root, and uses an unvalidated country_code column as the output filename. A delegated alias-editor becomes root via the default hourly newsyslog cron. The fix is a two-line length check.
Palo Alto Networks published CVE-2026-0322 on 14 October 2026: a code-injection flaw in the PAN-OS management interface that gives an authenticated attacker arbitrary code execution as root on the firewall. CVSS 4.0 8.6 with exploit maturity ATTACKED and urgency Red, found by an internal reporter, no workarounds, and in CISA KEV the same day with a 17 October deadline. The only vendor mitigation requires decrypting your own management traffic.
NVD published CVE-2026-110719 against Portkey-AI/gateway on 14 October 2026. An unauthenticated caller can send /v1 requests with a crafted x-portkey-custom-host header and have the gateway call loopback and Docker-host services, because the default trusted-host set short-circuits before the SSRF blocks run. No fixed release exists.
Four CVE records published 14 October 2026 cover Renovate, the dependency bot that reads configuration from repositories and runs package managers with your credentials. A shared preset could set env (LD_PRELOAD, NODE_OPTIONS) past allowedEnv, inject HTTP headers past allowedHeaders, point the HTTP client at the EC2 metadata service, and a rebase checkbox could skip minimumReleaseAge. Three advisories say Workarounds: None.
Ubiquiti Security Advisory Bulletin 070, published 14 October 2026, discloses six CVEs in the UniFi Protect AI Key — an unauthenticated command injection at 8.1, an access-control flaw at 8.6, and four more the vendor marks as chainable. Every record is CVSS PR:N. All six are credited to Andy Gill of ZephrSec, and the fixed firmware shipped before the bulletin did.
Volexity disclosed on 13 October 2026 that an unknown actor, UTA0576, chained three Ivanti Connect Secure flaws — a welcome.cgi routing bypass, a wu.cgi file-write race, and a dsinvoked privilege escalation — to run commands as root on a fully patched 22.8R2.4 appliance from 3 October. CVE-2026-104935 (CVSS 8.6) covers the first two and was patched on disclosure day; the privilege escalation fix is weeks away. Stolen LAPS passwords, BitLocker keys, and Kerberoast material followed, with no web shell left behind.
CVE-2026-110220, published to NVD on 13 October 2026 and scored 7.1 (CWE-918), lets any namespace tenant who can create a KServe InferenceService name the host that the Kubeflow Model Registry controller talks to — and the controller attaches its own Kubernetes ServiceAccount bearer token to that request. We read the chain first-hand at tag v0.3.17 and at main: the annotation is read unvalidated at controller.go:111, the token goes into the request context at :88-90, and the generated OpenAPI client adds the Authorization header at client.go:420-423. The shipped manifest binds the controller to a ClusterRoleBinding with patch and update on inferenceservices cluster-wide. v0.3.17 is the newest release. There is no fix.
CVE-2026-109527, CVE-2026-59951 (Python SDK) and CVE-2026-108395 (Java SDK) reached NVD on 14 October 2026: unauthenticated remote denial of service via unbounded request bodies and sessions that are never reclaimed. Fixes shipped in August and September; the CVE records arrived today.
Microsoft’s October 2026 Patch Tuesday fixed a record 1,413 CVEs — more than in all of 2025, pushing the 2026 total past 4,000 in a surge SecurityWeek attributes largely to AI. The exploited zero-day is CVE-2026-96951 (CVSS 8.8), a Windows Shell flaw that evades Mark-of-the-Web protections, reported by Fujitsu, Anthropic, and an independent researcher, and added to CISA KEV on 13 October with a 16 October federal deadline.
Five CVEs published 12 October 2026 against Open WebUI, all fixed in 0.11.4: CVE-2026-109292 forwards browser session cookies to third-party tool and terminal servers, CVE-2026-109572 lets any terminal user reach the admin Terminals API through the proxy, CVE-2026-109296 reaches disabled model backends by naming an index, and CVE-2026-109295/109298 turn model-invoked grep tools into event-loop stalls. Fix commits read first-hand.
CVE-2026-94603 reached NVD on 13 October 2026 at CVSS 10.0: any OCI image carrying the io.podman.annotations.checkpoint.runtime.name annotation made podman run silently discard the operator’s own sandbox flags, including --cap-drop=ALL. The cause was a convenience feature merged in December 2022 and shipped in v4.4.0, whose early return skipped the function that applies user security options. The fix is a revert, a breaking change, and a green e2e test turned red. Credited to ADA Logics using Anthropic’s Claude models.
VulnCheck published eighteen CWE-78 records between 15:16:59 and 15:17:18 UTC on 14 October 2026 — transcription wrappers, PDF and video converters, archive extractors — all the same bug: an attacker-controlled file name interpolated into a shell string. We read every record and all nineteen fix PRs: one researcher filed them, nine were merged, nine are still open, and two maintainers shipped fixes in the final hours before publication.
CVE-2026-49950 reached NVD on 13 October 2026 at CVSS 4.0 9.3: Xorbits Xoscar’s actor-pool channel calls cloudpickle.loads on data from any peer that can open the socket, with no authentication and no message check before reconstruction. We read recv() and unpickle_buffers at v0.11.2 — there is no fixed version, no repository advisory, and Xinference 4.0.0 requires the library.