Gloqo AI

Security reference

Security updates

Check affected versions. Find the fix.

Reviewed

Editorial source review: . This applies to the reviewed guidance below; automatic CVE data has its own source date.

Latest critical

CNA-reported CVSS 9.0 to 10.0

CVE Program
Latest 500 of 3,839 critical records · 90-day window

Includes the newest 500 of 3,839 qualifying records published from 25 Jul 2026 through 22 Oct 2026, capped at 500. Search covers these 500 included records.

Only PUBLISHED records with a CNA base score of 9.0 to 10.0 are included. CVSS preference: 4.0, then 3.1, then 3.0; highest base score within the chosen version. A lower score in the preferred version takes precedence over a higher older-version score. Unscored records, CVSS v2 and ADP scores are excluded. Scores describe severity; they don’t establish exploitation or patch status.

Automatically synced from the CVE Program. Source release cve_2026-10-23_0500Z. CVE terms of use.

Through Synced

  1. CVE-2026-110243Kiloview E3 Firmware 9.4CVSS 4.0CNA · icscert
  2. CVE-2026-107861Kiloview E3 Firmware 9.4CVSS 4.0CNA · icscert
  3. CVE-2026-109122Kiloview E3 Firmware 9.4CVSS 4.0CNA · icscert
  4. CVE-2026-110063Microsoft VM Inspector for Azure Virtual Machines 10.0CVSS 3.1CNA · microsoft
  5. CVE-2026-83938Microsoft Azure Kubernetes Configuration Service 10.0CVSS 3.1CNA · microsoft
  6. CVE-2026-97785Microsoft Microsoft Entra application proxy 10.0CVSS 3.1CNA · microsoft
  7. CVE-2026-105014Microsoft Azure Pipelines 9.1CVSS 3.1CNA · microsoft
  8. CVE-2026-111594InterSystems IRIS for Health 9.2CVSS 4.0CNA · icscert

Showing 8 of 500 included records

Browse critical recordsCatalogue & downloads

Reviewed guidance

Oracle Java / GraalVM Featured
Security alert

Oracle Java / GraalVM: compromised certificate trust

Oracle issued an out-of-band update to distrust compromised eMudhra intermediate certificates. An affected runtime can accept forged certificates, exposing connections to data interception or tampering when an attacker controls or intercepts the connection. [1][2]

Versions, remediation & sources
Affected systems & conditions
Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; GraalVM for JDK 17.0.21 and 21.0.13; GraalVM Enterprise 21.3.20. Earlier unsupported releases may also be affected. Oracle also flags JSSE API use and sandbox-dependent Java clients loading untrusted code. [1]
Remediation
Apply the applicable Oracle security update. Current Oracle JDK downloads include 27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.33.0.2 and 8u511 b32; preserve the complete build suffix. Check Oracle’s support matrix for GraalVM and PERF builds. The October 22 workaround offers root removal or documented revocation checking: back up default and custom truststores, then follow Oracle’s instructions to remove emSign ECC Root CA - G3 and AAA Certificate Services, or enable the specified revocation checks. Root removal can disrupt connections using those trust chains. [1][3][4]
Evidence at review time
The reviewed Oracle advisories do not confirm in-the-wild exploitation. [1][4]
Related context
The security alert was published October 21. Oracle’s mitigation guidance was updated October 22 and rechecked October 23. This is a certificate-trust issue; the alert does not describe generic remote code execution or root takeover. [1][4]
Vendor severity
Oracle rates CVE-2026-91403 Critical: CVSS 3.1 9.1, with high confidentiality and integrity impact and no direct availability impact. [1]
Referenced CVEs

Related coverage: eMudhra / certificate trust

GitLab
Security release

GitLab patches a critical regular-expression compiler issue

GitLab says CVE-2026-110264 could permit unauthenticated code execution under certain conditions through integer overflow during regular-expression compilation. Other fixes have distinct authentication and configuration requirements. [1]

Versions, remediation & sources
Affected systems & conditions
For CVE-2026-110264, GitLab CE/EE versions from 7.0 are affected unless on an applicable fixed release. Consult the advisory for the branch-by-branch ranges and the separate ranges for the other issues. [1]
Remediation
Upgrade affected self-managed installations to 19.5.1, 19.4.3 or 19.3.6. The critical RCE fix was also backported to 19.2.9, 19.1.9, 19.0.10 and 18.11.13; those backports should not be read as fixing all twelve issues. GitLab.com is patched. GitLab identifies already-patched Dedicated builds in its advisory. [1]
Evidence at review time
GitLab provides detection rules for exploitation attempts. Their publication does not by itself confirm observed exploitation. [1]
Vendor severity
CVE-2026-110264: CVSS v3.1 10.0. The twelve listed fixes span critical, high, medium and low severities. [1]
Referenced CVEs
Node.js
Security release

Node.js security releases cover runtime and dependency issues

The bulletin lists ten CVEs, including Brotli decoder remote code execution, certificate-hostname validation bypasses, DNS input handling, HTTP response handling, entropy-cache reuse and permission-model issues. It also includes dependency and CA-certificate updates. [1]

Versions, remediation & sources
Affected systems & conditions
Affected release lines vary. Most listed issues affect 22.x, 24.x and 26.x. CVE-2026-105483 affects 24.x and 26.x; CVE-2026-106070 and CVE-2026-106071 affect 26.x. Check the bulletin for each issue and the features your application uses. [1]
Remediation
Update the applicable supported release line to 22.23.4, 24.22.1 or 26.12.1. [1]
Evidence at review time
The cited Node.js bulletin describes vulnerability impact but does not establish in-the-wild exploitation. [1]
Related context
The CA-certificate dependency update addresses the eMudhra incident described separately on this page. [1]
Vendor severity
High is the highest severity assigned in the Node.js release bulletin; individual issues vary. [1]
Referenced CVEs

Related coverage: eMudhra / certificate trust

PHP
Security release

PHP fixes critical remote code execution vulnerabilities

PHP reports two vulnerabilities that can permit unauthenticated remote code execution. They involve out-of-memory corruption and stale request state. The confirmed impact in the out-of-memory advisory is code execution as the web worker account. [1][2][3]

Versions, remediation & sources
Affected systems & conditions
Supported branches before their fixes: PHP 8.2 before 8.2.35; 8.3 before 8.3.36; 8.4 before 8.4.27; 8.5 before 8.5.12. PHP advises all installations serving web requests to update. Attack paths vary by deployment; PHP documents a demonstrated exploit against mod_php, while other paths have additional conditions. For older branches, follow PHP's guidance on supported upgrades, distribution or LTS fixes, and the limited source backports linked in its advisory. [1][2][3]
Remediation
Install PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or the distribution/vendor package containing both fixes. Follow the PHP advisory's worker-restart and configuration guidance. PHP states that configuration mitigations are incomplete. [1][2][3]
Evidence at review time
In an October 21 post, Cloudflare reported attack traffic targeting its customers and changes to the payloads used. The post does not provide a count of successfully compromised systems. [4]
Vendor severity
PHP rates both vulnerabilities CVSS v4.0 9.2. [1][2][3]
Referenced CVEs
eMudhra / certificate trust
Mozilla advisory published

Mozilla reports compromised eMudhra intermediate-certificate keys

Mozilla says it received a report on October 17 that private keys associated with eight eMudhra intermediate certificates were compromised. It says these keys could enable fraudulent HTTPS certificates and, for an attacker able to intercept a connection, website impersonation and traffic interception or modification. [1]

Versions, remediation & sources
Affected systems & conditions
Clients that would otherwise trust a chain containing one of the affected intermediates. Mozilla says clients with reliable revocation checks that reject connections when revocation information is unavailable do not need additional action. Google warns that removing emSign ECC Root CA - G3 can also break legitimate certificates that chain to it. [1][2][3]
Remediation
Follow your browser, operating-system and runtime vendor's trust-store or blocklist updates. Mozilla says standard Firefox configurations received OneCRL protection on October 17, with additional Firefox and NSS updates for other configurations and consumers. The linked Go and Node.js updates address runtime trust data too. Google expects the Chrome Root Store update removing emSign ECC Root CA - G3 to reach all devices using that store on October 27, 2026, in the morning PDT, and advises site operators using that root to install a replacement certificate from another trusted hierarchy immediately. In its October 22 update, eMudhra offers Sectigo-issued certificates as an alternative for all customers. [1][2][4][5][3][6]
Evidence at review time
The Mozilla article establishes the reported key compromise and protective actions. It does not establish successful interception of user traffic. [1]
Related context
Incident report received October 17; Mozilla article published October 20 and updated October 21. This is not a new October 21 incident. [1]
Vendor severity
The cited Mozilla report does not assign a CVSS score. [1]

Related coverage: Go, Node.js

Go
Security release

Go updates certificate verification for affected intermediates

Go 1.27.3 and 1.26.10 add a crypto/x509 mitigation that excludes certificate chains containing the affected intermediate certificates. [2][3]

Versions, remediation & sources
Affected systems & conditions
Applications relying on Go's certificate verifier where an affected certificate chain would otherwise be trusted. The supported release fixes are Go 1.27.3 and 1.26.10; consult the release announcement and your software vendor for deployment guidance. [2][3]
Remediation
The Go team recommends immediately upgrading to Go 1.27.3 or 1.26.10. Consult the release announcement and your software vendor for deployment guidance. [2][3]
Evidence at review time
The Go announcement describes a certificate-trust mitigation and does not report observed exploitation. [2]
Related context
Our source comparison links this update to the eMudhra incident: Go and Chromium block the same affected public-key hashes. [4][5]
Vendor severity
The cited Go announcement does not assign a severity score. [2]
Referenced CVEs

Related coverage: eMudhra / certificate trust

NGINX
Security release

NGINX fixes configuration-dependent security issues

Five fixes cover alias/rewrite and script-evaluation buffer overflows, HTTP/3 request-body injection, session forgery during TLS session-ticket key rotation, and an AIO/SSI use-after-free. [1][2]

Versions, remediation & sources
Affected systems & conditions
Affected ranges and prerequisites differ by CVE. For CVE-2026-15176, F5 identifies alias/rewrite configurations that reference $request_filename in set, return or access log_format directives. It says code execution additionally requires ASLR to be disabled or bypassed. HTTP/3, session-ticket and AIO/SSI issues depend on the corresponding features. [2][3]
Remediation
Update NGINX Open Source to a fixed release on the appropriate branch: 1.30.6+ or 1.31.7+. For NGINX Plus or related products, use the product-specific F5 advisory tables. [2][3]
Evidence at review time
The cited advisory index and F5 advisory describe potential impact; they do not establish observed exploitation. [2][3]
Vendor severity
NGINX's advisory index labels these issues medium. F5 rates CVE-2026-15176 as CVSS v4.0 9.2 and v3.1 8.1. Vendor labels and score versions should not be conflated. [2][3]
Referenced CVEs

How this list is maintained

Selected public advisories, reviewed manually. This is not an exhaustive or live feed. Numbered links sit beside the claims they support. Vendor release dates and incident-report dates are labelled separately from our review dates.

Severity is attributed to its publisher; different scoring systems are not combined. Evidence of attempted exploitation is described separately from successful compromise. Where a cited bulletin does not establish exploitation, the entry says so without asserting that exploitation has never occurred.

Related responses to the same incident are linked rather than presented as an independent incident total. Fixed versions are a dated snapshot; use the linked vendor guidance when checking your own deployment.

Entries are maintained as dated snapshots. Updates should preserve stable entry links, recheck every changed claim against its source, and record the review date. To suggest a correction, contact Gloqo AI with the entry link and a supporting primary source.

For informational reference. This page does not determine whether a particular deployment is affected and is not a substitute for the linked vendor advisories.