Skip to content

15 Oct 2026

3 new, 0 updated.

New that day

criticalpatched 15 Oct 2026 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses @tanstack/start-server-core (npm), @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/vue-start (npm) ## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. ## Cause… fixed in @tanstack/start-server-core 1.169.39 +3CVE-2026-1029895 sources
criticalpartial fix 15 Oct 2026 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks github.com/argoproj/argo-cd/v2 (go), github.com/argoproj/argo-cd/v3 (go) ### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it. When the Application is deleted, Argo CD… fixed in github.com/argoproj/argo-cd/v3 3.3.15 +3CVE-2026-774595 sources
criticalpatchedexploited 15 Oct 2026 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15 (federal deadline 2026-10-18). CVE-2026-215892 sources