New that day
- criticalpatched Pillow: Heap buffer overflow in ImagingJpegDecode Pillow (pip) ## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scale_num`/`scale_denom`, calls `jpeg_start_decompress()`,…
- highno fix yetexploited Plex Media Server External Control of File Name or Path Vulnerability Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Can be chained with CVE-2026-96655, CVE-2026-96654, CVE-2026-96652. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23).
- highpatchedexploited EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23).
- highpatchedexploited Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20 (federal deadline 2026-11-03).