Index
Search
Search the public record. Drafts and scheduled notes are not included.
research
Visual Studio and SSMS Copilot flaw CVE-2026-103572 allows code execution
Microsoft fixed CVE-2026-103572 on 13 October 2026. A prompt-injected GitHub Copilot in Visual Studio or SSMS could rewrite its own config and run code. CVSS 3.1 8.8 (Important, scored by Microsoft). Fixed in Visual Studio 2022 17.14.42 and 2026 18.10.4. Researcher PoC public. Not exploited, not in CISA KEV.
Published 22m ago
threats
Nextcloud richdocumentscode proxy RCE is CVE-2026-110447
MITRE’s CVE-2026-110447 covers OS command injection in Nextcloud’s Collabora Online Built-in CODE Server app before 26.4.303. The CVE states exploitation in the wild in September and October 2026 with PHP webshells reported by operators. Fixed in 26.4.303. CVSS 4.0 9.2. Not in CISA KEV.
Published 4h ago
CVE-2026-110447
Nextcloud richdocumentscode proxy.php OS command injection
RCE
Published 6h ago
CVE-2026-103572
Visual Studio and SSMS GitHub Copilot code injection RCE
RCE
Published 19h ago
news
NetScaler SAML overflow CVE-2026-107406 needs new builds
Citrix CTX697191 discloses CVE-2026-107406, a critical memory overflow (CVSS 4.0 9.5) in NetScaler ADC and Gateway configured as a SAML SP or IdP that may lead to RCE or DoS. It is a new CVE, separate from the exploited CVE-2026-88779. The 88779 fix builds remain affected as a SAML IdP. Upgrade to 14.1-73.46 or 13.1-64.29. Not in KEV; Citrix is not aware of exploitation.
Published 5d ago
threats
NetScaler SAML memory overflow is being exploited
CVE-2026-88779 is a CVSS 4.0 8.7 memory overflow DoS on customer-managed NetScaler ADC/Gateway configured as a SAML SP or IdP. Citrix reports targeted attacks; CISA listed it in KEV on 4 October 2026. Fixed in 14.1-73.41 and 13.1-64.28. Earlier 88771/88772 builds do not close it.
Published 7d ago