Patch Management is a topic tracked in our intelligence system with 5 linked articles.
Node.js shipped security updates on October 21 fixing 10 flaws across all three supported release lines (22.x, 24.x, 26.x), the most severe being a Brotli decompression bug that permits remote code execution.
Volexity disclosed that an attacker chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain unauthenticated root command execution, with Ivanti having patched only two of the three flaws so far.
Azure Cosmos DB reportedly exposed a platform-wide key that could grant access to any database, signaling a severe cloud security flaw with broad potential customer and regulatory implications.
N-able reports attackers exploited an authentication bypass in N-central; the initial fix was incomplete, with patch build 2026.3.1.7 released on August 2 as the first unaffected version for affected builds.
CISA adds three actively exploited flaws to KEV, including Langflow CVE-2026-9198 (CVSS 9.8) RCE; two other flaws in Tomcat and N-central flagged, signaling urgent patching and regulatory/compliance considerations for affected firms.
CISA added the exploited N-able N-central flaw CVE-2026-18577 to the KEV catalog, with CVSS 8.2, tied to incomplete patching of CVE-2026-18556 and active exploitation in the wild.
Subscribe for real-time topic updates and unlimited access to our intelligence platform.