Juniper Networks disclosed more than 150 Junos OS and Evolved vulnerabilities, at least 15 rated 9.8 by Juniper. Critical issues include unauthenticated root access through J-Web and buffer overflows in routing and service daemons.
CVE-2026-101956 enables an unauthenticated remote attacker to run arbitrary Junos commands at root level via the J-Web interface.
CVE-2026-101986 lets an unauthenticated network attacker bypass J-Web authentication and run CGI content at elevated privileges with a crafted HTTP request.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Adobe has patched 11 CVEs in Substance 3D Stager 3.1.8 and earlier, each rated 7.8 by Adobe. All can lead to arbitrary code execution when a user opens a malicious file.
Adobe disclosed CVE-2026-106634, a path traversal flaw in Experience Manager 6.5 LTS SP3 and earlier and 6.5.25 and earlier that lets low-privileged attackers write files to unauthorized locations. Adobe rates it 7.7 under CVSS 3.1.
Microsoft's October security release lists 10 Visual Studio Code vulnerabilities, all rated Important, led by a 9.6 remote code execution bug. None are exploited or publicly disclosed. Users should update to VS Code 1.141.1.
A critical SQL injection vulnerability assigned CVE-2026-97668 affects the Abandoned Cart Pro for WooCommerce plugin in all versions through 10.8.0. Unauthenticated attackers can extract database information and escalate privileges to administrator via the wp_usermeta table.
Powerlevel10k through 1.20.0 has CVE-2026-110102, an insecure download flaw in its gitstatus installer. VulnCheck rates it 7.5 under CVSS 3.1 and 7.7 under CVSS 4.0; NVD has not scored it. The maintainer confirmed the report and advised against installing on systems without digest tools where a man-in-the-middle attack is possible.
