Microsoft disclosed CVE-2026-109468, a 7.5 ASP.NET Core denial-of-service flaw affecting Visual Studio 2022 before 17.14.42, Visual Studio 2026 before 18.10.4, and System.Formats.Cbor before 10.0.13.
Correction (Oct 15): An earlier version listed Visual Studio and System.Formats.Cbor versions through the fixed builds as affected. The CVE record uses lessThan those builds (17.14.42, 18.10.4, and 10.0.13), which are the fixes.
The vulnerability stems from unbounded resource allocation in ASP.NET Core.
Security teams should prioritize patching Visual Studio instances in development environments to prevent service disruptions.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Microsoft disclosed CVE-2026-108452, an 8.8 path traversal RCE in SharePoint Server Subscription Edition before 16.0.20326.20190. KB5002927 fixes it; an authenticated Site Owner can exploit it over the network.
Adobe's APSB26-163 bulletin fixes more than 30 vulnerabilities in its Content Credentials Rust SDK, C2PA Tool and JS SDK. Adobe rates the worst, a server-side request forgery flaw, 8.6 and most others 7.5, and says it knows of no exploits in the wild.
Microsoft's October security release lists 10 Visual Studio Code vulnerabilities, all rated Important, led by a 9.6 remote code execution bug. None are exploited or publicly disclosed. Users should update to VS Code 1.141.1.
Renovate before 44.79.0 and five Mend Renovate products have a high-severity SSRF flaw, CVE-2026-110868, that can expose cloud credentials. VulnCheck rates it 8.5 under CVSS 3.1.
CISA has included CVE-2026-21589 in its known exploited list, covering eight Atlassian Data Center products with a short compliance window.
