QCS Security Advisory Desk
Security Advisory Desk.
Monitor network-edge vulnerabilities, known exploitation, affected products, mitigations, and vendor patch guidance without waiting for a weekly editorial cycle.
QCS pathSource-to-action path
- 01Official sourceMonitor vendors and trusted authorities.
- 02Verify contextCheck products, exposure, and evidence.
- 03Set prioritySeparate urgent action from useful reading.
- 04Act or learnPatch, mitigate, investigate, or prepare.
Live intelligence
See the items that can change today's patch or mitigation plan.
Priority combines source severity, known exploitation, remote attack conditions, recency, and network-edge relevance.
unrated Exploitation reported
Amazon Web Services / Priority 70
CVE-2026-10740 - Excessive memory allocation in s2n-quic
A security vulnerability in the AWS Cloud Development Kit (CDK) tool aws-cdk-lib allows a user who can control certain configuration properties to execute arbitrary operating system commands on the machine running the CDK toolchain. This could let an attacker run harmful commands if they control those property values.
- Published
- 9 Oct 2026
- CVSS
- Not scored
- Verified
- 10 Oct 2026
unrated Exploitation reported
Ubuntu / Priority 70
USN-8911-1: Linux kernel (OEM) vulnerabilities
Several security vulnerabilities were found in the Linux kernel used in Ubuntu. These issues could allow an attacker to compromise the system. The affected components include various hardware drivers, network protocols, and file systems. Ubuntu has released updates to fix these problems and strongly advises users to apply these updates and reboot their systems.
- Published
- 9 Oct 2026
- CVSS
- Not scored
- Verified
- 11 Oct 2026
unrated Exploitation reported
Ubuntu / Priority 70
USN-8875-2: Linux kernel (NVIDIA) vulnerabilities
Multiple security flaws were discovered in the Linux kernel used in NVIDIA systems, including a specific weakness in the i.MX clock driver where improper memory handling could lead to system crashes. These issues could allow local attackers to disrupt system operations or potentially compromise systems running affected versions.
- Published
- 9 Oct 2026
- CVSS
- Not scored
- Verified
- 11 Oct 2026
unrated Exploitation reported
Ubuntu / Priority 70
USN-8903-2: Linux kernel vulnerabilities
Several security weaknesses were found in the Linux kernel affecting many parts and drivers. An attacker might exploit these flaws to compromise the system's security. Updates have been released to fix these issues in Ubuntu's Linux kernels.
- Published
- 9 Oct 2026
- CVSS
- Not scored
- Verified
- 11 Oct 2026
unrated Exploitation reported
Ubuntu / Priority 70
USN-8905-2: Linux kernel (GCP) vulnerabilities
Multiple security vulnerabilities were found in the Linux kernel used on Google Cloud Platform (GCP) systems. These weaknesses affect many components, and an attacker could possibly use them to compromise a system. The issue has been addressed by Ubuntu in a security update that fixes flaws across a wide range of hardware architectures and drivers, including network, USB, file system, memory management, and many others.
- Published
- 9 Oct 2026
- CVSS
- Not scored
- Verified
- 11 Oct 2026
unrated
Ubuntu / Priority 70
USN-8910-1: libxml2 vulnerabilities
Multiple security flaws were found in libxml2, a library used to process XML data in Ubuntu systems. These flaws could allow attackers to crash the library, cause denial of service, use excessive system resources, or potentially execute malicious code. One issue could also allow attacks like XML external entity injection or server-side request forgery. These vulnerabilities affect various Ubuntu releases, including 26.04 LTS and older long-term support versions.
- Published
- 8 Oct 2026
- CVSS
- Not scored
- Verified
- 11 Oct 2026
unrated Exploitation reported
Amazon Web Services / Priority 70
CVE-2026-107608: Improper link resolution in asset bundling output handling in aws-cdk-lib
AWS CDK is a tool that helps developers build and deploy cloud infrastructure using code. A security issue was found where specially crafted Dockerfiles used during the asset packaging step could insert hidden linked files (symlinks) into the packaged output without those symlinks being part of the original input. This could let unintended files or directories slip into deployments.
- Published
- 8 Oct 2026
- CVSS
- Not scored
- Verified
- 9 Oct 2026
unrated Exploitation reported
Amazon Web Services / Priority 70
CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code
AWS Toolkit for Visual Studio Code, an extension used by developers to work with AWS services, had a security issue where a user's login token was saved in a file accessible by anyone on the same computer. This file was not deleted after use, risking unauthorized access by others sharing the machine. AWS fixed this in a recent update released in July 2026.
- Published
- 8 Oct 2026
- CVSS
- Not scored
- Verified
- 9 Oct 2026
unrated Exploitation reported
Citrix / Priority 70
CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC and Gateway have a memory buffer vulnerability that can be exploited to cause a denial of service, disrupting normal operation.
- Published
- 4 Oct 2026
- CVSS
- Not scored
- Verified
- 6 Oct 2026
unrated Exploitation reported
Amazon Web Services / Priority 70
CVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker Distribution
Amazon SageMaker Unified Studio lets teams work together on AI and data projects. A vulnerability was found in how SageMaker Spaces start up, where unsafe handling of network connection details could let a user run harmful commands in another team member's workspace. This could expose sensitive access credentials when a special security feature is enabled, allowing attackers to act as others. AWS fixed this by improving input handling, and the fix is automatically applied when SageMaker Spaces restart on supported software versions.
- Published
- 2 Oct 2026
- CVSS
- Not scored
- Verified
- 5 Oct 2026
unrated
Amazon Web Services / Priority 70
CVE-2026-103505 - Mount Option Injection in Amazon EFS CSI Driver
A security issue was found in the Amazon EFS CSI Driver, used by Kubernetes clusters with Amazon Elastic File System. Someone with permission to create PersistentVolumes could add extra mount instructions that the system would accept, possibly causing unexpected behavior. Users should upgrade to version 3.5.0 or later and restrict who can create PersistentVolumes to trusted administrators.
- Published
- 2 Oct 2026
- CVSS
- Not scored
- Verified
- 5 Oct 2026
unrated
Amazon Web Services / Priority 70
CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
A security issue was found in the data masking feature of the Powertools for AWS Lambda (Python) toolkit. This flaw could let someone see sensitive information that the application meant to hide. Amazon fixed this in a newer version and recommends users upgrade.
- Published
- 1 Oct 2026
- CVSS
- Not scored
- Verified
- 5 Oct 2026