QCS Security Advisory Desk
Security Advisory Desk.
Monitor network-edge vulnerabilities, known exploitation, affected products, mitigations, and vendor patch guidance without waiting for a weekly editorial cycle.
QCS pathSource-to-action path
- 01Official sourceMonitor vendors and trusted authorities.
- 02Verify contextCheck products, exposure, and evidence.
- 03Set prioritySeparate urgent action from useful reading.
- 04Act or learnPatch, mitigate, investigate, or prepare.
Live intelligence
See the items that can change today's patch or mitigation plan.
Priority combines source severity, known exploitation, remote attack conditions, recency, and network-edge relevance.
unrated Exploitation reported
Ubuntu / Priority 76
USN-8887-3: Linux kernel vulnerabilities
A number of security weaknesses were found in the Linux kernel affecting many parts of the system, including a specific issue on some AMD processors that could let an attacker with hypervisor access exploit memory protections for virtual machines. These flaws could allow attackers to compromise system security. Users are advised to update their Linux kernel to the versions that include these corrections.
- Published
- 9 Oct 2026
- CVSS
- Not scored
- Verified
- 11 Oct 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-107322 - OS command injection in Amazon Agent Plugins for AWS databases-on-aws
A security flaw was found in the Amazon Agent Plugins for AWS, specifically in the databases-on-aws plugin versions before 1.7.1. This flaw could allow an unauthorized remote attacker to execute commands on the operating system of the host machine if the agent processes crafted input that then triggers execution in a local helper script. The issue only arises if the agent runs the helper with the malicious input. Amazon has fixed this in version 1.7.1, and users should upgrade to that version or later. If upgrading isn't immediately possible, Amazon recommends avoiding certain plugin features and running the processes with minimal permissions to reduce risk.
- Published
- 8 Oct 2026
- CVSS
- Not scored
- Verified
- 9 Oct 2026
unrated
Cisco / Priority 76
Cisco Advance Notification for Publication of October 7, 2026, Security Advisories
On October 7, 2026, Cisco published several security advisories detailing critical and medium-severity vulnerabilities across Cisco NX-OS software and related products. These vulnerabilities include multiple remote code execution, denial of service, sandbox escape, and bypass flaws. Cisco strongly recommends customers upgrade to the fixed software versions provided in the advisories to remediate these issues. There are no workarounds noted at this time.
- Published
- 7 Oct 2026
- CVSS
- Not scored
- Verified
- 9 Oct 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF
AWS discovered two security problems in their Bedrock AgentCore Starter Toolkit, a Python package for working with Amazon Bedrock Agents locally. One problem (CVE-2026-105812) allows attackers to run malicious code if they import a specially crafted agent and then run or deploy it. The other problem (CVE-2026-106032) involves improper handling of external references that could cause unexpected network requests or unauthorized file access when importing an agent. AWS advises updating to version 0.3.14 or later and re-importing agents to apply fixes. The toolkit has been deprecated, so they recommend switching to the new AgentCore CLI tool for future work.
- Published
- 6 Oct 2026
- CVSS
- Not scored
- Verified
- 6 Oct 2026
unrated Exploitation reported
Ubuntu / Priority 76
USN-8890-1: libsoup vulnerabilities
Multiple security vulnerabilities were found in libsoup, an HTTP client/server library used in Ubuntu. These vulnerabilities could allow remote attackers to cause denial of service, gain unauthorized access to sensitive information, bypass security controls, or potentially execute arbitrary code. The issues affect several Ubuntu Long Term Support (LTS) versions, including 22.04, 24.04, and 26.04. Correcting these problems requires updating libsoup packages to fixed versions provided by Ubuntu.
- Published
- 6 Oct 2026
- CVSS
- Not scored
- Verified
- 8 Oct 2026
unrated Exploitation reported
Ubuntu / Priority 76
USN-8884-1: U-Boot vulnerabilities
Multiple security vulnerabilities were found in the U-Boot boot loader used by Ubuntu. These flaws involve improper handling of malformed ZFS and ext4 file system metadata, as well as incorrect processing of fragmented IP traffic with defragmentation enabled. An attacker could exploit these issues to run unauthorized code or cause a denial of service, potentially disrupting device startup or operation.
- Published
- 6 Oct 2026
- CVSS
- Not scored
- Verified
- 8 Oct 2026
unrated Exploitation reported
Ubuntu / Priority 76
USN-8889-1: Linux kernel (OEM) vulnerabilities
A set of security issues were found in the Linux kernel used on some systems. One specific problem involves certain AMD processors that do not correctly check memory access controls, which could let someone with high-level access in a virtualized environment exploit memory areas of secure virtual machines. Other vulnerabilities affect many parts of the Linux kernel, and attackers might use these issues to compromise affected systems. Updates have been released to address these issues on affected systems, such as Ubuntu OEM Linux kernels.
- Published
- 6 Oct 2026
- CVSS
- Not scored
- Verified
- 8 Oct 2026
unrated
Ubuntu / Priority 76
USN-8888-1: Linux kernel (Azure) vulnerabilities
Multiple security vulnerabilities were discovered in the Linux kernel used in Microsoft Azure environments, including a notable flaw in AMD processors related to memory access checks. A local attacker with hypervisor access might exploit these issues to compromise system security or the integrity of guest memory protected by SEV-SNP. Ubuntu has released updates to address these vulnerabilities across many subsystems and architectures used in the Linux kernel for Azure.
- Published
- 6 Oct 2026
- CVSS
- Not scored
- Verified
- 7 Oct 2026
unrated Exploitation reported
Amazon Web Services / Priority 76
CVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWS
Amazon Web Services (AWS) found and fixed three security problems in their open-source AI platform called Loom. These problems could allow attackers to bypass authentication, expose sensitive OAuth2 tokens and credentials, and mishandle outbound requests between parts of the system. AWS recommends upgrading Loom to version 1.7.0 and applying these fixes to any modified versions. Until then, there are temporary steps to reduce risk.
- Published
- 2 Oct 2026
- CVSS
- Not scored
- Verified
- 5 Oct 2026
unrated Exploitation reported
Cisco / Priority 76
CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Catalyst SD-WAN Manager has a security weakness in how it processes encoded information in web requests. This flaw allows a remote attacker, without needing any login, to gain admin-level access to the system by exploiting improper handling of URL encoding.
- Published
- 30 Sep 2026
- CVSS
- Not scored
- Verified
- 6 Oct 2026
unrated Exploitation reported
Citrix / Priority 76
CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler products have a security flaw where they don't properly limit certain memory operations. This can let attackers run harmful code or crash the system remotely. To reduce risk, users should follow Citrix's guidance to apply mitigations promptly and perform security checks as directed by U.S. government guidance.
- Published
- 27 Sep 2026
- CVSS
- Not scored
- Verified
- 6 Oct 2026
unrated Exploitation reported
Citrix / Priority 76
CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability
The Citrix NetScaler ADC and NetScaler Gateway products have a security vulnerability caused by improper input validation. This flaw could let an attacker who is not logged in run arbitrary commands on the system, potentially compromising it.
- Published
- 27 Sep 2026
- CVSS
- Not scored
- Verified
- 6 Oct 2026