Daily Brief - 2026-10-30

2026-10-30 · 5 vulnerabilities · 6 min listen

CVE-2026-107347

high · CVSS 8.4 · HashiCorp Nomad

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Remote Code Execution
Privilege Escalation
container orchestration
infrastructure as code

CVE-2026-110186

critical · CVSS 9.8 · IBM Langflow OSS

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

Remote Code Execution
web application
python
automation tools

CVE-2026-90868

critical · CVSS 9.9 · Progress Software WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

Command Injection
file transfer protocol
server software

CVE-2026-92744

Delinea Privilege Manager

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

Remote Code Execution
endpoint management
agent software

CVE-2026-96203

high · CVSS 8.8 · Microsoft Edge

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

Use After Free
web browser