InTouch Access Anywhere contains a Relative Path Traversal that could allow a remote attacker with network access to read files on the system outside of the secure gateway web server. CVSSv3 score of 7.5
More info.

Advantech iView contains a SQL Injection vulnerability that could allow an attacker to acquire credentials. CVSSv3 score of 7.5
More info.

Dell ECS update is available for multiple security vulnerabilities in third-party software that may be exploited by remote attackers to compromise the affected system. Dell rates this Critical.
More info.

A DoS vulnerability in the fsicapd component can be triggered remotely.  WithSecure rates this Medium.
More info.

TIBCO Nimbus Web Client contains a vulnerability that allows an unauthenticated attacker with network access to exploit an open redirect on the affected system. CVSSv3 score of 9.3
More info.

Logix Controllers contain a vulnerability that will allow a remote attacker to cause a DoS on a targeted device.  CVSSv3 score of 8.6
More info.

AMI reported potential security vulnerabilities in some AMI MegaRAC SP-X Baseboard Management Controller that may allow user enumeration, unauthorized access or arbitrary code execution. Highest CVSSv3 score of 9.8
More info.

Monthly Patches are out with 6 bulletins, 1 rated High, 2 rated Medium, and 3 rated Low.  Highest CVSSv3 score of 7.7
More info.

PHP has updates to fix several vulnerabilities.  Highest CVSSv3 score of 9.8
More info. And here. And here.

It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
More info. And here.

A command injection vulnerability allows a remote attacker to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. CVSSv3 score of 9.8
More info.

BIG-IP and BIG-IQ are vulnerable to an issue in Java SE that could allow an attacker to create, delete or modify access to critical data. CVSSv3 score of 5.3
More info. And here.

Oracle Linux has updated the kernel. More info.
Red Hat has updated kpatch, grub2. More info.
Ubuntu has updated u-boot and others. More info.

Potential security vulnerabilities in some Intel Server Board Baseboard Management Controller (BMC) firmware may allow escalation of privilege or information disclosure. Highest CVSSv3 score of 8.3
More info.

Google Monthly Patches for Android have been published, and include fixes for 46 vulnerabilities, 4 rated Critical, plus Imagination Technologies, MediaTek, Unisoc, and Qualcomm.
More info.

Google Pixel Monthly Patches are also out, with 149 security vulnerability fixes, plus Qualcomm and Android patches.
More info.

Samsung Monthly Patches are out, with 13 Samsung vulnerabilities, plus Google Android.
More info.

Microsoft has updated Edge for the latest chromium vulnerabilities, including the latest exploited vulnerability.
More info.

IBM Cloud Transformation Advisor has addressed multiple security vulnerabilities. Highest CVSSv3 score of 9.8
More info. And here. And here. And here. And here. And here. And here. And here. And here.

Dell NetWorker vProxy remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected systems. Dell rates this Critical.
More info.

Dell has updated Avamar ADS Gen5A PowerEdge. Dell rates this Critical.
More info.

Qualcomm Monthly Patches are out, with 16 vulnerabilities, 1 rated Critical, 14 rated High, and 1 rated Medium. Highest CVSSv3 score of 8.4
More info.

Mediatek Monthly Patches include 19 vulnerabilities, 6 rated High and 13 rated Medium. No CVSSv3 scores assigned yet.
More info.

pgAdmin has been updated to ensure only authorized and authenticated users can validate binary paths when using pgAdmin running in server mode.
More info.

Google has updated Chrome for Desktop to fix a security vulnerability rated High.  An exploit exists.
More info.

Sophos Firewall has been updated to fix several security vulnerabilities, include RCE via the User Portal and Webadmin. Highest CVSSv3 score of 9.8
More info.

The latest version of MISP includes two security fixes for Critcal vulnerabilities. CVSSv3 score of 10 according to CERT Bund.
More info.

Horner Automation Remote Compact Controller update fixes 3 vulnerabilities. Successful exploitation of these vulnerabilities could allow an attacker to obtain credentials to the affected device and obtain complete control. Highest CVSSv3 score of 9.8
More info.

IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. Highest CVSSv3 score of 9.8
More info. And here. And here. And here. And here. And here.

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in cURL libcurl. CVSSv3 score of 9.8
More info.

Asterisk has published a bulletin identifying a remote crash vulnerability in H323 channel add on.
More info.

Google has updated ChromeOS and fixed 1 High Severity bug.
More info.

NetApp has published 4 new bulletins identifying vulnerabilities in third-party software included in their products.  No patches yet. Highest CVSSv3 score of 8.8
More info.

Ubuntu has updated the kernel. More info.

Xerox FreeFlow Print Server v7 and v9 have been updated with Oracle October 2022 patches. CVSSv3 score of 10, according to CERT Bund.
More info. And here.

Form 7 recloser control and Proview NXG use CODESYS components.  Eaton has published a bulletin identifying vulnerabilites from 2021 and 2022 in their products due to CODESYS. A remote attacker could download and execute malicious code, cause a DoS, or cause a device to restart unexpectedly.
More info.

LenelS2’s OnGuard platform is vulnerable to a Client Authentication Bypass vulnerability in Erlang/OTP through the installation/use of RabbitMQ. CVSSv3 score of 9.8
More info.

Apple has published a security update for iOS, but no details are available yet.
More info.

IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of GnuPG. Highest CVSSv3 score of 9.8
More info.

IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from Expat, SQlite, libxml2, Libksba, zlib and GnuTLS. Highest CVSSv3 score of 9.8
More info.

FactoryTalk Live Data Communication Module is vulnerable to a MitM attack. CVSSv3 score of 5.9
More info.

Access Appliance and NetBackup Flex Scale are vulnerable to an unauthenticated command injection vulnerability. CVSSv3 score of 9.8
More info.

ping contains memory safety bugs that can be triggered by a remote host, causing the ping program to crash. It may be possible for a malicious host to trigger remote code execution in ping. CVSSv3 score of 10, according to CERT Bund.
More info.

Google has updated Chrome for Desktop to fix 28 security vulnerabilities.
More info.

Microsoft is aware. More info.

SUSE has updated the kernel. More info.
Red Hat has updated the kernel, kernelrt, and kpatch. More info.
Ubuntu has updated the kernel. More info.

In multiple products by Festo a remote unauthenticated attacker could use functions of undocumented protocols which could lead to a complete loss of confidentiality, integrity and availability. CVSSv3 score of 9.8
The solution is to update the documentation.
More info.

Several products are shipped with an unsafe configuration of the integrated CODESYS Runtime environment. In this case no default password is set to the CODESYS PLC and therefore access without authentication is possible. Highest CVSSv3 score of 9.8
More info.

A DoS vulnerability exists in MELSEC iQ-R Ethernet Interface Module. This vulnerability allows a remote unauthenticated attacker to cause a DoS by sending specially crafted packets. CVSSv3 score of 8.6
More info.

Moxa Secure Router EDR and TN Series contain an Improper Input Validation Vulnerability that could allow a remote attacker to cause a buffer overflow that crashes the web service.
This is a different bulletin than yesterday's.
More info.

Microsoft has updated Edge to fix the latest exploited vulnerability in chromium.
More info.

A flaw in BIG-IP named resolver code can cause excessive amounts of time on processing large delegations. By flooding the target resolver with queries exploiting this flaw, an attacker can deny legitimate clients access to the DNS resolution service. CVSSv3 score of 5.3
No patches yet.
More info.

NetApp has published 6 new bulletins identifying 5 vulnerabilities in Brocade SANnav and a vulnerability in Samba included in their products.
More info.

Google has updated Chrome for Desktop to fix 1 security vulnerability rated High.
More info.

A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Atos Unify OpenScape 4000 Manager that may allow an unauthenticated attacker to upload arbitrary files and get administrative access to the system. CVSSv3 score of 9.8
More info.

Moxa Secure Router EDR and TN Series contain an Improper Input Validation Vulnerability that could allow a remote attacker to cause a buffer overflow that crashes the web service.
More info.

Mageia has updated the kernel and kernel firmware. More info.
Oracle Linux has updated the kernel. More info.