Critical Vulnerabilities Patched in OpenAM with Release of Version 16.1.2
OpenAM has been found to contain multiple vulnerabilities, some of which allow remote code execution. The development team addressed these issues by releasing security update OpenAM 16.1.2 on July 20, 2026, covering 18 vulnerabilities in total, including those inherited from third-party dependencies.
The flaw tracked as CVE-2026-62379 affects the authentication endpoint. It permits loading and instantiating arbitrary Java classes specified in XML without any validation, enabling unauthenticated attackers to execute code on the server. Another critical issue, CVE-2026-62263, arises from insufficient restrictions on deserialized objects during authentication, again allowing unauthenticated remote code execution.
GitHub assigned CVE-2026-62379 a CVSS v3.1 base score of 9.8, while CVE-2026-62263 received a CVSS v4.0 score of 9.2; both are rated Critical. The update additionally fixes cross-site scripting vulnerability CVE-2026-62280 on the authorization consent page and resolves issues in dependent software including the Node.js component, js-yaml, and websocket-driver.
Full list of addressed CVEs
- CVE-2026-45736
- CVE-2026-48779
- CVE-2026-49982
- CVE-2026-53550
- CVE-2026-54466
- CVE-2026-54490
- CVE-2026-61787
- CVE-2026-62261
- CVE-2026-62263
- CVE-2026-62280
- CVE-2026-62379
- CVE-2026-63463
- CVE-2026-63467
- CVE-2026-63468
- CVE-2026-63484
- CVE-2026-63485
- CVE-2026-63487
- CVE-2026-63488
Related articles
CISA Adds Five Exploited Vulnerabilities to KEV Catalog Including AhsayCBS Authentication and Command Injection Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Four vulnerabilities were registered on October 14, 2026, and one additional entry followed on October 15. Among the newly listed issues are two critical flaws affecting the AhsayCBS backup management server: CVE-2026-105133, an authentication bypass in the API, and CVE-2026-105134, a command injection vulnerability in the replication feature. When chained together, the pair allows unauthenticated remote attackers to execute arbitrary operating system commands. Vendor Ahsay has released hotfixes in versions 10.3.4.45 and 9.15.2.70 because standard patches cannot fully address the issues. The advisory also references vulnerabilities in Atlassian products and multiple network security solutions from other vendors.
Google Issues Chrome Security Update Fixing Critical Vulnerability Two Days After Previous Patch
Google has released a new set of security updates for its Chrome browser that address ten vulnerabilities, including one rated critical. The update arrives just two days after a larger patch that fixed 37 issues on October 13. The most severe flaw, tracked as CVE-2026-110922, is a use-after-free vulnerability in the Prerender feature that could allow remote code execution. The company released Chrome 155.0.8059.85 and 155.0.8059.84 for Windows and macOS, along with Chrome 155.0.8059.84 for Linux on October 15. The critical issue was reported by an external researcher on October 2. Deployment will occur gradually over the next several days to weeks.
543 Vulnerabilities in FFmpeg: Hunting Flaws in the Industry Standard
FFmpeg, the open-source library serving as the de facto standard for audio and video processing in mobile apps, carries approximately 543 registered CVEs that frequently appear in bug bounty programs. A Quokka report on over 150,000 applications found critical third-party CVEs in 11% of Android and 13% of iOS apps, with high-severity issues in 65% of Android applications. The article examines three notable vulnerabilities including PixelSmash (CVE-2026-8461), HTTP chunked overflow (CVE-2016-10190), and an AV1 RTP depacketizer flaw (DFVULN-127), each enabling remote code execution through memory corruption. It provides practical guidance on locating FFmpeg binaries inside APKs, identifying integration patterns, determining versions via strings and NDK timestamps, and extracting build configurations to confirm enabled components. Analysts are shown how to locate protocol handlers that serve as entry points without requiring malicious media files. The material targets reverse engineers experienced with ELF libraries and memory corruption issues.
Anthropic OSS Scanner Uncovers 29,439 Vulnerability Candidates in Open Source Projects, Delivering 6,157 Reports and 516 Fixes
Anthropic has published detailed metrics from its six-month coordinated vulnerability disclosure program that preceded the launch of its automated OSS Scanner service. The company’s models identified 29,439 potential vulnerabilities, of which external firms verified 6,123 candidates and confirmed 5,674 as genuine issues. From the 6,157 reports sent to maintainers across 591 projects, only 516 fixes have been merged so far, representing an 8.4 percent remediation rate among delivered reports. Anthropic emphasizes that 78 percent of reports were sent without independent human triage, and the new OSS Scanner now delivers fully model-generated findings directly to approved projects. Maintainers from PostgreSQL, curl, OpenSSL, wolfSSL and HotCRP have praised the quality of recent reports while noting that earlier AI-generated submissions were largely noise. The dashboard snapshot dated 2 October 2026 shows that 584 identifiers (219 CVE and 365 GHSA) have been issued, yet many confirmed issues remain in the triage queue due to limited human resources.