Published threat advisories for October 21, 2026

Best Practice Software Bp Premier has a critical flaw where a hardcoded administrative password for its Microsoft SQL Server database allows network-accessible attackers to bypass application authentication, gain sysadmin privileges, and execute operating system commands. The relevance and exposure of this vulnerabilit

NVD modified: NVD date unavailable

HKUDS Vibe-Trading has a critical vulnerability where missing authentication allows unauthenticated attackers to access its FastAPI surface, potentially leading to root shell command execution, arbitrary file uploads, and access to sensitive information. This issue arises when a specific configuration key is not set, m

NVD modified: NVD date unavailable

A critical authentication bypass vulnerability exists in self-hosted Trigger.dev deployments that use default secrets, allowing unauthenticated attackers to forge magic link tokens and log in as any user. This could lead to unauthorized access to sensitive tenant data stored in databases like Postgres, Redis, and Click

NVD modified: NVD date unavailable

A vulnerability exists in vLLM that could allow an unauthenticated attacker to execute arbitrary Python code. This is possible by sending a specially crafted multimodal request to the `/tokenize` endpoint, which can lead to the import of malicious processor code when `trust_remote_code` is enabled. This could compromis

NVD modified: NVD date unavailable