https://payloadreport.com/section/cyber-attacks/western-allies-flag-cyber-threats-tied-to-chinas/Payload Reporten2026-10-10T13:12:15ZWestern Allies Flag Cyber Threats Tied to China’s Integrity Technology Grouphttps://payloadreport.com/section/vulnerabilities/anthropics-oss-scanner-offers-free-security-flaw/Payload Reporten2026-10-10T13:12:03ZAnthropic's OSS Scanner offers free security flaw detection for open-source codebaseshttps://payloadreport.com/section/data-breaches/tensorlake-npm-sdk-compromised-in-supply-chain/Payload Reporten2026-10-10T13:11:53ZTensorlake NPM SDK Compromised in Supply Chain Attackhttps://payloadreport.com/section/vulnerabilities/blocksy-companion-auth-bypass-lets-attackers/Payload Reporten2026-10-10T09:15:46ZBlocksy Companion Auth Bypass Lets Attackers Publish Content Without Loginhttps://payloadreport.com/section/vulnerabilities/smart-casa-deserialization-defect-scores-9-8-cvss/Payload Reporten2026-10-10T08:57:27ZSmart Casa Deserialization Defect Scores 9.8 CVSS in NVD for Versions Through 1.0.12https://payloadreport.com/section/vulnerabilities/vikunja-2-4-0-fixes-critical-idor-in-task/Payload Reporten2026-10-10T08:37:52ZVikunja 2.4.0 Fixes Critical IDOR in Task Collection Endpointhttps://payloadreport.com/section/vulnerabilities/onlyoffice-docs-rce-via-path-traversal-gets/Payload Reporten2026-10-09T13:14:02ZONLYOFFICE Docs RCE via path traversal gets CISA KEV status, federal deadline Oct 11https://payloadreport.com/section/vulnerabilities/apache-struts-rce-via-dmi-agencies-must-patch/Payload Reporten2026-10-09T13:11:22ZApache Struts RCE via DMI: Agencies Must Patch CVE-2016-3081 by Oct 11 After KEV Catalog Listinghttps://payloadreport.com/section/vulnerabilities/aws-databases-on-aws-plugin-fix-stops/Payload Reporten2026-10-08T19:14:57ZAWS databases-on-aws plugin fix stops unauthenticated remote code execution in v1.7.1https://payloadreport.com/section/vulnerabilities/handlebars-remote-code-execution-bug-in-4-0-4-7/Payload Reporten2026-10-08T18:05:42ZHandlebars Remote Code Execution Bug in 4.0-4.7.9 Lets Attackers Inject JavaScript