Daily brief, Thursday, October 29, 2026

Breaking

Emerging

Critical bugs in widely used enterprise tech, not spreading widely yet.

Newly exploited in the wild

• 8.6CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCISA KEVUnauthenticated remote attacker can reload Cisco Secure Firewall ASA and FTD devices via the Remote Access SSL VPN service, causing denial of service.
• 10.0CVE-2026-97229 GitLab GitLabCISA KEVDetectionCVE published Oct 13, 2026An attacker can execute arbitrary code on the GitLab server without authentication.

New public exploit code

• 6.8CVE-2026-116167 Siyuan-Note siyuanNuclei templateDetectionSiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href without scheme validation. Attackers can send a crafted link with a javascript: URI that
• 6.5CVE-2026-116070 Dqzboy Docker-ProxyNuclei templateDetectionDocker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bo
• 6.5CVE-2026-115886 pip mlflowNuclei templateDetection### Summary MLflow's tracking server exposes `POST /ajax-api/3.0/mlflow/scorer/invoke` with **no authentication**, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the opt
• 9.8CVE-2026-110447 Collabora Collabora Online - Built-in CODE ServerNuclei templateKEVDetectionCVE published Oct 14, 2026Remote code execution via OS command injection in proxy.php of Collabora Online Built-in CODE Server (richdocumentscode Nextcloud app) before 26.4.303.
• 9.8CVE-2026-104736 Thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online CoursesNuclei templateDetectionCVE published Oct 17, 2026An attacker gains arbitrary code execution on WordPress installations using LearnPress plugin versions up to 4.4.10.
• 9.8CVE-2025-58434 FlowiseAI FlowiseMetasploit moduleDetectionCVE published Sep 12, 2025Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication o

2 older CVEs (published more than 7 days earlier) with new exploit code, below the bar (CVSS under 9, not widely used enterprise tech): CVE-2026-55864 (7.8), CVE-2026-48048 (7.5).

New critical CVEs

• 9.8CVE-2026-93680 IBM Langflow OSSexploit codeAn attacker can bypass security restrictions on IBM Langflow OSS.
• 9.9CVE-2026-107328 IBM Langflow OSSexploit code+1 more CVEs in the same releaseA remote authenticated attacker can execute arbitrary code on IBM Langflow OSS.
• 9.9CVE-2026-107327 IBM Langflow OSSexploit codeA remote authenticated attacker can execute arbitrary code on IBM Langflow OSS.
• 10.0CVE-2026-84295 Progress Software WS FTP Serverexploit codeUnauthenticated remote attackers can access sensitive information, including administrative credentials, in Progress WS_FTP Server before 2024.0.6 and 2025.0.3 on Windows.
• 9.4CVE-2026-103093 ServiceNow ServiceNow AI PlatformAuthenticated users with the admin role can escape the Rhino sandbox in ServiceNow AI Platform to run arbitrary code on the host operating system.
• 9.8CVE-2026-61992 Von Eyal Fitoussi GEO my WordPressAn attacker gets remote code execution in GEO my WordPress without authentication.
• 9.9CVE-2026-90868 Progress Software WS FTP Server+1 more CVEs in the same releaseAn attacker can execute arbitrary commands in WS FTP Server on Windows under certain configurations.
• 9.8CVE-2026-97854 Yamaha NWR100An attacker can execute arbitrary OS commands on Yamaha NWR100.
• 9.9CVE-2026-119145 Frappe frappeAn authenticated attacker can upload files to unintended locations via a path traversal vulnerability in Frappe.
• 10.0CVE-2026-61991 Ajax Load More AjaxLoadMore CacheUnauthenticated remote code execution in AjaxLoadMore Cache versions 3.1.1 and earlier, a WordPress plugin, via code injection (CWE-94).
• 9.8CVE-2026-104339 IBM Langflow OSSAn attacker gets remote code execution with IBM Langflow OSS.
• 9.1CVE-2026-90866 Progress Software WS FTP Server+1 more CVEs in the same releaseAn attacker gets data access with Progress Software WS FTP Server without authentication.
• 9.4CVE-2026-66088 Apereo Foundation openEQUELLAAn attacker gets remote code execution in openEQUELLA without authentication or user interaction.
• 9.1CVE-2026-90863 Progress Software WS FTP ServerAn attacker gets privilege escalation with Progress Software WS FTP Server without authentication.
• 9.8CVE-2026-110186 IBM Langflow OSSA remote attacker can execute arbitrary code on IBM Langflow OSS.
• 9.8CVE-2026-109516 Guruteam Bot for Telegram on WooCommerceAn attacker can bypass authentication and take over accounts on the Bot for Telegram on WooCommerce plugin for WordPress.
• 9.8CVE-2026-42922 Frangoteam FrangoteamAn authorization bypass in the /nodered feature of Frangoteam FUXA 1.3.2-2809 lets a specially crafted HTTP request lead to arbitrary code execution.
• 9.8CVE-2026-54859 ThemeREX PreservationAn attacker gets remote code execution in Preservation without authentication.
• 9.3CVE-2023-22793 Microsoft Management Pack for Microsoft System CenterAn attacker can execute code on servers running Veeam Management Pack for Microsoft System Center without authentication.
• 9.8CVE-2026-61997 ThemeREX Legal StoneAn attacker gets remote code execution without authentication in Legal Stone <= 1.2.11.

62 more critical CVEs in this window: see them on the dashboard.

Ransomware

27 victims posted to leak sites. Most active: booba team (7), qilin (4), everstake (4), rhysida (2), global secret group (2).

Financial services hit: rolly.io (whitearmor), ca***s.com (everstake), INTAX, Inc. (rhysida), National Association of Credit Management (booba team).

New data breaches

No new breaches published.