Daily brief · Friday 30 October 2026 · generated 10:56 UTC

55 new criticals.
1 to patch today.

One vulnerability entered CISA KEV overnight, a GitLab GitLab bug. ThemeREX shipped 24 criticals.

cvelistV510:56Z

CISA KEV12:16Z

Vulnrichment10:56Z

NVD10:56Z

EPSS12:16Z

Patch today

In KEV, publicly exploited, or SSVC “Act”. Ordered by priority.

GitLab1 report · highest priority 99 · 1 in KEV

99priority

CVE-2026-97229·GitLab GitLab

Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially… From CVE record

KEV · added today · due 1 Nov EPSS 18%public exploit SSVC act CVSS 10.0

Also new today (55)

New CVSS ≥ 9.0 records outside the patch list, ordered by priority.

Open Operator view →

Ajax Load More1 report · highest priority 30

30Priority
CVE-2026-61991 · Ajax Load More AjaxLoadMore Cache
WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
CVSS 10.0

frappe1 report · highest priority 30

30Priority
CVE-2026-119145 · frappe frappe
Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
CVSS 9.9

IBM6 reports · highest priority 30

30Priority
CVE-2026-107327 · IBM Langflow OSS
Langflow OSS is affected by multiple vulnerabilities
CVSS 9.9
30Priority
CVE-2026-107328 · IBM Langflow OSS
Langflow OSS is affected by multiple vulnerabilities
CVSS 9.9
30Priority
CVE-2026-107329 · IBM Langflow OSS
Langflow OSS is affected by multiple vulnerabilities
CVSS 9.9
29Priority
CVE-2026-104339 · IBM Langflow OSS
Langflow OSS is affected by multiple vulnerabilities
CVSS 9.8
29Priority
CVE-2026-110186 · IBM Langflow OSS
Langflow OSS is affected by multiple vulnerabilities
CVSS 9.8
29Priority
CVE-2026-93680 · IBM Langflow OSS
Langflow OSS is affected by multiple vulnerabilities
CVSS 9.8

Progress Software6 reports · highest priority 30

30Priority
CVE-2026-84295 · Progress Software WS_FTP Server
Improper Authentication in Progress WS_FTP Server
CVSS 10.0
30Priority
CVE-2026-90868 · Progress Software WS_FTP Server
OS Command Injection in Progress WS_FTP Server
CVSS 9.9
27Priority
CVE-2026-90863 · Progress Software WS_FTP Server
Privilege Escalation via Missing Authorization in WS_FTP Manager
CVSS 9.1
27Priority
CVE-2026-90864 · Progress Software WS_FTP Server
Host Administrator Path Containment Bypass in Progress WS_FTP Server
CVSS 9.1
27Priority
CVE-2026-90865 · Progress Software WS_FTP Server
Command Injection via FTP Notification Variables in Progress WS_FTP Server
CVSS 9.0
27Priority
CVE-2026-90866 · Progress Software WS_FTP Server
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
CVSS 9.1

Dahua1 report · highest priority 29

29Priority
CVE-2025-31704 · Dahua Intelligent Connection Center
Dahua Intelligent Connection Center command injection
CVSS 9.8

Gravity Forms1 report · highest priority 29

29Priority
CVE-2026-103039 · Gravity Forms Gravity Forms
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
CVSS 9.8

ThemeREX24 reports · highest priority 29

29Priority
CVE-2026-54856 · ThemeREX RexCoin
WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-54857 · ThemeREX Quirky
WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-54858 · ThemeREX Printy
WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-54859 · ThemeREX Preservation
WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-54860 · ThemeREX Ozisti
WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-61997 · ThemeREX Legal Stone
WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-61998 · ThemeREX Le Truffe
WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62001 · ThemeREX Marcell
WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62002 · ThemeREX Meals & Wheels
WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62003 · ThemeREX Mission
WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62004 · ThemeREX Motorix
WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62005 · ThemeREX Muzicon
WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62006 · ThemeREX Nuts
WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62008 · ThemeREX Orpheus
WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62009 · ThemeREX Filmax
WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62010 · ThemeREX Avventure
WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62011 · ThemeREX Bonbon
WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62012 · ThemeREX Coinpress
WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62013 · ThemeREX Edge Decor
WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62014 · ThemeREX EmojiNation
WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62015 · ThemeREX Gamezone
WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62016 · ThemeREX Gamic
WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62017 · ThemeREX Good Homes
WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
CVSS 9.8
29Priority
CVE-2026-62018 · ThemeREX Gunslinger
WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
CVSS 9.8

Von Eyal Fitoussi1 report · highest priority 29

29Priority
CVE-2026-61992 · Von Eyal Fitoussi GEO my WordPress
WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability
CVSS 9.8

Yamaha Corporation1 report · highest priority 29

29Priority
CVE-2026-97854 · Yamaha Corporation NWR100
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.
CVSS 9.8

Zoho Flow1 report · highest priority 29

29Priority
CVE-2026-62131 · Zoho Flow Zoho Flow
WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
CVSS 9.8

agno-agi1 report · highest priority 28

28Priority
CVE-2026-119050 · agno-agi agno
Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
CVSS 9.2

monkeytypegame1 report · highest priority 28

28Priority
CVE-2026-118762 · monkeytypegame monkeytype
Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN
CVSS 9.3

OpenText1 report · highest priority 28

28Priority
CVE-2026-112256 · OpenText Advanced Authentication Server
Logon bypass (trust of attacker-controlled completed-methods list)
CVSS 9.2

randombit1 report · highest priority 28

28Priority
CVE-2026-118769 · randombit botan
Botan: Integer overflow when reporting block size in FFI can cause memory corruption
CVSS 9.2

RT-Labs1 report · highest priority 28

28Priority
CVE-2026-111732 · RT-Labs P-Net
Out-of-bounds write when parsing AR Vendor Block requests
CVSS 9.3

ServiceNow1 report · highest priority 28

28Priority
CVE-2026-103093 · ServiceNow ServiceNow AI Platform
Sandbox Escape via Table Rotation in ServiceNow AI Platform
CVSS 9.4

StylemixThemes1 report · highest priority 28

28Priority
CVE-2026-115964 · StylemixThemes Motors
WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability
CVSS 9.3

Teltonika Networks1 report · highest priority 28

28Priority
CVE-2026-82104 · Teltonika Networks RUT
API permission bypass via logic bug
CVSS 9.4

Veeam1 report · highest priority 28

28Priority
CVE-2023-22793 · Veeam Management Pack for Microsoft System Center
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization E…
CVSS 9.3

docat-org1 report · highest priority 27

27Priority
CVE-2026-61645 · docat-org docat
Docat has Arbitrary File Upload exists in Upload API
CVSS 9.1

socfortress1 report · highest priority 27

27Priority
CVE-2026-61707 · socfortress CoPilot
SOCFortress CoPilot: Stored case-report template injection permits backend code execution
CVSS 9.0

zitadel1 report · highest priority 27

27Priority
CVE-2026-119128 · zitadel zitadel
ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
CVSS 9.1

Newly exploited

CVE-2026-97229 · due 1 Nov

GitLab GitLab — Integer Overflow or Wraparound in GitLab

EPSS movers

No EPSS jumps of 15 points or more.

Vendor clusters

ThemeREX24× · Printy, Ozisti, Legal Stone, Le Truffe, Marcell, Meals & Wheels, Mission, Motorix, Muzicon, Nuts, Orpheus, Filmax, Avventure, Bonbon, Coinpress, Edge Decor, EmojiNation, Gamezone, Gamic, Good Homes, Gunslinger, Preservation, RexCoin, Quirky IBM6× · Langflow OSS Progress Software6× · WS_FTP Server

19 more single-vendor criticals in the full list →