27 vulnerabilities across 10 products scored HIGH or above on September 29, 2026.

  • 🟠 HIGH: 27

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-100752 (ordasoft.com/real_estate_manager_(free)_extension_for_joomla) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-09-28 bulletin.
  • [UPGRADED] CVE-2026-82901 (themefic/ultra_addons_for_contact_form_7) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-26 bulletin.
  • [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-75745 (adobe/experience_manager_forms) — F1: exploitable → functional, AAS: 13.8 → 15.8 (CRITICAL → CRITICAL). Originally in 2026-09-22 bulletin.
  • [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin.

🟠 [HIGH] google/chrome

3 CVEs | CVSS 3.1: 9.6 | AAS 11.4

  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (< 154.0.8037.57)

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] mozilla/thunderbird

13 CVEs | CVSS 3.1: 9.6 | AAS 10.6

  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] hitachi_energy/rtu500_series_cmu_firmware

1 CVE | CVSS 3.1: 9.1 | AAS 10.0

  • cpe:2.3:a:hitachi_energy:rtu500_series_cmu_firmware:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] gitlab/gitlab

1 CVE | CVSS 3.1: 8.7 | AAS 10.0

  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] electron/electron

1 CVE | CVSS 3.1: 8.2 | AAS 9.5

  • cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] videolan/vlc

1 CVE | CVSS 4.0: 8.5 | AAS 9.4

  • cpe:2.3:a:videolan:vlc:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] red_hat/red_hat_enterprise_linux_10

4 CVEs | CVSS 3.1: 8.6 | AAS 9.4

  • cpe:2.3:a:redhat:enterprise_linux:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] ollama/ollama

1 CVE | CVSS 4.0: 8.5 | AAS 9.3

  • cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] flowring_technology_corp/agentflow_4.0

1 CVE | CVSS 4.0: 9.3 | AAS 9.2

  • cpe:2.3:a:flowring_technology_corp:agentflow_4.0:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] ibm/guardium_data_protection

1 CVE | CVSS 3.1: 9.1 | AAS 9.0

  • cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory