20 vulnerabilities across 11 products scored HIGH or above on September 30, 2026.

  • 🟠 HIGH: 20

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-100752 (ordasoft.com/real_estate_manager_(free)_extension_for_joomla) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-09-28 bulletin.
  • [UPGRADED] CVE-2026-82901 (themefic/ultra_addons_for_contact_form_7) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-26 bulletin.
  • [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.

🟠 [HIGH] openbsd/openbsd

1 CVE | CVSS 4.0: 9.2 | AAS 11.7

  • cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] cisco/cisco_catalyst_sd-wan_manager

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] quenary/tugtainer

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:quenary:tugtainer:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] denoland/deno

1 CVE | CVSS 4.0: 9.2 | AAS 10.5

  • cpe:2.3:a:denoland:deno:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] jetbrains/teamcity

2 CVEs | CVSS 3.1: 8.8 | AAS 10.2

  • cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] estatik/estatik

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:estatik:estatik:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] liquid_web_/_stellarwp/givewp

1 CVE | CVSS 3.1: 9.1 | AAS 10.0

  • cpe:2.3:a:liquid_web_stellarwp:givewp:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] jetbrains/youtrack

1 CVE | CVSS 3.1: 8.9 | AAS 9.5

  • cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] py-pdf/pypdf

8 CVEs | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:py-pdf:pypdf:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] apache_software_foundation/apache_mina_sshd

2 CVEs | CVSS 3.1: 9.1 | AAS 9.0

  • cpe:2.3:a:apache:apache_mina_sshd:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory

🟠 [HIGH] withastro/astro

1 CVE | CVSS 4.0: 8.2 | AAS 9.0

  • cpe:2.3:a:withastro:astro:*:*:*:*:*:*:*:*

You’ve hit your weekly limit · resets Oct 2, 7am (America/Toronto)

Vendor Advisory