21 vulnerabilities across 10 products scored HIGH or above on October 01, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 20

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-100752 (ordasoft.com/real_estate_manager_(free)_extension_for_joomla) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-09-28 bulletin.
  • [UPGRADED] CVE-2026-82901 (themefic/ultra_addons_for_contact_form_7) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-26 bulletin.
  • [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.

🔴 [CRITICAL] fortinet/fortimail

1 CVE | CVSS 3.1: 9.8 | AAS 14.9

  • cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* (>= 7.2.0, <= 7.4.8)
  • cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* (>= 7.6.0, <= 7.6.6)
  • cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:* (>= 8.0.0, <= 8.0.1)

Fortinet FortiMail is affected by a critical path traversal vulnerability (CVE-2026-104286, CVSS 9.8) that allows an unauthenticated attacker to write arbitrary files to the underlying system via crafted HTTP or HTTPS requests. Affected versions include FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. This vulnerability is confirmed exploited in the wild, making immediate action essential.

Any organization running FortiMail as part of its email security infrastructure should treat this as an emergency. Unauthenticated arbitrary file write at this severity level can lead to full system compromise, including remote code execution. Administrators should apply the vendor-provided patches immediately by consulting the Fortinet advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-175 and, where patching cannot be done immediately, restrict network access to the FortiMail management and web interfaces.

Vendor Advisory

🟠 [HIGH] tryghost/ghost

8 CVEs | CVSS 4.0: 8.7 | AAS 11.8

  • cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:*

TryGhost Ghost is affected by eight vulnerabilities, including multiple high-severity issues (max CVSS 8.7), spanning versions 4.0.0 through before 6.63.0. The most notable flaw allows unauthenticated visitors to bypass content gating and access restricted posts by directly querying the content API, undermining paid subscription and membership models.

Organizations and publishers running self-hosted Ghost instances should update to version 6.63.0 or later immediately. These vulnerabilities are considered exploitable and require no authentication, making internet-facing Ghost deployments particularly at risk. Review the vendor security advisory at https://github.com/TryGhost/Ghost/security/advisories/GHSA-rcx7-6m7p-xw5c for full details and patch guidance.

Vendor Advisory

🟠 [HIGH] getsimplecms-ce/getsimplecms-ce

5 CVEs | CVSS 3.1: 9.6 | AAS 10.7

  • cpe:2.3:a:getsimplecms-ce:getsimplecms-ce:*:*:*:*:*:*:*:*

GetSimple CMS Community Edition prior to version 1.5 is affected by five vulnerabilities, including multiple critical-severity issues (max CVSS 9.6). The lead vulnerability enables a cross-site request forgery attack in which a remote attacker can trick an authenticated administrator into visiting a malicious page, triggering an attacker-controlled download-and-deploy operation on the server, effectively achieving remote code execution without direct authentication.

Administrators running self-hosted GetSimple CMS CE installations should upgrade to version 1.5 or later immediately. These vulnerabilities are considered exploitable and pose serious risk to any internet-facing deployment, particularly where administrators actively manage content. Consult the vendor advisory at https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-2rxv-4g4m-573w for complete details and remediation steps.

Vendor Advisory

🟠 [HIGH] renstillmann/super_forms_–drag&_drop_form_builder

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:renstillmann:super_forms_drag_drop_form_builder:*:*:*:*:*:*:*:*

The Super Forms Drag and Drop Form Builder plugin for WordPress versions up to and including 6.3.316 is affected by a critical privilege escalation vulnerability (CVE-2026-15989, CVSS 9.8). The Register and Login add-on fails to validate user-supplied role values during registration, allowing an unauthenticated attacker to submit a crafted request that assigns themselves any WordPress role, including administrator, achieving full site takeover.

Any WordPress site using Super Forms with the Register and Login add-on enabled should treat this as an emergency. Administrators should update beyond version 6.3.316 immediately or disable the registration functionality until a patch is applied. Refer to the vendor fix at https://github.com/RensTillmann/super-forms/pull/205 for remediation details.

Vendor Advisory

🟠 [HIGH] ionic-team/capacitor

1 CVE | CVSS 3.1: 9.3 | AAS 10.5

  • cpe:2.3:a:ionic-team:capacitor:*:*:*:*:*:*:*:*

Ionic Capacitor, a cross-platform native runtime for web applications, is affected by a high-severity vulnerability (CVE-2026-103922, CVSS 9.3) in versions 6.0.0 through multiple 6.x, 7.x, and 8.x releases. The Android and iOS WebView navigation guard fails to validate URL paths, allowing an attacker to redirect a frame to the internal HTTP interceptor proxy, which fetches attacker-controlled content and serves it under the application’s own origin, enabling same-origin data access and potential credential theft.

Development teams building mobile applications with Capacitor should update to versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, or 8.5.1 depending on their release branch. While exploitation requires user interaction with a malicious link, the impact of same-origin bypass in a mobile app context is severe. Review the vendor fix at https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e for implementation details.

Vendor Advisory

🟠 [HIGH] fleetdm/fleet

1 CVE | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*

Fleet, an open-source device management platform, versions prior to 4.87.0 are affected by a high-severity authentication bypass vulnerability (CVE-2026-103264, CVSS 9.3). The device API incorrectly accepts hostnames and hardware serial numbers as valid authentication tokens alongside device UUIDs, allowing unauthenticated attackers who know or can guess these non-secret identifiers to impersonate iOS and iPadOS hosts, access device data, and trigger device-scoped actions including software installation and MDM migration.

Organizations using Fleet for mobile device management should upgrade to version 4.87.0 or later immediately. This vulnerability is considered exploitable and is particularly dangerous in environments where device serial numbers or hostnames are exposed or predictable. Review the vendor advisory at https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f for full remediation guidance.

Vendor Advisory

🟠 [HIGH] pgvector/pgvector

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:pgvector:pgvector:*:*:*:*:*:*:*:* (< 0.8.7)

pgvector, a popular open-source vector similarity search extension for PostgreSQL, versions prior to 0.8.7 are affected by a high-severity out-of-bounds write vulnerability (CVE-2026-103484, CVSS 8.8). A database user can trigger the flaw during IVFFlat index builds, potentially achieving arbitrary code execution on the underlying database server.

Organizations using pgvector for AI, machine learning, or semantic search workloads in PostgreSQL should upgrade to version 0.8.7 or later immediately. This is particularly urgent in multi-tenant or shared database environments where lower-privileged users can create indexes. Review the vendor fix at https://github.com/pgvector/pgvector/commit/ee00d39ab30c2a7cf9510abf9288c624d91db156 for details.

Vendor Advisory

🟠 [HIGH] tornadoweb/tornado

1 CVE | CVSS 4.0: 8.2 | AAS 9.5

  • cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*

Tornado, a widely used Python web framework and asynchronous networking library, versions prior to 6.5.9 are affected by a high-severity path traversal vulnerability (CVE-2026-103263, CVSS 8.2) in the StaticFileHandler component. When symbolic links exist within the static root directory that point to locations outside it, unauthenticated attackers can request those paths to read sensitive files such as configuration files, private keys, and application secrets accessible to the process user.

Teams running Tornado-based web applications that use StaticFileHandler should upgrade to version 6.5.9 or later immediately and audit their static directories for any symlinks pointing outside the intended root. This vulnerability is considered exploitable and poses particular risk in containerized or shared-hosting environments where static directories may contain deployment-created symlinks. Review the vendor fix at https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32 for details.

Vendor Advisory

🟠 [HIGH] latepoint/appointment_booking_plugin_–latepoint|calendar&_scheduling_for_wordpress

1 CVE | CVSS 3.1: 9.1 | AAS 9.4

  • cpe:2.3:a:latepoint:appointment_booking_plugin_latepoint_calendar_scheduling_for_wordpress:*:*:*:*:*:*:*:*

The LatePoint Appointment Booking and Scheduling plugin for WordPress versions up to and including 5.7.0 is affected by a critical arbitrary shortcode execution vulnerability (CVE-2026-92966, CVSS 9.1). An unauthenticated attacker can plant a malicious payload during the public booking flow that executes arbitrary shortcodes when later processed by the application, potentially leading to data exfiltration, privilege escalation, or further site compromise depending on other installed plugins.

Any WordPress site using LatePoint for appointment scheduling should update beyond version 5.7.0 immediately. The unauthenticated attack surface and the stored nature of the payload make this especially dangerous, as exploitation can occur without direct interaction from an administrator. Review the vulnerable code at https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.0/lib/helpers/blocks_helper.php#L234 for technical details and confirm the latest patched version with the vendor.

Vendor Advisory

🟠 [HIGH] jetbrains/youtrack

1 CVE | CVSS 3.1: 8.1 | AAS 9.1

  • cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* (< 2026.2.19422)

JetBrains YouTrack versions prior to 2026.2.19422 are affected by a high-severity stored cross-site scripting vulnerability (CVE-2026-103493, CVSS 8.1) through Mermaid diagram and LaTeX content. An attacker with the ability to create or edit issues can inject persistent malicious scripts that execute in the browsers of other users who view the affected content, potentially leading to session hijacking, data theft, or administrative account compromise.

Organizations using YouTrack for project tracking should upgrade to version 2026.2.19422 or later immediately. Stored XSS in a collaborative tool like YouTrack is particularly impactful as it can target developers, project managers, and administrators across the organization. Consult the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for full details and remediation guidance.

Vendor Advisory