64 vulnerabilities across 5 products scored HIGH or above on October 02, 2026.

  • 🟠 HIGH: 64

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-76504 (cisco/catalyst_sd-wan_manager) — F1: exploitable → functional, AAS: 10.9 → 13.4 (HIGH → CRITICAL). Originally in 2026-09-30 bulletin.
  • [UPGRADED] CVE-2026-100752 (ordasoft.com/real_estate_manager_(free)_extension_for_joomla) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-09-28 bulletin.
  • [UPGRADED] CVE-2026-82901 (themefic/ultra_addons_for_contact_form_7) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-26 bulletin.

🟠 [HIGH] apache_software_foundation/apache_thrift

49 CVEs | CVSS 4.0: 9.2 | AAS 11.8

  • cpe:2.3:a:apache:apache_thrift:*:*:*:*:*:*:*:*

Apache Thrift — 49 Vulnerabilities Including Critical Heap Buffer Overflow

Apache Thrift’s C++ library is affected by 49 vulnerabilities, including multiple high-severity issues. The lead vulnerability is a heap-based buffer overflow in THeaderTransport that occurs when the ZLIB transform is enabled. When processing frames containing data that does not compress well, such as attacker-supplied content, the compressed output exceeds the allocated write buffer, resulting in an out-of-bounds heap write. The overflow size scales with frame length, making reliable exploitation feasible for remote attackers who can influence frame contents.

Any organization running services built on the Apache Thrift C++ library, particularly those using THeaderTransport with ZLIB framing enabled, should treat this as urgent. With a CVSS 4.0 score of 9.2 and confirmed exploitability, this vulnerability poses a serious risk of remote code execution or denial of service. Security teams should review the vendor advisory at lists.apache.org, inventory all deployments of Apache Thrift across their environment, and apply available patches or mitigations immediately. As an interim measure, consider disabling ZLIB transform on THeaderTransport where operationally feasible.

Vendor Advisory

🟠 [HIGH] tryghost/ghost

4 CVEs | CVSS 4.0: 8.6 | AAS 11.6

  • cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:*

Ghost CMS — 4 Vulnerabilities Including Stored Cross-Site Scripting via oEmbed

Ghost CMS versions 2.5.0 through 6.64.0 are affected by 4 vulnerabilities, including multiple stored cross-site scripting flaws. The most severe issue allows attackers to inject malicious scripts through crafted oEmbed photo responses. When a Ghost author embeds a malicious URL, the attacker-controlled script executes across the Ghost editor, the published site, and newsletter emails, potentially compromising staff admin sessions and enabling full account takeover.

Organizations self-hosting Ghost or managing Ghost-based publications should act immediately given the CVSS 4.0 score of 8.6 and confirmed exploitability. Security teams should upgrade Ghost to version 6.64.0 or later, review the vendor advisory on GitHub for additional details, and audit recent post content for any suspicious oEmbed embeds. Until patched, consider restricting which staff members can embed external content and review active admin sessions for signs of compromise.

Vendor Advisory

🟠 [HIGH] lxsmnsyc/seroval

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:* (>= 0.12.0, < 1.6.2)

Seroval — Remote Code Execution via Deserialization of Crafted JSON

Seroval versions 0.12.0 through 1.6.2 contain a deserialization vulnerability that allows remote code execution through crafted JSON input. When the fromJSON function deserializes a specially constructed Promise control node, attacker-supplied callables are passed to the native Promise resolver, which invokes them through ECMAScript’s thenable assimilation mechanism. This bypasses intended type restrictions and enables attackers to execute arbitrary code in any application using plugin-capable Seroval releases, carrying a CVSS 3.1 score of 9.8.

Teams building JavaScript or TypeScript applications that use the Seroval library for serialization and deserialization should treat this as critical. Update Seroval to version 1.6.2 or later immediately, review the fix commit linked in the vendor advisory on GitHub, and audit any application endpoints that accept untrusted JSON input processed through Seroval’s fromJSON function.

Vendor Advisory

🟠 [HIGH] yeswiki/yeswiki

8 CVEs | CVSS 4.0: 9.2 | AAS 10.2

  • cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:* (< 4.6.7)

YesWiki — 8 Vulnerabilities Including Admin API Authorization Bypass

YesWiki versions before 4.6.7 are affected by 8 vulnerabilities, including multiple critical authorization bypass flaws. The most severe issue resides in ApiService::isAuthorized(), which fails to enforce access controls on admin-only API routes when public API mode is enabled. Unauthenticated attackers can directly call privileged endpoints such as api/ci/update_config and api/archives to overwrite wiki configuration, and list, download, or delete backup archives, effectively granting full administrative control over the platform without credentials.

Any organization running a YesWiki instance with public API mode enabled should treat this as urgent given the CVSS 4.0 score of 9.2 and confirmed exploitability. Security teams should upgrade to YesWiki 4.6.7 or later immediately, review the full set of advisories on GitHub for additional issues addressed in this release, and audit API access logs for any unauthorized calls to admin endpoints. As an interim mitigation, consider disabling public API mode until the update is applied.

Vendor Advisory

🟠 [HIGH] renstillmann/super_forms_–drag&_drop_form_builder

2 CVEs | CVSS 3.1: 9.1 | AAS 9.9

  • cpe:2.3:a:renstillmann:super_forms_drag_drop_form_builder:*:*:*:*:*:*:*:*

Super Forms WordPress Plugin — 2 Vulnerabilities Including Unauthenticated Directory Traversal

The Super Forms – Drag & Drop Form Builder plugin for WordPress versions up to and including 6.3.316 is affected by 2 vulnerabilities, including at least one critical directory traversal flaw. The parse_request function allows unauthenticated attackers to read arbitrary files from the server, potentially exposing sensitive configuration files such as wp-config.php, database credentials, and other secrets. The vulnerability is exploitable by default because the optional file_upload_auth setting is empty, meaning no authentication is required unless explicitly configured.

Any WordPress site running the Super Forms plugin should respond immediately given the CVSS 3.1 score of 9.1 and confirmed exploitability. Security teams should update to a patched version by reviewing the fix referenced in the vendor’s GitHub pull request, and audit server logs for suspicious file read requests targeting the parse_request endpoint. As an immediate workaround, enable the file_upload_auth setting to require authentication, and review whether any sensitive files on the server may have already been accessed.

Vendor Advisory