3 vulnerabilities across 3 products scored HIGH or above on October 12, 2026.

  • 🟠 HIGH: 3

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-108263 (iflytek/astron-agent) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-10-09 bulletin.
  • [UPGRADED] CVE-2026-104334 (langflow/langflow) — F1: exploitable → functional, AAS: 13.4 → 15.4 (CRITICAL → CRITICAL). Originally in 2026-10-07 bulletin.
  • [UPGRADED] CVE-2026-106382 (google/chrome) — F1: exploitable → functional, AAS: 11.4 → 13.4 (HIGH → CRITICAL). Originally in 2026-10-06 bulletin.
  • [UPGRADED] CVE-2026-105697 (langflow-ai/langflow) — F1: exploitable → functional, AAS: 10.2 → 12.7 (HIGH → CRITICAL). Originally in 2026-10-05 bulletin.

🟠 [HIGH] samsung_mobile/samsung_mobile_devices

1 CVE | CVSS 4.0: 8.9 | AAS 9.7

  • cpe:2.3:a:samsung:android:*:*:*:*:*:*:*:* (< smr_oct-2026_release_1)

Samsung Mobile Devices — 1 Critical-Severity Vulnerability

Samsung mobile devices running software prior to the SMR October 2026 Release 1 are affected by a high-severity use-after-free vulnerability (CVE-2026-21120, CVSS 8.9) in the WSM service. A local attacker can exploit this flaw to execute arbitrary code with system-level privileges, making it a serious escalation risk on any compromised or shared device. Organizations managing Samsung device fleets should apply the October 2026 security update immediately by referring to the vendor advisory at https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=10 and ensuring MDM policies enforce timely patching.

Vendor Advisory

🟠 [HIGH] blinko/blinko

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:* (< 1.8.9)

Blinko — 1 High-Severity Vulnerability

Blinko versions through 1.8.8 are affected by a high-severity directory traversal vulnerability (CVE-2026-108980, CVSS 8.8) in the plugin installation mechanism. Any authenticated user can supply crafted path traversal sequences in a plugin name via the installPlugin tRPC procedure to write arbitrary files outside the intended plugins directory, and because the official Docker image runs as root, this allows overwriting startup files to achieve full system compromise. Administrators running Blinko should upgrade beyond version 1.8.8 immediately, restrict access to the plugin installation endpoint, and audit deployed containers for signs of unauthorized file modifications.

Vendor Advisory

🟠 [HIGH] rapid7/metasploit_framework

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:rapid7:metasploit_framework:*:*:*:*:*:*:*:*

Rapid7 Metasploit Framework — 1 High-Severity Vulnerability

The Metasploit Framework’s iOS image gathering post-exploitation module (post/apple_ios/gather/ios_image_gather) is affected by a high-severity path traversal vulnerability (CVE-2026-87690, CVSS 8.8) that allows a hostile or compromised iOS target device to write arbitrary files on the operator’s system. File names returned by the remote Meterpreter directory listing are interpolated into the local download path without sanitization, meaning a tampered device can escape the intended output directory and overwrite files on the pentester’s workstation. Security teams and penetration testers using Metasploit should update to the latest framework version from the official repository at https://github.com/rapid7/metasploit-framework and exercise caution when running gather modules against untrusted targets.

Vendor Advisory