137 vulnerabilities across 15 products scored HIGH or above on October 13, 2026.

  • 🔴 CRITICAL: 19
  • 🟠 HIGH: 118

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-108263 (iflytek/astron-agent) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-10-09 bulletin.
  • [UPGRADED] CVE-2026-104334 (langflow/langflow) — F1: exploitable → functional, AAS: 13.4 → 15.4 (CRITICAL → CRITICAL). Originally in 2026-10-07 bulletin.
  • [UPGRADED] CVE-2026-106382 (google/chrome) — F1: exploitable → functional, AAS: 11.4 → 13.4 (HIGH → CRITICAL). Originally in 2026-10-06 bulletin.

🔴 [CRITICAL] ivanti/connect_secure

1 CVE | CVSS 3.1: 8.6 | AAS 14.0

  • cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* (>= 25.1.0.0, < 25.1.1.2)
  • cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* (>= 25.1.2.0, < 25.1.3.0)

Ivanti Connect Secure is affected by a critical authentication bypass vulnerability (CVE-2026-104935, CVSS 8.6) that allows a remote unauthenticated attacker to spoof authentication and execute arbitrary commands on the appliance. This flaw affects ICS versions prior to 25.1.3.0, excluding version 22.7R2.14 and earlier, and is confirmed exploited in the wild. Organizations running affected versions should treat this as an emergency, apply the update to 25.1.3.0 immediately, and review systems for signs of compromise per the vendor advisory at hub.ivanti.com.

Vendor Advisory

🔴 [CRITICAL] adobe/adobe_commerce

8 CVEs | CVSS 3.1: 10.0 | AAS 13.9

  • cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*

Adobe Commerce is affected by eight vulnerabilities, including at least one critical incorrect authorization flaw (CVSS 10.0) that allows a remote attacker to execute arbitrary code without user interaction. These issues pose severe risk to any organization running Adobe Commerce or Magento Open Source storefronts, as exploitation could lead to full system compromise. Administrators should immediately apply the patches detailed in Adobe security bulletin APSB26-153 and review their environments for indicators of compromise.

Vendor Advisory

🔴 [CRITICAL] adobe/coldfusion_2025

22 CVEs | CVSS 3.1: 10.0 | AAS 13.8

  • cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:* (< 1)

Adobe ColdFusion 2025 is affected by 22 vulnerabilities, including multiple critical flaws rated up to CVSS 10.0, with the most severe being a server-side request forgery issue that enables privilege escalation without user interaction and with changed scope, meaning it can impact resources beyond the vulnerable component. Organizations running ColdFusion in any capacity, particularly internet-facing deployments, face significant risk of compromise. Apply the patches from Adobe security bulletin APSB26-144 immediately, restrict network access to ColdFusion administration interfaces, and audit systems for unauthorized activity.

Vendor Advisory

🔴 [CRITICAL] adobe/adobe_experience_manager_as_a_cloud_service

6 CVEs | CVSS 3.1: 10.0 | AAS 13.6

  • cpe:2.3:a:adobe:adobe_experience_manager_as_a_cloud_service:*:*:*:*:*:*:*:*

Adobe Experience Manager as a Cloud Service is affected by six vulnerabilities, including at least one critical incorrect authorization flaw rated CVSS 10.0 that allows arbitrary code execution without user interaction, with changed scope enabling an attacker to compromise resources beyond the vulnerable component, including account takeover and session hijacking. Any organization using AEM Cloud Service should treat this as a high-priority update, as successful exploitation could grant full control over content management infrastructure. Apply the fixes outlined in Adobe security bulletin APSB26-152 immediately and review access logs for signs of unauthorized activity.

Vendor Advisory

🔴 [CRITICAL] adobe/adobe_experience_manager_6.5_lts

1 CVE | CVSS 3.1: 9.9 | AAS 13.1

  • cpe:2.3:a:adobe:adobe_experience_manager_6.5_lts:*:*:*:*:*:*:*:*

Adobe Experience Manager 6.5 LTS is affected by a critical incorrect authorization vulnerability (CVE-2026-75732, CVSS 9.9) that allows arbitrary code execution without user interaction, with changed scope meaning an attacker can pivot beyond the vulnerable component to compromise user accounts, sessions, and potentially the broader infrastructure. Organizations running AEM 6.5 LTS should prioritize this patch immediately, as the near-maximum severity rating and lack of required user interaction make exploitation straightforward. Apply the update per Adobe security bulletin APSB26-152 and audit systems for unauthorized access or anomalous behavior.

Vendor Advisory

🔴 [CRITICAL] microsoft/visual_studio_code

3 CVEs | CVSS 3.1: 9.6 | AAS 12.5

  • cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*

Microsoft Visual Studio Code is affected by three vulnerabilities, including at least one critical path traversal flaw (CVSS 9.6) that allows an unauthorized attacker to achieve remote code execution over a network. Development teams and any organization with VS Code deployed across endpoints should take immediate action, as the editor’s widespread use makes this a high-value target for attackers seeking initial access to developer workstations. Update Visual Studio Code to the latest version through the built-in update mechanism or organizational software distribution channels, and review Microsoft’s advisory for additional mitigation guidance.

Vendor Advisory

🔴 [CRITICAL] gitlab/gitlab

3 CVEs | CVSS 3.1: 10.0 | AAS 12.4

  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

GitLab CE/EE is affected by three vulnerabilities, including at least one critical flaw rated CVSS 10.0 that allows an unauthenticated attacker to execute arbitrary code on the GitLab server by submitting a specially crafted regular expression in a CI/CD configuration. Affected versions span all releases from 19.2 through 19.4, and any organization running a self-managed GitLab instance should treat this as an emergency given the unauthenticated attack vector and direct path to server compromise. Upgrade immediately to versions 19.2.8, 19.3.5, or 19.4.2 as detailed in the GitLab patch release advisory, and review CI/CD pipeline logs for suspicious activity.

Vendor Advisory

🟠 [HIGH] fortinet/fortisiem

1 CVE | CVSS 3.1: 9.8 | AAS 11.9

  • cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* (>= 7.5.0)

Fortinet FortiSIEM 7.5.0 is affected by a critical path traversal vulnerability (CVE-2026-106173, CVSS 9.8) that allows an attacker to execute unauthorized code or commands by sending specially crafted packets. Security operations teams running FortiSIEM should prioritize this fix immediately, as SIEM platforms are high-value targets that typically have broad network visibility and access to sensitive log data. Apply the patch referenced in Fortinet advisory FG-IR-26-180 and monitor FortiSIEM instances for any indicators of exploitation.

Vendor Advisory

🟠 [HIGH] microsoft/windows

36 CVEs | CVSS 3.1: 9.8 | AAS 11.6

  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.14393.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.17763.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.20348.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.26100.0)
  • cpe:2.3:a:microsoft:windows:*:*:*:*:*:*:*:* (>= 10.0.10240.0, < 10.0.10240.20978)

Microsoft Windows is affected by 36 vulnerabilities, including multiple critical flaws rated up to CVSS 9.8, with the most severe being a double free in the Failover Cluster Virtual Driver that allows an unauthorized attacker to achieve remote code execution over a network. The breadth of this patch batch impacts virtually every Windows environment, including workstations, servers, and clustered deployments. Organizations should apply the October Patch Tuesday updates immediately through Windows Update or WSUS and prioritize internet-facing and clustered systems first.

Vendor Advisory

🟠 [HIGH] microsoft/microsoft_365_apps_for_enterprise

51 CVEs | CVSS 3.1: 9.8 | AAS 11.6

  • cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise:*:*:*:*:*:*:*:*

Microsoft 365 Apps for Enterprise is affected by 51 vulnerabilities, including multiple critical flaws rated up to CVSS 9.8, with the most severe being a heap-based buffer overflow in Outlook that allows an unauthorized attacker to execute code remotely over a network. Given the massive deployment footprint of Microsoft 365 across enterprise environments and the inclusion of Outlook, Word, Excel, and other Office components, this update is relevant to nearly every organization. Deploy the latest Microsoft 365 updates immediately through your update management channels and prioritize systems where users handle external email or untrusted documents.

Vendor Advisory

🟠 [HIGH] argoproj/argo-cd

1 CVE | CVSS 3.1: 9.9 | AAS 11.1

  • cpe:2.3:a:argoproj:argo-cd:*:*:*:*:*:*:*:* (>= 2.10.0, < 3.3.15)
  • cpe:2.3:a:argoproj:argo-cd:*:*:*:*:*:*:*:* (>= 3.4.0, < 3.4.10)
  • cpe:2.3:a:argoproj:argo-cd:*:*:*:*:*:*:*:* (>= 3.5.0, < 3.5.4)
  • cpe:2.3:a:argoproj:argo-cd:*:*:*:*:*:*:*:* (>= 3.6.0-rc1, < 3.6.0-rc2)

Argo CD versions 2.10.0 through 3.6.0-rc1 are affected by a critical authorization bypass vulnerability (CVE-2026-77459, CVSS 9.9) where PostDelete resource hooks are created without enforcing AppProject destination and resource authorization checks, allowing an attacker with write access to an application’s Git repository to target forbidden namespaces, clusters, or resource types and break out of project-level security boundaries. Any organization using Argo CD for Kubernetes GitOps deployments should treat this as urgent, since it undermines the multi-tenant isolation that AppProjects are designed to enforce. Upgrade immediately to Argo CD 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2, and audit recent sync operations for any unauthorized PostDelete hooks targeting restricted resources.

Vendor Advisory

🟠 [HIGH] vitessio/vitess

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:vitessio:vitess:*:*:*:*:*:*:*:* (< 23.0.5)
  • cpe:2.3:a:vitessio:vitess:*:*:*:*:*:*:*:* (>= 24.0.0, < 24.0.2)

Vitess, a MySQL horizontal scaling and clustering system, is affected by a reflected cross-site scripting vulnerability (CVE-2026-104252, CVSS 9.8) in the vttablet and vtcombo /twopcz HTTP debug endpoint, where form values are written into HTML responses without escaping, allowing a remote unauthenticated attacker to execute arbitrary script in an operator’s browser under the default allow-all ACL policy. Organizations running Vitess in production Kubernetes or database infrastructure should be aware that successful exploitation could compromise operator sessions and potentially lead to unauthorized database management actions. Upgrade to Vitess 23.0.5 or 24.0.2 immediately, and restrict access to debug endpoints by configuring a non-default ACL policy.

Vendor Advisory

🟠 [HIGH] rapid7/metasploit_framework

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:rapid7:metasploit_framework:*:*:*:*:*:*:*:* (>= 5.0.0)

The Metasploit Framework Web Service REST API is affected by a critical authentication bypass vulnerability (CVE-2026-87689, CVSS 9.8) where the update and delete handlers for the /api/v1/credentials endpoint omit authentication entirely, allowing a remote unauthenticated attacker to modify or delete stored credentials in the Metasploit credential store. Red teams, penetration testers, and security operations teams running the Metasploit Web Service should act immediately, as the credential store often contains harvested passwords and hashes from active engagements. Update Metasploit Framework to the latest version, restrict network access to the msf-ws API endpoint, and audit credential store integrity for any unauthorized modifications or deletions.

Vendor Advisory

🟠 [HIGH] opencats/opencats

1 CVE | CVSS 3.1: 9.1 | AAS 10.5

  • cpe:2.3:a:opencats:opencats:*:*:*:*:*:*:*:*

OpenCATS, an open-source applicant tracking and recruitment system, is affected by an unrestricted file upload vulnerability (CVE-2026-54454, CVSS 9.1) where an authenticated user with Import privileges can upload a PHP file through the Import module that retains its original filename and is placed in a web-accessible directory, enabling remote code execution on the server. Organizations using OpenCATS for recruitment should patch immediately, as any user with import access can fully compromise the underlying web server. Upgrade to OpenCATS 0.10.0 or apply the referenced commit, and audit the temporary upload directory for any suspicious PHP files that may have already been planted.

Vendor Advisory

🟠 [HIGH] parse-community/parse-server

1 CVE | CVSS 4.0: 8.3 | AAS 10.4

  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:*

Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 are affected by a critical concurrency flaw (CVE-2026-109954) where transactional batch state is shared across concurrent requests, allowing any client’s batch operation to interfere with other clients’ database writes, roll back acknowledged writes on PostgreSQL or MongoDB replica sets, and leave PostgreSQL transactions open indefinitely causing cascading write failures. Any organization running Parse Server as a backend-as-a-service with multiple concurrent users faces risk of data loss and denial of service. Upgrade to Parse Server 8.6.96 or 9.10.2-alpha.5 immediately and monitor database connections for orphaned open transactions that may need manual cleanup.

Vendor Advisory