6 vulnerabilities across 5 products scored HIGH or above on October 14, 2026.

  • 🟠 HIGH: 6

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-87744 (red_hat/exploit_intelligence) — F1: exploitable → functional, AAS: 9.4 → 11.4 (HIGH → HIGH). Originally in 2026-10-12 bulletin.
  • [UPGRADED] CVE-2026-108263 (iflytek/astron-agent) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-10-09 bulletin.
  • [UPGRADED] CVE-2026-104334 (langflow/langflow) — F1: exploitable → functional, AAS: 13.4 → 15.4 (CRITICAL → CRITICAL). Originally in 2026-10-07 bulletin.

🟠 [HIGH] ntbyk/jtl-connector_for_woocommerce

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:ntbyk:jtl-connector_for_woocommerce:*:*:*:*:*:*:*:*

ntbyk JTL-Connector for WooCommerce — Critical Arbitrary File Upload

The JTL-Connector for WooCommerce plugin for WordPress versions up to and including 2.4.3 is affected by one critical-severity vulnerability (CVSS 9.8). CVE-2026-87855 allows unauthenticated attackers to upload arbitrary files, potentially achieving remote code execution, because the authentication function accepts an empty credential parameter as valid and the image upload handler fails to properly validate file types. This vulnerability is considered exploitable in the wild.

Any WordPress site running the JTL-Connector for WooCommerce plugin should treat this as an urgent priority. Administrators should update to a patched version immediately or deactivate the plugin until a fix is available. Review web server logs for unexpected file uploads or suspicious requests to the image push endpoint, and check for any unauthorized files that may have already been placed on the server.

Vendor Advisory

🟠 [HIGH] tyche_softwares/abandoned_cart_pro_for_woocommerce

2 CVEs | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:tyche_softwares:abandoned_cart_pro_for_woocommerce:*:*:*:*:*:*:*:*

Tyche Softwares Abandoned Cart Pro for WooCommerce — Critical Authentication Bypass

The Abandoned Cart Pro for WooCommerce plugin for WordPress versions up to and including 10.8.0 is affected by two critical-severity vulnerabilities (CVSS 9.8), including multiple authentication bypass flaws. CVE-2026-97657 and CVE-2026-97668 stem from weaknesses in the cart-recovery link token system, where MAC-free AES-CTR encryption with attacker-influenced key lookup and a bypassable HMAC nonce check allow unauthenticated attackers to forge valid session tokens and gain unauthorized access to user accounts.

Any WordPress site running Abandoned Cart Pro for WooCommerce should treat this as an urgent priority. Administrators should update to a version newer than 10.8.0 immediately and review access logs for suspicious cart-recovery link activity or unauthorized account access. Consider temporarily disabling the plugin if a patched version is not yet available.

Vendor Advisory

🟠 [HIGH] nixos/nix

1 CVE | CVSS 3.1: 8.0 | AAS 9.3

  • cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* (< 2.35.3)

NixOS Nix and Lix — Privilege Escalation via Store Path Repair

Nix versions prior to 2.35.3 and Lix versions prior to 2.95.4 are affected by one high-severity vulnerability (CVSS 8.0). CVE-2026-110450 allows local privilege escalation through a race condition in the repair operation, where an attacker can destroy and replace a store path before content verification completes, potentially substituting malicious content into trusted store paths.

Organizations running Nix or Lix package managers in multi-user configurations should prioritize this update, as the vulnerability is considered exploitable. Upgrade Nix to version 2.35.3 or later and Lix to version 2.95.4 or later immediately. Refer to the NixOS security advisory for additional guidance and monitor systems for any unexpected store path modifications.

Vendor Advisory

🟠 [HIGH] onlyoffice/document_server

1 CVE | CVSS 4.0: 8.7 | AAS 9.3

  • cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*

ONLYOFFICE Document Server — Remote Code Execution via Document Builder API

ONLYOFFICE Document Server versions prior to 10.0.0 are affected by one high-severity vulnerability (CVSS 8.7). CVE-2026-110385 allows an authenticated attacker with a valid JWT to execute arbitrary operating system commands as the ds service account by injecting malicious XML into the Document Builder API’s SaveFile function, overriding the server-generated output path to write arbitrary content to the filesystem.

Any organization running ONLYOFFICE Document Server should treat this as a high priority, particularly in environments where document collaboration is exposed to external or semi-trusted users. Upgrade to version 10.0.0 or later immediately and review access logs for unusual Document Builder API activity or unexpected file writes on the server.

Vendor Advisory

🟠 [HIGH] inductive_automation/ignition

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:inductive_automation:ignition:*:*:*:*:*:*:*:*

Inductive Automation Ignition — Privilege Escalation to Remote Code Execution

The Ignition Perspective module is affected by one high-severity vulnerability (CVSS 8.7). CVE-2026-92817 allows an authenticated user with basic Vision project access to escalate to Designer-level privileges by reusing a valid Vision session identifier, bypassing session privilege validation. With these elevated privileges, an attacker can execute arbitrary code in the context of the Ignition Gateway process.

Organizations running Inductive Automation Ignition in industrial control or operational technology environments should treat this as an urgent priority given the potential for full gateway compromise. Apply the vendor-recommended update immediately and review user access controls to ensure least-privilege principles are enforced across Vision and Perspective sessions. Monitor gateway logs for unusual session activity or unauthorized Designer-level access.

Vendor Advisory