3 vulnerabilities across 3 products scored HIGH or above on October 15, 2026.

  • 🟠 HIGH: 3

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-93479 (f5/nginx_plus) — F1: exploitable → functional, AAS: 10.5 → 12.5 (HIGH → CRITICAL). Originally in 2026-10-14 bulletin.
  • [UPGRADED] CVE-2026-103849 (adobe/adobe_commerce) — F1: theoretical → functional, AAS: 13.1 → 16.1 (CRITICAL → EMERGENCY). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-87744 (red_hat/exploit_intelligence) — F1: exploitable → functional, AAS: 9.4 → 11.4 (HIGH → HIGH). Originally in 2026-10-12 bulletin.
  • [UPGRADED] CVE-2026-108263 (iflytek/astron-agent) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-10-09 bulletin.

🟠 [HIGH] 10web/10web_booster_–_website_speed_optimization,cache&_page_speed_optimizer

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:10web:10web_booster_website_speed_optimization_cache_page_speed_optimizer:*:*:*:*:*:*:*:* (< 2.34.11)

10Web Booster, a WordPress speed optimization and caching plugin, is affected by a critical unauthenticated arbitrary file upload vulnerability (CVE-2026-108587, CVSS 9.8). The flaw exists in the compressCustom function across all versions through 2.34.10, where missing file type validation on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication, allows remote unauthenticated attackers to upload potentially executable files to the server, enabling remote code execution.

WordPress administrators running any version of 10Web Booster up to and including 2.34.10 should treat this as an urgent priority. Update to the latest patched release immediately, audit web server logs for unexpected file uploads, and check for unfamiliar files in upload directories. If patching is not immediately possible, consider disabling the plugin until a fix can be applied.

Vendor Advisory

🟠 [HIGH] znuny/znuny

1 CVE | CVSS 4.0: 9.5 | AAS 9.6

  • cpe:2.3:a:znuny:znuny:*:*:*:*:*:*:*:*

Znuny, an open-source helpdesk and IT service management platform, is affected by a critical authentication bypass vulnerability (CVE-2026-93483, CVSS 9.5) in all versions through 7.3.6. The HTTPBasicAuth modules for agent and customer interfaces incorrectly trust a specific HTTP request header, allowing a remote attacker to impersonate any user, including administrators, without providing a password, granting full access to confidential data and system controls.

Organizations running Znuny for ticketing or ITSM should treat this as high priority. Update to a patched release as soon as one is available from the vendor, and in the meantime review whether HTTPBasicAuth modules are enabled in your configuration. If they are, consider disabling them or restricting access to the application at the network level until a fix is applied. Consult the vendor advisory at znuny.org for further guidance.

Vendor Advisory

🟠 [HIGH] jxxghp/moviepilot

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:jxxghp:moviepilot:*:*:*:*:*:*:*:*

MoviePilot, an open-source media automation and management tool, is affected by a command injection vulnerability (CVE-2026-77931, CVSS 8.7) in all versions through 3.1.5. Malicious content processed through features such as web browsing, web search, and torrent metadata parsing can be crafted to trick the application’s AI tooling into executing arbitrary operating system commands via the unrestricted ExecuteCommandTool, bypassing dangerous-command safeguards through asyncio subprocess shell calls.

Anyone self-hosting MoviePilot for media library management should act promptly. Update to a patched version as soon as one is available, and in the interim consider restricting the application’s network exposure and disabling or limiting the execute_command tool functionality if your deployment allows it. Review the vendor advisory at lasso.security for full details and indicators of exploitation.

Vendor Advisory