1 vulnerability across 1 product scored HIGH or above on October 18, 2026.

  • 🟠 HIGH: 1

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-103849 (adobe/adobe_commerce) — F1: theoretical → functional, AAS: 13.1 → 16.1 (CRITICAL → EMERGENCY). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-105899 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.3 → 15.8 (CRITICAL → CRITICAL). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-87744 (red_hat/quarkus) — F1: exploitable → functional, AAS: 9.4 → 10.4 (HIGH → HIGH). Originally in 2026-10-12 bulletin.

🟠 [HIGH] brainstorm_force/ottokit

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:brainstorm_force:ottokit:*:*:*:*:*:*:*:* (< 1.1.41)

Brainstorm Force OttoKit (SureTriggers) — 1 Critical Vulnerability

OttoKit, a popular WordPress automation plugin formerly known as SureTriggers, is affected by a critical privilege escalation vulnerability (CVE-2026-110372, CVSS 9.8) stemming from incorrect privilege assignment. All versions through 1.1.40 are affected, and the flaw is confirmed exploitable, making immediate action essential. WordPress administrators running OttoKit or SureTriggers should update the plugin beyond version 1.1.40 immediately and review site accounts for any unauthorized privilege changes. Refer to the Patchstack advisory for full details and remediation guidance.

Vendor Advisory