15 vulnerabilities across 3 products scored HIGH or above on October 19, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 14

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-103849 (adobe/adobe_commerce) — F1: theoretical → functional, AAS: 13.1 → 16.1 (CRITICAL → EMERGENCY). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-105899 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.3 → 15.8 (CRITICAL → CRITICAL). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-70242 (microsoft/microsoft_365_apps_for_enterprise) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-10-13 bulletin.
  • [UPGRADED] CVE-2026-87744 (red_hat/quarkus) — F1: exploitable → functional, AAS: 9.4 → 10.4 (HIGH → HIGH). Originally in 2026-10-12 bulletin.

🔴 [CRITICAL] apache_software_foundation/apache_camel

13 CVEs | CVSS 4.0: 10.0 | AAS 12.8

  • cpe:2.3:a:apache:apache_camel:*:*:*:*:*:*:*:* (>= 4.0.0, < 4.18.5)
  • cpe:2.3:a:apache:apache_camel:*:*:*:*:*:*:*:* (>= 4.19.0, < 4.22.1)
  • cpe:2.3:a:apache:apache_camel:*:*:*:*:*:*:*:* (>= 4.4.0, < 4.18.5)
  • cpe:2.3:a:apache:apache_camel:*:*:*:*:*:*:*:* (>= 2.11.0, < 4.18.5)
  • cpe:2.3:a:apache:apache_camel:*:*:*:*:*:*:*:* (>= 4.11.0, < 4.18.5)

Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0 are affected by 13 vulnerabilities, including multiple critical-severity flaws with a maximum CVSS score of 10.0. The lead issue involves deserialization of untrusted data in the camel-hazelcast component, where incomplete fixes left configuration paths exposed to unsafe Java deserialization, and proof-of-concept exploit code is available. Organizations running Apache Camel in these version ranges should upgrade immediately to 4.18.5 or 4.22.1 and review the vendor advisory at camel.apache.org for full details on all 13 CVEs.

Vendor Advisory

🟠 [HIGH] pt_norther_lights_production/mapsvg

1 CVE | CVSS 3.1: 9.9 | AAS 9.2

  • cpe:2.3:a:pt_norther_lights_production:mapsvg:*:*:*:*:*:*:*:* (< 8.16.2)

The MapSVG WordPress plugin by PT Norther Lights Production, versions through 8.16.1, contains a critical unrestricted file upload vulnerability that allows attackers to upload web shells directly to the server, carrying a CVSS score of 9.9. This flaw is considered actively exploitable and poses an immediate risk of full site compromise for any WordPress installation running the affected plugin. Site administrators should remove or disable MapSVG immediately, check for indicators of compromise such as unexpected uploaded files, and apply a patched version as soon as one is available from the vendor.

Vendor Advisory

🟠 [HIGH] hivepress/hivepress

1 CVE | CVSS 3.1: 9.9 | AAS 9.2

  • cpe:2.3:a:hivepress:hivepress:*:*:*:*:*:*:*:* (< 1.7.33)

The HivePress WordPress plugin, versions through 1.7.32, contains a code injection vulnerability that enables remote code inclusion, rated at a CVSS score of 9.9. This flaw is considered actively exploitable and could allow an attacker to execute arbitrary code on the server, potentially leading to full site takeover. WordPress administrators using HivePress should update beyond version 1.7.32 immediately, audit their sites for signs of compromise, and consult the Patchstack advisory for further remediation guidance.

Vendor Advisory