9 vulnerabilities across 6 products scored HIGH or above on October 25, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 8

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-112403 (python-pillow/pillow) — F1: exploitable → functional, AAS: 9.3 → 11.3 (HIGH → HIGH). Originally in 2026-10-19 bulletin.

🔴 [CRITICAL] parse-community/parse-server

2 CVEs | CVSS 4.0: 9.1 | AAS 12.0

  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (< 8.6.102)
  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (>= 9.0.0, < 9.10.5-alpha.2)

Parse Server by parse-community is affected by 2 vulnerabilities, including at least one rated CRITICAL with a CVSS 4.0 score of 9.1. The most severe issue is an authentication bypass in versions before 8.6.102 and 9.0.0 before 9.10.5-alpha.2, where custom authentication adapter validation methods are never invoked, allowing attackers to supply arbitrary authentication data to sign up, link identities, log in as existing users, or bypass multi-factor authentication entirely. Organizations running Parse Server should treat this as an urgent priority and upgrade to patched versions immediately, reviewing the vendor advisory at the linked GitHub Security Advisory for full remediation guidance.

Vendor Advisory

🟠 [HIGH] grokability/snipe-it

1 CVE | CVSS 4.0: 9.2 | AAS 10.2

  • cpe:2.3:a:grokability:snipe-it:*:*:*:*:*:*:*:* (< 8.6.3)

Snipe-IT by grokability is affected by 1 vulnerability rated HIGH with a CVSS 4.0 score of 9.2. The issue is an authentication bypass in versions before 8.6.3 where the Google SSO callback fails to enforce the account deactivation flag, allowing deactivated users with still-active Google identities to sign back in and regain sessions at their original permission level, including administrative access. Organizations using Snipe-IT with Google SSO authentication should upgrade to version 8.6.3 or later immediately and audit recent login activity for any deactivated accounts that may have regained access.

Vendor Advisory

🟠 [HIGH] yeswiki/yeswiki

2 CVEs | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:* (>= 4.5.0, < 4.7.0)
  • cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:* (>= 4.6.0, < 4.7.0)
  • cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:* (>= 5.0.0-alpha1, < 5.0.0-alpha4)

YesWiki is affected by 2 vulnerabilities, including at least one rated HIGH with a CVSS 4.0 score of 8.8. The most severe issue is an unauthenticated SQL injection in versions 4.5.0 through 4.6.x, where the date_maj_fiche field in Bazar entry-creation requests is concatenated unescaped into an INSERT statement, allowing attackers to exfiltrate sensitive data such as password hashes from the user database on default installations. Organizations running YesWiki should upgrade to version 4.7.0 or later immediately and consider rotating all user credentials, as exploitation requires no authentication and password hashes may already have been compromised.

Vendor Advisory

🟠 [HIGH] vllm-project/vllm

2 CVEs | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* (>= 0.9.2, < 0.24.0)
  • cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* (>= 0.10.2, < 0.25.0)

vLLM by vllm-project is affected by 2 vulnerabilities, including at least one rated HIGH with a CVSS 4.0 score of 8.8. The most severe issue is a server-side request forgery in versions 0.9.2 through 0.23.x, where an attacker can embed a decode address in the X-Request-Id header to force a prefill worker to establish outbound ZMQ connections to an attacker-controlled host, potentially leaking NCCL identifiers and KV-cache tensors or causing worker denial of service. Organizations deploying vLLM for inference serving should upgrade to version 0.24.0 or later and review network controls to ensure inference workers cannot establish arbitrary outbound connections.

Vendor Advisory

🟠 [HIGH] thorsten/phpmyfaq

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* (< 4.1.10)

phpMyFAQ by thorsten is affected by 1 vulnerability rated HIGH with a CVSS 4.0 score of 8.7. The issue is an object-level authorization bypass in versions before 4.1.10, where unauthenticated attackers can modify or delete any visitor question by supplying an arbitrary question identifier to the FAQ creation API endpoint, enabling category manipulation, forging of answered entries in question history, or permanent deletion of questions when the delete setting is enabled. Organizations running phpMyFAQ should upgrade to version 4.1.10 or later and review question history logs for signs of unauthorized modifications or deletions.

Vendor Advisory

🟠 [HIGH] rclone/rclone

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:* (< 1.75.2)

Rclone is affected by 1 vulnerability rated HIGH with a CVSS 4.0 score of 8.7. The issue is a path traversal in the serve webdav functionality in versions before 1.75.2, where unvalidated parent directory path components allow unauthenticated attackers to escape the served root and create, overwrite, or delete arbitrary files, potentially impacting other tenants in multi-user environments. Organizations exposing Rclone’s WebDAV server should upgrade to version 1.75.2 or later immediately and audit file systems for any unauthorized modifications outside the intended serving root.

Vendor Advisory