6 vulnerabilities across 4 products scored HIGH or above on October 26, 2026.

  • 🟠 HIGH: 6

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-112403 (python-pillow/pillow) — F1: exploitable → functional, AAS: 9.3 → 11.3 (HIGH → HIGH). Originally in 2026-10-19 bulletin.

🟠 [HIGH] fortinet/fortisandbox

1 CVE | CVSS 3.1: 9.8 | AAS 11.4

  • cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* (>= 4.2.0, < 4.4.0)
  • cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* (>= 5.0.0, < 5.0.7)
  • cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* (>= 4.4.0, < 5.0.0)

Fortinet FortiSandbox contains a critical authentication bypass vulnerability (CVE-2026-107656, CVSS 9.8) that allows remote attackers to execute unauthorized code or commands via crafted HTTP requests without authentication. Affected versions include FortiSandbox 4.2 all versions, 4.4.0 through 4.4.9, and 5.0.0 through 5.0.6, as well as all corresponding FortiSandbox PaaS releases. Organizations running FortiSandbox in any deployment model should treat this as an emergency patch priority, as the vulnerability is remotely exploitable and requires no credentials. Upgrade immediately to patched versions per the vendor advisory at fortiguard.fortinet.com/psirt/FG-IR-26-185.

Vendor Advisory

🟠 [HIGH] mautic/mautic

3 CVEs | CVSS 3.1: 9.9 | AAS 10.2

  • cpe:2.3:a:mautic:mautic:*:*:*:*:*:*:*:* (>= 7.0.0)

Mautic, the open-source marketing automation platform, is affected by 3 vulnerabilities including at least one critical unrestricted file upload flaw (CVSS 9.9) that allows authenticated users with campaign import permissions to upload arbitrary server-side scripts to the web root via crafted campaign archives, achieving remote code execution. Organizations self-hosting Mautic 7 should treat this as a high-priority patch, as the attack surface includes both the web UI and the REST API endpoint. Review the vendor advisory at github.com/mautic/mautic/security/advisories/GHSA-mxjf-pghx-h299 and upgrade to the patched release immediately.

Vendor Advisory

🟠 [HIGH] mtrudel/bandit

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*

Bandit, a popular HTTP server for Elixir and Phoenix applications, contains a high-severity HTTP/2 resource exhaustion vulnerability (CVE-2026-115269, CVSS 8.7) that allows unauthenticated remote attackers to hold stream processes open indefinitely by sending WINDOW_UPDATE or empty SETTINGS frames during request body reads, effectively resetting the read timeout with each frame. Teams running Bandit as their HTTP server in Elixir or Phoenix deployments should prioritize this fix, as exploitation requires no authentication and can lead to denial of service through process exhaustion. Consult the vendor advisory at cna.erlef.org/cves/CVE-2026-115269.html and upgrade to the patched version as soon as possible.

Vendor Advisory

🟠 [HIGH] aman/funnelkit_automations

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:aman:funnelkit_automations:*:*:*:*:*:*:*:*

FunnelKit Automations (formerly WP Marketing Automations), a widely used WordPress marketing automation plugin, contains a high-severity cross-site request forgery vulnerability (CVE-2026-111841, CVSS 8.8) affecting all versions through 3.8.5.2 that could allow attackers to perform unauthorized actions on behalf of authenticated administrators via crafted requests. WordPress site operators using this plugin for marketing workflows should update immediately, as CSRF flaws in plugins with administrative functionality can lead to full site compromise. Review the Patchstack advisory and upgrade to the latest patched release without delay.

Vendor Advisory