18 vulnerabilities across 15 products scored HIGH or above on October 28, 2026.

  • 🟠 HIGH: 18

🟠 [HIGH] fasterxml/jackson-databind

1 CVE | CVSS 3.1: 9.8 | AAS 11.9

  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*

FasterXML jackson-databind is affected by one critical vulnerability (CVE-2026-110879, CVSS 9.8) involving a bypass of generic-argument type validation during polymorphic deserialization. An attacker can supply crafted class names within generic type arguments that evade the outer-class validation checks, effectively circumventing the earlier fix for CVE-2026-54512. This is an incomplete fix bypass and is considered exploitable.

Any application using jackson-databind with polymorphic type handling (default typing or @JsonTypeInfo annotations) should treat this as high priority. Security teams should monitor the vendor advisory at the FasterXML jackson-databind GitHub security page and apply the patched release as soon as it is available.

Vendor Advisory

🟠 [HIGH] ultimate_member/ultimate_member

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:ultimate_member:ultimate_member:*:*:*:*:*:*:*:* (< 2.13.2)

The Ultimate Member plugin for WordPress through version 2.13.1 is affected by one critical vulnerability (CVE-2026-115968, CVSS 9.8) involving PHP object injection through deserialization of untrusted data. Successful exploitation could allow an attacker to inject arbitrary objects into the application, potentially leading to remote code execution, data exfiltration, or full site compromise depending on available gadget chains.

WordPress site administrators running Ultimate Member version 2.13.1 or earlier should update immediately once a patched release is available. Monitor the Patchstack advisory for remediation guidance, and consider temporarily disabling the plugin on high-value sites if no fix is yet available.

Vendor Advisory

🟠 [HIGH] ggml-org/llama.cpp

1 CVE | CVSS 4.0: 9.2 | AAS 10.5

  • cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:* (>= b8841, < b11865)

The llama.cpp inference framework versions b8841 through b11864 is affected by one critical vulnerability (CVE-2026-118375, CVSS 9.2) involving a stack-based buffer overflow in the ggml-rpc RDMA transport layer. An unauthenticated remote attacker can send a crafted HELLO message advertising RDMA capabilities to overflow a 1-byte stack variable with up to 256 KiB of data, resulting in server crashes or potential remote code execution.

Organizations running llama.cpp’s RPC server with RDMA transport enabled should upgrade to version b11865 or later immediately. If upgrading is not feasible, restrict network access to the RPC server endpoint to trusted hosts only and disable RDMA transport if it is not required.

Vendor Advisory

🟠 [HIGH] signalk/signalk-server

1 CVE | CVSS 4.0: 9.3 | AAS 10.5

  • cpe:2.3:a:signalk:signalk-server:*:*:*:*:*:*:*:* (< 2.33.0)

Signal K Server before version 2.33.0 is affected by one critical vulnerability (CVE-2026-118690, CVSS 9.3) where the /skServer/ziplogs endpoint lacks authentication, allowing any unauthenticated remote attacker to download server log archives. These archives contain security.json with the JWT secret key, enabling an attacker to forge administrator tokens and create persistent admin accounts for full control of the server.

Organizations running Signal K Server in marine or IoT environments should upgrade to version 2.33.0 or later immediately. After upgrading, rotate the JWT secret key and audit existing admin accounts for any unauthorized additions, as prior exploitation may have already established persistent access.

Vendor Advisory

🟠 [HIGH] artbees/jupiter_x_core

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:artbees:jupiter_x_core:*:*:*:*:*:*:*:*

The Jupiter X Core plugin for WordPress through version 4.61.0 is affected by one critical vulnerability (CVE-2026-106013, CVSS 9.8) that enables authentication bypass through the Twitter/X social login handler. A flaw in the verify_twitter_callback function fails to reassign OAuth credentials after token exchange, causing the identity verification call to use stale credentials, which an attacker can exploit to log in as any user including administrators.

WordPress site administrators using Jupiter X Core with social login enabled should update beyond version 4.61.0 immediately. If an update is not yet available, disable the Twitter/X social login feature as a temporary mitigation and review user accounts for any signs of unauthorized access.

Vendor Advisory

🟠 [HIGH] aman/funnelkit_automations

1 CVE | CVSS 3.1: 9.3 | AAS 9.6

  • cpe:2.3:a:aman:funnelkit_automations:*:*:*:*:*:*:*:* (< 3.8.6)

FunnelKit Automations (wp-marketing-automations) for WordPress through version 3.8.5.2 is affected by one critical vulnerability (CVE-2026-111411, CVSS 9.3) involving blind SQL injection due to improper neutralization of user-supplied input in SQL queries. Successful exploitation could allow an attacker to read, modify, or delete sensitive database contents, potentially compromising the entire WordPress installation and any stored customer data.

WordPress administrators running FunnelKit Automations version 3.8.5.2 or earlier should update to a patched release as soon as one is available. Monitor the Patchstack advisory for remediation details, and consider implementing a web application firewall rule to block SQL injection attempts against this plugin in the interim.

Vendor Advisory

🟠 [HIGH] wwbn/avideo-encoder

2 CVEs | CVSS 3.1: 10.0 | AAS 9.3

  • cpe:2.3:a:wwbn:avideo-encoder:*:*:*:*:*:*:*:* (< 8.1.0)

AVideo Encoder (avideo-encoder) prior to version 8.1.0 is affected by two critical vulnerabilities (including CVE-2026-61567 and CVE-2026-61564, max CVSS 10.0) involving authentication bypass in the live-streaming endpoint. An unauthenticated remote attacker can supply a malicious URL as the streamer identity, causing the server to trust attacker-controlled JSON as session state, granting streaming privileges and potentially full platform access without any legitimate credentials.

Organizations running AVideo Encoder should upgrade to version 8.1.0 or later immediately. If immediate patching is not possible, restrict network access to the encoder’s live-streaming endpoints and ensure the encoder cannot make outbound HTTP requests to untrusted hosts.

Vendor Advisory

🟠 [HIGH] samba/samba

1 CVE | CVSS 3.1: 8.1 | AAS 9.2

  • cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* (>= 4.21.0, < 4.21.4)
  • cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* (>= 4.22.0, < 4.22.1)

Samba’s experimental vfs_ceph_rgw module is affected by one high-severity vulnerability (CVE-2026-109411, CVSS 8.1) involving an access control bypass in the openat() function. An authenticated user can request existing files using mismatched character casing, causing the module to misidentify the operation as a new file creation and skip standard permission checks, allowing unauthorized reading or overwriting of restricted files.

Organizations using Samba shares configured with the vfs_ceph_rgw module should apply vendor patches as soon as they are available from their distribution. If patching is not immediately possible, consider disabling the vfs_ceph_rgw module or restricting share access to trusted users only, and monitor the Red Hat advisory for updated remediation guidance.

Vendor Advisory

🟠 [HIGH] project-monai/monai

2 CVEs | CVSS 4.0: 8.6 | AAS 9.2

  • cpe:2.3:a:project-monai:monai:*:*:*:*:*:*:*:* (>= 1.2.0, < 1.6.1)

MONAI, the open-source medical AI framework, versions 1.2.0 through 1.6.0 is affected by two high-severity vulnerabilities (including CVE-2026-118683 and CVE-2026-118684, max CVSS 8.6) enabling remote code execution through malicious bundle configurations. An attacker can publish a crafted MONAI bundle whose logging.conf exploits eval() calls during workflow initialization, executing arbitrary Python code when a victim loads or runs the bundle.

Research teams and healthcare organizations using MONAI for medical imaging workflows should upgrade to version 1.6.1 or later immediately. Exercise caution when loading third-party MONAI bundles from untrusted sources, and audit any recently downloaded bundles for suspicious logging.conf entries prior to patching.

Vendor Advisory

🟠 [HIGH] rucio/rucio

1 CVE | CVSS 3.1: 8.8 | AAS 9.2

  • cpe:2.3:a:rucio:rucio:*:*:*:*:*:*:*:* (< 35.6.0)

Rucio, the scientific data management framework, is affected by one high-severity vulnerability (CVE-2026-58273, CVSS 8.8) where the /credentials/signurl endpoint trusts the client-supplied X-Rucio-Account header for authorization instead of the authenticated token’s actual account. Any user holding a valid low-privilege auth token can impersonate the root account and have the server generate presigned read, write, or delete URLs for arbitrary objects using the storage endpoint’s credentials.

Organizations running Rucio instances, particularly in large-scale research and data management environments, should apply the vendor patch immediately and audit access logs for any suspicious signurl requests with mismatched account headers. Review the GitHub advisory for the patched version and consider rotating S3, GCS, or Swift credentials on affected storage endpoints if prior exploitation cannot be ruled out.

Vendor Advisory

🟠 [HIGH] espocrm/espocrm

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* (< 9.3.11)
  • cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* (>= 10.0.0, < 10.0.8)

EspoCRM before version 9.3.11 and 10.x before 10.0.8 is affected by one high-severity vulnerability (CVE-2026-118686, CVSS 8.7) involving a regular expression denial of service in API error handling. An unauthenticated remote attacker can send a small number of concurrent large API requests to trigger catastrophic backtracking in the password-redaction regex, exhausting server workers and rendering EspoCRM unavailable to legitimate users.

Organizations running EspoCRM should upgrade to version 9.3.11 or 10.0.8 or later immediately. As a temporary mitigation, consider implementing request body size limits at the reverse proxy or web application firewall level to restrict oversized API payloads from reaching the application.

Vendor Advisory

🟠 [HIGH] fogproject/fogproject

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* (< 1.5.10.2253)
  • cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:* (>= 1.6.0-RC-0, < 1.6.0-RC-1)

FOG Project, the open-source imaging and inventory management suite, prior to versions 1.5.10.2253 and 1.6.0-RC-1 is affected by one high-severity vulnerability (CVE-2026-116778, CVSS 8.8) involving a privilege escalation through missing role enforcement in the API. An authenticated non-administrator user with API access can modify Storage Node credentials and file paths via the PUT /fog/storagenode/{id}/edit endpoint, potentially leveraging storage replication to execute arbitrary commands on connected nodes.

Organizations using FOG Project for network imaging and deployment should upgrade to version 1.5.10.2253 or 1.6.0-RC-1 or later immediately. As an interim measure, restrict API token distribution to administrator accounts only and audit Storage Node configurations for any unauthorized modifications to credentials or file paths.

Vendor Advisory

🟠 [HIGH] labstack/echo

2 CVEs | CVSS 4.0: 8.2 | AAS 9.0

  • cpe:2.3:a:labstack:echo:*:*:*:*:*:*:*:* (>= 4.0.0, < 4.16.1)

The Echo Go web framework versions 4.0.0 through 4.16.0 is affected by two high-severity vulnerabilities (CVE-2026-118260 and CVE-2026-118261, max CVSS 8.2) involving unbounded memory allocation in the opt-in BodyDump middleware. An unauthenticated attacker can send large request bodies or trigger large responses on routes using BodyDump, causing repeated memory allocations that can exhaust process memory and crash the application.

Development teams using Echo v4 with the BodyDump middleware enabled should upgrade to version 4.16.1 or later. If immediate upgrading is not feasible, disable BodyDump on production routes or enforce strict request body size limits at the reverse proxy layer to mitigate exploitation.

Vendor Advisory

🟠 [HIGH] libexpat/libexpat

1 CVE | CVSS 4.0: 8.2 | AAS 9.0

  • cpe:2.3:a:libexpat:libexpat:*:*:*:*:*:*:*:*

libexpat, the widely-used XML parsing library, through version 2.9.0 is affected by one high-severity vulnerability (CVE-2026-117610, CVSS 8.2) involving a NULL pointer dereference in the external entity processing code. An attacker who can control XML stream chunking can force an empty parse on an external entity subparser, triggering a crash in any application linked against libexpat.

Given libexpat’s extensive use as a dependency across operating systems, programming languages, and applications, this vulnerability has broad impact. System administrators and developers should monitor their distributions for patched libexpat packages and update promptly, paying particular attention to applications that parse untrusted XML input.

Vendor Advisory

🟠 [HIGH] n8n-io/n8n

1 CVE | CVSS 4.0: 8.4 | AAS 9.0

  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:* (< 1.123.85)
  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:* (>= 2.0.0, < 2.43.5)
  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:* (>= 2.44.0, < 2.44.1)

n8n, the workflow automation platform, before versions 1.123.85, 2.43.5, and 2.44.1 is affected by one high-severity vulnerability (CVE-2026-118648, CVSS 8.4) involving stored cross-site scripting through webhook response paths. Authenticated members who can create workflows can craft webhook responses that bypass the Content-Security-Policy sandbox, serving malicious HTML that executes scripts in the context of any user who visits the webhook URL and hijacking their session.

Organizations running self-hosted n8n instances should upgrade to version 1.123.85, 2.43.5, or 2.44.1 or later immediately. As a precaution, review active workflows for suspicious webhook configurations and restrict workflow creation permissions to trusted users until the patch is applied.

Vendor Advisory