5 vulnerabilities across 5 products scored HIGH or above on October 29, 2026.

  • 🟠 HIGH: 5

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-115893 (bytecodealliance/wasmtime) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-10-23 bulletin.

🟠 [HIGH] ibm/langflow_oss

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* (>= 1.0.0, < 1.12.9)

IBM Langflow OSS versions 1.0.0 through 1.12.8 are affected by a critical remote code execution vulnerability (CVE-2026-110186, CVSS 9.8) stemming from improper control of code generation, which could allow an unauthenticated remote attacker to execute arbitrary code on affected systems. This vulnerability is considered exploitable, making it an urgent priority for any organization running Langflow OSS in their AI and workflow automation pipelines. Security teams should review the vendor advisory at https://www.ibm.com/support/pages/node/7294467 and upgrade beyond version 1.12.8 immediately.

Vendor Advisory

🟠 [HIGH] agno-agi/agno

1 CVE | CVSS 4.0: 9.2 | AAS 10.5

  • cpe:2.3:a:agno-agi:agno:*:*:*:*:*:*:*:*

Agno through version 3.1.11 is affected by a critical unsafe reflection vulnerability (CVE-2026-119050, CVSS 9.2) in its PandasTools component, where attacker-controlled function names passed to getattr() allow arbitrary pandas function invocation. Through prompt injection, an attacker can trigger remote code execution via pandas.read_pickle on malicious paths or read sensitive local files using other reader functions. Teams using Agno in AI agent pipelines should update beyond version 3.1.11 immediately and monitor the vendor repository at https://github.com/agno-agi/agno for a patched release.

Vendor Advisory

🟠 [HIGH] openemr/openemr

1 CVE | CVSS 4.0: 8.7 | AAS 10.3

  • cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* (< 8.5.0)

OpenEMR versions before 8.5.0 are affected by an authenticated SQL injection vulnerability (CVE-2026-49142, CVSS 8.7) in the Syndromic Surveillance module, where users with Clinician-level privileges can read and modify arbitrary database contents through crafted values in the form_icd_codes[] POST parameter. Given that OpenEMR installations typically contain protected health information, exploitation poses serious data breach and regulatory compliance risks for healthcare organizations. Administrators should upgrade to OpenEMR 8.5.0 or later immediately, referencing the vendor patch at https://github.com/openemr/openemr/commit/9b52cc0fc3a4eddd9fa7a096f6a3ac2a57d772d0.

Vendor Advisory

🟠 [HIGH] stylemixthemes/motors

1 CVE | CVSS 3.1: 9.3 | AAS 9.6

  • cpe:2.3:a:stylemixthemes:motors:*:*:*:*:*:*:*:*

The StylemixThemes Motors plugin for WordPress, used for car dealership and classified listings, is affected by a critical blind SQL injection vulnerability (CVE-2026-115964, CVSS 9.3) in all versions through 1.4.126. This flaw could allow an attacker to extract sensitive database contents from affected WordPress sites, posing a direct risk to any organization running this plugin. Site administrators should update the Motors plugin beyond version 1.4.126 immediately and review the vendor advisory at https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-126-sql-injection-vulnerability for further details.

Vendor Advisory

🟠 [HIGH] instawp/instawp_connect

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:instawp:instawp_connect:*:*:*:*:*:*:*:* (< 0.1.4.3)

The InstaWP Connect plugin for WordPress versions through 0.1.4.2 is affected by a cross-site request forgery vulnerability (CVE-2026-116399, CVSS 8.8) that could allow an attacker to perform unauthorized actions on behalf of authenticated administrators by tricking them into visiting a malicious page. WordPress site operators using InstaWP Connect for staging or migration workflows should treat this as high priority, as successful exploitation could compromise site integrity. Update the plugin beyond version 0.1.4.2 immediately and consult the vendor advisory at https://patchstack.com/database/wordpress/plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-4-2-cross-site-request-forgery-csrf-vulnerability for additional guidance.

Vendor Advisory