9 vulnerabilities across 5 products scored HIGH or above on October 30, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 8

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-115893 (bytecodealliance/wasmtime) — F1: theoretical → poc, AAS: 9.1 → 11.6 (HIGH → HIGH). Originally in 2026-10-23 bulletin.

🔴 [CRITICAL] clickhouse/clickhouse

1 CVE | CVSS 4.0: 9.5 | AAS 12.1

  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* (< 23.3.22)
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* (>= 23.4.1, < 23.8.14)
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* (>= 23.9.1, < 23.12.6)
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* (>= 24.1.1, < 24.1.3)
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* (>= 24.2.1, < 24.2.2)

ClickHouse Server is affected by a critical remote code execution vulnerability (CVE-2026-116366, CVSS 9.5) that allows an unauthenticated attacker with network access to execute arbitrary code under certain conditions. A functional exploit is available, significantly increasing the risk of active exploitation. Organizations running ClickHouse Server should immediately consult the vendor security changelog at clickhouse.com and apply available patches or mitigations without delay, prioritizing any internet-facing deployments.

Vendor Advisory

🟠 [HIGH] gravity_forms/gravity_forms

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:gravity_forms:gravity_forms:*:*:*:*:*:*:*:* (< 3.1.3)

Gravity Forms plugin for WordPress versions up to and including 3.1.2 is affected by a critical PHP Object Injection vulnerability (CVE-2026-103039, CVSS 9.8) via unsanitized deserialization in Post Custom Field inputs using the List type. This flaw allows unauthenticated attackers to inject arbitrary PHP objects, potentially leading to full site compromise, and the vulnerability is confirmed exploitable. WordPress administrators running Gravity Forms should update immediately to a patched version and review site integrity, as this is a widely deployed commercial plugin with a large attack surface.

Vendor Advisory

🟠 [HIGH] sqlite/sqlite

4 CVEs | CVSS 4.0: 8.5 | AAS 9.8

  • cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* (>= 3.9.0, < 3.54.0)
  • cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* (>= 3.13.0, < 3.54.0)

SQLite versions before 3.54.0 are affected by four vulnerabilities (CVSS up to 8.5), including at least one exploitable heap buffer overflow in the FTS5 full-text search engine that can corrupt heap memory and crash processes via crafted prefix MATCH queries. Given SQLite’s ubiquitous embedding in operating systems, browsers, mobile platforms, and countless applications, these flaws carry an exceptionally broad blast radius across virtually every technology stack. All teams shipping or depending on SQLite should upgrade to 3.54.0 immediately and audit downstream dependencies that bundle their own SQLite copies.

Vendor Advisory

🟠 [HIGH] n8n-io/n8n

2 CVEs | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:* (< 2.42.6)
  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:* (>= 2.43.0, < 2.43.3)
  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:* (>= 3.0.0, < 3.0.1)
  • cpe:2.3:a:n8n-io:n8n:*:*:*:*:*:*:*:* (>= 2.14.0, < 2.46.4)

n8n workflow automation platform versions before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 are affected by two vulnerabilities (CVSS up to 8.7), including at least one exploitable remote code execution flaw that allows authenticated users to execute arbitrary JavaScript in the n8n main process via deprecated Function and LangChain Code nodes running outside task runner isolation. Any organization running self-hosted n8n instances with multi-user access should treat this as high priority, since a single compromised or malicious user account can achieve full server compromise. Upgrade immediately to n8n 2.42.6, 2.43.3, or 3.0.1 and review workflow histories for unexpected imports or modifications of deprecated node types.

Vendor Advisory

🟠 [HIGH] strategy11team/formidable_forms_–_contact_form,_survey,_quiz,_payment,calculator_form&_custom_form_builder

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:strategy11team:formidable_forms_contact_form_survey_quiz_payment_calculator_form_custom_form_builder:*:*:*:*:*:*:*:* (< 6.36)

Formidable Forms plugin for WordPress versions up to and including 6.35 is affected by an arbitrary plugin installation vulnerability (CVE-2026-89435, CVSS 8.8) caused by insufficient URL validation and a weak permission check that allows any user with the delegable frm_view_forms capability to install and activate unauthorized plugins. This is exploitable and effectively gives low-privileged users a path to full site takeover by installing a malicious plugin. WordPress administrators using Formidable Forms should update beyond version 6.35 immediately and audit installed plugins for any unauthorized additions.

Vendor Advisory