by Kastro
Friday 30 October 2026

Good morning. 1 thing needs you before lunch.

55 new ≥ 9.01 added to KEV0 EPSS jumps0 watchlist hitsall upstreams fresh ●
GitLab1 vulnerabilityMax CVSS 10.0Priority 99KEV 1
CVE-2026-97229·GitLab GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially…

KEV · added today · due 1 NovEPSS 18%public exploitSSVC actCVSS 10.0
Integer Overflow or Wraparound in GitLab · From CVE record · score breakdown & fixes →
99
CVSS 10.0

EPSS moved overnight

No EPSS jumps of 15 points or more.

Also new today

Ajax Load More1 vulnerabilityMax CVSS 10.0Priority 30KEV 0
  1. 30Priority
    CVE-2026-61991 · Ajax Load More AjaxLoadMore Cache

    WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

    CVSS 10.0
frappe1 vulnerabilityMax CVSS 9.9Priority 30KEV 0
  1. 30Priority
    CVE-2026-119145 · frappe frappe

    Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

    CVSS 9.9
IBM6 vulnerabilitiesMax CVSS 9.9Priority 30KEV 0
  1. 30Priority
    CVE-2026-107327 · IBM Langflow OSS

    Langflow OSS is affected by multiple vulnerabilities

    CVSS 9.9
  2. 30Priority
    CVE-2026-107328 · IBM Langflow OSS

    Langflow OSS is affected by multiple vulnerabilities

    CVSS 9.9
  3. 30Priority
    CVE-2026-107329 · IBM Langflow OSS

    Langflow OSS is affected by multiple vulnerabilities

    CVSS 9.9
  4. 29Priority
    CVE-2026-104339 · IBM Langflow OSS

    Langflow OSS is affected by multiple vulnerabilities

    CVSS 9.8
  5. 29Priority
    CVE-2026-110186 · IBM Langflow OSS

    Langflow OSS is affected by multiple vulnerabilities

    CVSS 9.8
  6. 29Priority
    CVE-2026-93680 · IBM Langflow OSS

    Langflow OSS is affected by multiple vulnerabilities

    CVSS 9.8
Progress Software6 vulnerabilitiesMax CVSS 10.0Priority 30KEV 0
  1. 30Priority
    CVE-2026-84295 · Progress Software WS_FTP Server

    Improper Authentication in Progress WS_FTP Server

    CVSS 10.0
  2. 30Priority
    CVE-2026-90868 · Progress Software WS_FTP Server

    OS Command Injection in Progress WS_FTP Server

    CVSS 9.9
  3. 27Priority
    CVE-2026-90863 · Progress Software WS_FTP Server

    Privilege Escalation via Missing Authorization in WS_FTP Manager

    CVSS 9.1
  4. 27Priority
    CVE-2026-90864 · Progress Software WS_FTP Server

    Host Administrator Path Containment Bypass in Progress WS_FTP Server

    CVSS 9.1
  5. 27Priority
    CVE-2026-90865 · Progress Software WS_FTP Server

    Command Injection via FTP Notification Variables in Progress WS_FTP Server

    CVSS 9.0
  6. 27Priority
    CVE-2026-90866 · Progress Software WS_FTP Server

    Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

    CVSS 9.1
Dahua1 vulnerabilityMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVE-2025-31704 · Dahua Intelligent Connection Center

    Dahua Intelligent Connection Center command injection

    CVSS 9.8
Gravity Forms1 vulnerabilityMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVE-2026-103039 · Gravity Forms Gravity Forms

    Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

    CVSS 9.8
ThemeREX24 vulnerabilitiesMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVE-2026-54856 · ThemeREX RexCoin

    WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

    CVSS 9.8
  2. 29Priority
    CVE-2026-54857 · ThemeREX Quirky

    WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

    CVSS 9.8
  3. 29Priority
    CVE-2026-54858 · ThemeREX Printy

    WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

    CVSS 9.8
  4. 29Priority
    CVE-2026-54859 · ThemeREX Preservation

    WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

    CVSS 9.8
  5. 29Priority
    CVE-2026-54860 · ThemeREX Ozisti

    WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

    CVSS 9.8
  6. 29Priority
    CVE-2026-61997 · ThemeREX Legal Stone

    WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

    CVSS 9.8
  7. 29Priority
    CVE-2026-61998 · ThemeREX Le Truffe

    WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    CVSS 9.8
  8. 29Priority
    CVE-2026-62001 · ThemeREX Marcell

    WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

    CVSS 9.8
  9. 29Priority
    CVE-2026-62002 · ThemeREX Meals & Wheels

    WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

    CVSS 9.8
  10. 29Priority
    CVE-2026-62003 · ThemeREX Mission

    WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

    CVSS 9.8
  11. 29Priority
    CVE-2026-62004 · ThemeREX Motorix

    WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

    CVSS 9.8
  12. 29Priority
    CVE-2026-62005 · ThemeREX Muzicon

    WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

    CVSS 9.8
  13. 29Priority
    CVE-2026-62006 · ThemeREX Nuts

    WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

    CVSS 9.8
  14. 29Priority
    CVE-2026-62008 · ThemeREX Orpheus

    WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

    CVSS 9.8
  15. 29Priority
    CVE-2026-62009 · ThemeREX Filmax

    WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

    CVSS 9.8
  16. 29Priority
    CVE-2026-62010 · ThemeREX Avventure

    WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

    CVSS 9.8
  17. 29Priority
    CVE-2026-62011 · ThemeREX Bonbon

    WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

    CVSS 9.8
  18. 29Priority
    CVE-2026-62012 · ThemeREX Coinpress

    WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

    CVSS 9.8
  19. 29Priority
    CVE-2026-62013 · ThemeREX Edge Decor

    WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

    CVSS 9.8
  20. 29Priority
    CVE-2026-62014 · ThemeREX EmojiNation

    WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

    CVSS 9.8
  21. 29Priority
    CVE-2026-62015 · ThemeREX Gamezone

    WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

    CVSS 9.8
  22. 29Priority
    CVE-2026-62016 · ThemeREX Gamic

    WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

    CVSS 9.8
  23. 29Priority
    CVE-2026-62017 · ThemeREX Good Homes

    WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

    CVSS 9.8
  24. 29Priority
    CVE-2026-62018 · ThemeREX Gunslinger

    WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

    CVSS 9.8
Von Eyal Fitoussi1 vulnerabilityMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVE-2026-61992 · Von Eyal Fitoussi GEO my WordPress

    WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

    CVSS 9.8
Yamaha Corporation1 vulnerabilityMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVSS 9.8
Zoho Flow1 vulnerabilityMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVE-2026-62131 · Zoho Flow Zoho Flow

    WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

    CVSS 9.8
agno-agi1 vulnerabilityMax CVSS 9.2Priority 28KEV 0
  1. 28Priority
    CVE-2026-119050 · agno-agi agno

    Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

    CVSS 9.2
monkeytypegame1 vulnerabilityMax CVSS 9.3Priority 28KEV 0
  1. 28Priority
    CVE-2026-118762 · monkeytypegame monkeytype

    Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

    CVSS 9.3
OpenText1 vulnerabilityMax CVSS 9.2Priority 28KEV 0
  1. 28Priority
    CVE-2026-112256 · OpenText Advanced Authentication Server

    Logon bypass (trust of attacker-controlled completed-methods list)

    CVSS 9.2
randombit1 vulnerabilityMax CVSS 9.2Priority 28KEV 0
  1. 28Priority
    CVE-2026-118769 · randombit botan

    Botan: Integer overflow when reporting block size in FFI can cause memory corruption

    CVSS 9.2
RT-Labs1 vulnerabilityMax CVSS 9.3Priority 28KEV 0
  1. 28Priority
    CVE-2026-111732 · RT-Labs P-Net

    Out-of-bounds write when parsing AR Vendor Block requests

    CVSS 9.3
ServiceNow1 vulnerabilityMax CVSS 9.4Priority 28KEV 0
  1. 28Priority
    CVE-2026-103093 · ServiceNow ServiceNow AI Platform

    Sandbox Escape via Table Rotation in ServiceNow AI Platform

    CVSS 9.4
StylemixThemes1 vulnerabilityMax CVSS 9.3Priority 28KEV 0
  1. 28Priority
    CVE-2026-115964 · StylemixThemes Motors

    WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability

    CVSS 9.3
Teltonika Networks1 vulnerabilityMax CVSS 9.4Priority 28KEV 0
  1. 28Priority
    CVE-2026-82104 · Teltonika Networks RUT

    API permission bypass via logic bug

    CVSS 9.4
Veeam1 vulnerabilityMax CVSS 9.3Priority 28KEV 0
  1. 28Priority
    CVSS 9.3
docat-org1 vulnerabilityMax CVSS 9.1Priority 27KEV 0
  1. 27Priority
    CVE-2026-61645 · docat-org docat

    Docat has Arbitrary File Upload exists in Upload API

    CVSS 9.1
socfortress1 vulnerabilityMax CVSS 9.0Priority 27KEV 0
  1. 27Priority
    CVE-2026-61707 · socfortress CoPilot

    SOCFortress CoPilot: Stored case-report template injection permits backend code execution

    CVSS 9.0
zitadel1 vulnerabilityMax CVSS 9.1Priority 27KEV 0
  1. 27Priority
    CVSS 9.1