Patchstack reported on 6 October 2026 that one attacker is exploiting two unrelated stored cross-site scripting (XSS) flaws in WordPress plugins with the same JavaScript payload, loaded from imgcdn1[.]com. Patchstack first saw it on 4 October against CVE-2026-93836 in WPC Product Bundles for WooCommerce (8.6.6 and earlier, about 30,000 active sites), where a numeric quantity value with extra markup is stored in WooCommerce order data. On 5 October the same payload arrived through CVE-2026-94504 in Ninja Forms (3.15.3 and earlier, more than 500,000 sites), submitted through the plugin's normal form-submission AJAX endpoint and later rendered unescaped in the legacy admin submission editor. Neither needs the attacker to log in; the script runs when a logged-in administrator opens the order or form submission. It then uses the administrator's own session and WordPress nonces to upload a malicious plugin posing as "WP Smart Thumbnails" 1.2.4 from "MediaPress Labs", create an administrator account, and report back to its server. Patchstack found the plugin carries a heavily packed file manager that works without login, plus a second script that creates an administrator hidden from the Users screen and its counts, adds a secret login URL that signs in as the original site owner, and backdates its own files. Those extra pieces keep working after the fake plugin is removed. Patchstack says exploitation is limited so far and expects more plugins to be used. Both CVE records were published by Wordfence on 22 September with CVSS 7.2. Primary: Patchstack; wire: BleepingComputer.
Patchstack — Four ways back in: the WordPress XSS campaign that hides its own admin account (6 Oct 2026)
IBM security bulletin 7290833 (initial publication 5 October 2026) covers Maximo AI Service 9.1.0 and 9.2.0, the AI component of the Maximo Application Suite used for asset and maintenance management. Its most serious item is IBM's own CVE-2026-90920: improper control of code generation (CWE-94) that IBM says could let a remote attacker execute arbitrary code. IBM rates it CVSS 3.1 9.8 with no privileges or user interaction needed. The CVE record was published on 13 October 2026 (Perth time). The same bulletin fixes vulnerable third-party parts bundled with the service: Apache Tomcat embed core 10.1.57 (including the security-constraint and DIGEST authentication bypasses CVE-2026-65182 and CVE-2026-65905), Netty handler (CVE-2026-75595 SNI mutual-TLS bypass), Apache HttpClient 5 (CVE-2026-71290 hostname verification), GitPython and glibc. IBM lists no workarounds and says to upgrade now. Three further Maximo AI Service denial-of-service CVEs published at the same time (CVE-2026-90911, -90912 and -90921, CVSS 7.5) point to IBM bulletin 7290473 (1 October 2026), which is fixed by the same releases. No exploitation or public exploit has been reported, and the CVE is not on CISA's KEV list. Primary: IBM security bulletin; CVE record (IBM CNA).
IBM Security Bulletin 7290833 — Maximo AI Service third-party dependencies and CVE-2026-90920 (initial publication 5 Oct 2026)
Zabbix, acting as its own CVE numbering authority, published two records on 5 October 2026 for Zabbix Server and Proxy. CVE-2026-59782 (ZBX-28193, CVSS 4.0 6.9 Medium): the Duktape JavaScript preprocessing engine lets a limited administrator read raw heap data, which can expose data from other running preprocessors that the administrator is not allowed to see. Zabbix credits Shaber Tseng via HackerOne. CVE-2026-59787 (ZBX-28197, Zabbix CVSS 4.0 5.3; Tenable's CVE page lists CVSS 3.1 9.1): the Perl SNMP trap receiver script shipped with Zabbix does not neutralise the ZBXTRAP record delimiter inside trap content, so anyone who can send SNMP traps to the receiver can inject a record that lands against a different monitored host. Zabbix credits the researcher 'stoun' via HackerOne. Both affect 6.0.0 to 6.0.47, 7.0.0 to 7.0.28 and 7.4.0 to 7.4.12. No exploitation has been reported.
The Apache Struts project published four security bulletins, S2-075 to S2-078, with CVE records issued on 5 October 2026 (UTC). S2-075 (CVE-2026-104711, rated Moderate by Apache): if an application uses the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Applications on the default mapper, the restful2 mapper or the Struts REST plugin are not affected, and Struts 7 is only affected when its OGNL allowlist has been disabled. S2-076 (CVE-2026-104712, Moderate): a request parameter bound to a java.math.BigDecimal property and rendered through the Struts tags can produce a response many orders of magnitude larger than the request, letting an unauthenticated attacker burn CPU and outbound bandwidth with low-volume traffic. S2-077 (CVE-2026-104713, Important): the optional REST plugin reads request bodies into memory with no size limit, so a single oversized request can exhaust the heap; fixed releases add a default limit of 2,097,152 characters. S2-078 (CVE-2026-104714, Moderate): a message formatter shared between concurrent requests can show one user's date or time value in another user's response or cause rendering errors, with no malicious input needed. Reporters: LeaveSong (S2-075), 0xCc.zhang (S2-076), n0mi1k (S2-077, S2-078). Apache gives severity ratings only; no CVSS score has been published, and no exploitation has been reported. Primary: Apache Struts security bulletins; wire: Cyber Security News (6 Oct).
Atlassian published a security advisory on 5 October 2026 for CVE-2026-21589, an arbitrary file access flaw (recorded as path traversal) in Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye. An attacker with no login can read specific files inside the web application root directory, but must already know each file's exact name and path; the flaw does not let them list directory contents. Atlassian says some configurations hold sensitive files there, which raises the risk. Atlassian rates it Critical, 9.3 under CVSS v4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H), as its own internal assessment. All versions before the listed fixes are affected, which can include end-of-life versions. Affected Atlassian Cloud products are already patched and Atlassian says its investigation found no evidence of exploitation there; Bitbucket Cloud is not affected. For self-hosted instances Atlassian says it cannot confirm whether any have been hit, and tells customers to search access logs for requests where .. sits directly next to /, \ or :: (after URL-decoding up to twice). It offers three temporary blocking rules (a WAF or proxy regex, a Tomcat RewriteValve rule, and a file change; Crucible and Fisheye only get the first) and says they are not a replacement for patching. Primary: Atlassian security advisory. UPDATE (watchTowr Labs, 6 Oct 2026): watchTowr published a technical analysis, a Python proof of concept and a detection artefact generator. It traces the bug to the shared atlassian-plugins-webresource library, which turns :: back into / in web-resource download paths, so a request such as /download/resources/<plugin-key>/images/..::..::WEB-INF::web.xml walks out of a plugin's resource folder. watchTowr showed working routes on Jira, Confluence and Bitbucket. Reads stay inside the Tomcat web application, but that includes WEB-INF. On Jira set up to use Crowd as described in Atlassian's documentation, WEB-INF/classes/crowd.properties holds the Crowd application name and password; watchTowr used those to call the Crowd REST API, list users, create a new user and add it to jira-administrators. With public exploit code out, expect scanning and exploitation to follow quickly. UPDATE (7 Oct 2026): exploitation attempts have started. Previdian says its honeypot network saw attempts within two hours of watchTowr's write-up and exploit code going public, 15 attempts from three IP addresses in Japan and the US (38.60.157[.]86, 146.70.187[.]234 and 159.26.119[.]225), and a Nuclei scanning template is now out, so it expects activity to climb over the coming days. watchTowr has also released a free scanner to check whether an instance is vulnerable. Sources: BleepingComputer and The Hacker News (7 Oct). CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on 15 October 2026 with an 18 October due date for US federal agencies (source: CISA KEV catalog). Correction (24 Oct 2026): The CVE record for CVE-2026-21589 (Atlassian, updated 19 October) now lists the same fixed versions as Atlassian's advisory for all eight Data Center products and no longer lists Server editions, so the earlier note that it differed for Crowd and Bamboo and listed Server editions with no fix has been removed. (source: CVE record CVE-2026-21589) Correction (25 Oct 2026): removed an 8 October attempt count credited to a wire report we cannot read. (source: Previdian) UPDATE (26 Oct 2026): as of 26 October 2026 (Perth), Previdian's page for CVE-2026-21589 (daily telemetry updated 25 October) says its sensors have recorded 658 exploitation attempts from 78 unique attacker IP addresses in 22 countries, first observed on 6 October and last observed on 25 October. (source: Previdian)
Google published the Android Security Bulletin for October 2026 on 5 October 2026. It lists 25 vulnerabilities, all fixed at a single security patch level, 2026-10-01: 7 rated Critical and 18 High. Google says the most severe is a Critical flaw in the System component that could lead to local escalation of privilege with no additional execution privileges and no user interaction. The Critical System entries are CVE-2026-55269, CVE-2026-55280, CVE-2026-58835 and CVE-2026-58880 (privilege escalation, Android 16, 16 QPR2 and 17) plus CVE-2026-49933 and CVE-2026-55265 (denial of service); the CVE records published on 6 October place CVE-2026-58880, CVE-2026-58835 and CVE-2026-55269 in Bluetooth stack code (a race condition, a heap buffer overflow and an input-validation flaw). The Framework section's Critical entry, CVE-2026-58865, is a remote denial of service needing no privileges or user interaction. The High-rated set includes CVE-2026-49878, a System remote code execution bug in the Wi-Fi module, and five Framework privilege escalations. Wi-Fi (CVE-2026-45524, CVE-2026-49878) and Telephony (CVE-2026-58859) fixes also ship as Google Play system updates. The bulletin does not flag any of these as exploited, and Google says AOSP source patches follow within 48 hours. Chipset fixes from MediaTek's own October bulletin (desk card mediatek-october-2026-bulletin-20261005) arrive separately through device makers. The Pixel bulletin for October was not yet published when this card was checked. Primary: Android Security Bulletin, October 2026.
Android Security Bulletin — October 2026 (published 5 Oct 2026)
Nine CVE records for vLLM, the open-source LLM inference and serving engine, were published on 5 October 2026 from its GitHub advisories; all are Medium or Low (top CVSS 3.1 score 6.5). The higher-impact ones let one request take down service for every user of a deployment: CVE-2026-105756 (GHSA-2823-qmq8-rwvj), where a malformed cache_salt kills EngineCore on LMCache-MP deployments; CVE-2026-105757 (GHSA-85xf-c7hm-whqw), where structured-output request errors escape the request boundary and terminate the shared engine; CVE-2026-105754, where the scale-out disaggregated multimodal transport trusts caller-supplied features; and CVE-2026-105753, a multimodal IPC cache desync (fixed in 0.28.0). Several are reachable without authentication: CVE-2026-105758 and CVE-2026-105760 let request-supplied video frame and fps values exhaust CPU and memory (Qwen2-VL/Qwen3-VL samplers via /tokenize, and the GLMGA backend), and CVE-2026-105759 lets arbitrary HTTP method tokens grow Prometheus label sets in the Rust frontend until memory runs out. Two weaken tenant isolation: CVE-2026-105752 drops cache_salt on Harmony tool continuations so a tenant can test whether another tenant's prefix was cached (prefix caching is on by default), and CVE-2026-105755 lets a reused X-Request-Id overwrite cached query embeddings on /score and /rerank. The advisories do not report exploitation. Primary: vLLM GitHub security advisories.
Twenty, the open-source CRM, published GitHub advisory GHSA-mq5c-qp77-2cv3 (CVE-2026-105763, CVSS 3.1 9.6; CVE record published 5 October 2026). From 1.20.10 until 2.7.0, the connectedAccounts query on the /metadata GraphQL endpoint returned the connection parameters of every connected account in a workspace, including plaintext IMAP, SMTP and CalDAV passwords, because the field was not hidden and the lookup did not check the caller's identity or account visibility. An ordinary workspace member could take other members' mail and calendar credentials, read their mail or calendars, and potentially use them to reset third-party accounts. Workspaces that connect only Google or Microsoft accounts through OAuth were not affected. The advisory does not report exploitation. Primary: Twenty GitHub security advisory.
CVE records published 5 October 2026 cover Langflow GitHub advisories on its Model Context Protocol (MCP) support. GHSA-w794-rj3p-xv45 (CVE-2026-105697, CVSS 3.1 9.9) and GHSA-7w94-79vh-5mr2 (CVE-2026-105740, 9.9) describe the same core flaw: when a user adds an MCP server with the stdio transport, or builds a flow with the MCP Tools component, Langflow launched the supplied command and arguments with no allowlist, wrapped in bash -c, so the command runs on the Langflow host as the Langflow process user as soon as Langflow connects to that server, even if the UI then says the server failed to start. The advisory notes that with the default LANGFLOW_AUTO_LOGIN=true, the auto-login endpoint hands out a token without credentials, so an exposed instance on the default setting can be exploited without an account; with auto-login off, any authenticated non-admin user can do it. The fix came in two steps: 1.9.0 added a command allowlist and argument/environment checks to the Add MCP Server API, and 1.10.3 applied the same policy at the point where the process is spawned (covering configs embedded in flows and tweaks) and removed the bash wrapper. A third advisory, GHSA-4f6c-2vvp-gw82 (CVE-2026-105741, 7.1), lets an authenticated user bypass the local-only check on the MCP config install endpoint by sending X-Forwarded-For: 127.0.0.1 and write an MCP client config file on the server (1.5.0 to before 1.10.3). The advisories themselves do not report exploitation. Primary: Langflow GitHub security advisories; CVE records 5 Oct. UPDATE 15 October: honeypot operator Previdian says its sensors have recorded 1,423 exploitation attempts against CVE-2026-105740 since 19 September 2026 from 27 attacker IP addresses in 15 countries, rising from 11 October (333 attempts that day) and still running on 15 October (66 by the time The Hacker News reported it). Previdian rates the exploitation as confirmed. Wire: The Hacker News.
Langflow GHSA-w794-rj3p-xv45 — OS command injection via MCP stdio server configuration (CVE-2026-105697)
Ten CVE records for Docling, the open-source document conversion library widely used to feed PDFs and office files into RAG and other generative AI pipelines, were published on 5 October 2026 from its GitHub advisories. The most serious, CVE-2026-105744 (GHSA-x3q2-h9hx-4r4j, CVSS 3.1 7.5), affects callers that opt into the Tectonic engine for TikZ in LaTeX input (2.94.0 to before 2.132.0): crafted input can read files the converter can access and create or overwrite writable files, and turning on the shell-escape option also allows shell commands; the default configuration is not affected. CVE-2026-105751 (GHSA-4xhp-xg4w-8ppm, CVSS 4.0 6.9) lets an OpenDocument file's draw:image reference read local files that decode as images into the converted output (2.107.0 to before 2.120.3). Others cover an SSRF guard that can be bypassed with DNS rebinding or mixed address records when remote fetching is enabled (CVE-2026-105743), enable_local_fetch not enforced in HTML browser-rendering mode (CVE-2026-105750), plugin entry points imported before the allow_external_plugins check (CVE-2026-105745), configured HTTP headers sent to every remote image host (CVE-2026-105742), local images embedded via crafted DoclingDocument JSON (CVE-2026-105748), CPU or memory exhaustion from oversized tables or archives (CVE-2026-105747, CVE-2026-105749), and a KServe OCR remote-services setting not enforced (CVE-2026-105746). The advisories do not report exploitation. Primary: Docling GitHub security advisories.
Docling GHSA-x3q2-h9hx-4r4j — file read/write via untrusted TikZ with opt-in Tectonic engine (CVE-2026-105744)
Two CVE records for Dify, the open-source LLM app development platform from LangGenius, were published on 5 October 2026 from its GitHub advisories. GHSA-8235-vv5j-mmvg (CVE-2026-105762, CVSS 3.1 8.3): before 1.13.0, the /console/api/remote-files/upload endpoint took an attacker-supplied URL without authentication and made the Dify server fetch it, so a remote attacker could use the server to send requests to internal services or cloud metadata endpoints and as a network pivot. GHSA-ccrj-frp2-c945 (CVE-2026-105761, 7.1): before 1.16.0, the PUT endpoint for an app's MCP server looked up the server by a client-supplied ID without checking that it belonged to that app and tenant, so an authenticated workspace member could change another app's MCP server status and settings, potentially redirecting data or disabling the service. The advisories do not report exploitation. Primary: Dify GitHub security advisories; CVE records 5 Oct.
Dify GHSA-8235-vv5j-mmvg — Unauthenticated SSRF in /console/api/remote-files/upload (CVE-2026-105762)
MediaTek published its October 2026 Product Security Bulletin on 5 October 2026, covering 31 vulnerabilities in its smartphone, tablet, IoT and automotive chipsets: 2 Critical, 9 High and 20 Medium. The two Critical bugs, CVE-2026-20519 and CVE-2026-20520, are out-of-bounds writes in the modem firmware caused by missing bounds checks; the CVE records say a device that connects to a rogue base station controlled by an attacker could suffer remote escalation of privilege with no user interaction and no extra execution privileges. Both affect a long list of 4G/5G modem chipsets (including the MT68xx and MT69xx Dimensity families and MT87xx/MT88xx parts) and were found internally. The High-rated issues include more modem out-of-bounds writes (for example CVE-2026-20526, which needs user interaction), out-of-bounds writes in the video decoder and encoder (CVE-2026-20586, CVE-2026-20589), a stack overflow in the Video HAL (CVE-2026-20521), and flaws in the NeuroPilot and APU AI-accelerator components. MediaTek says device makers received the patches at least two months before publication and that it is not aware of active exploitation. End users get the fixes only through their phone or tablet maker's security update, which often lands with or after the matching Android monthly patch.
MediaTek — Product Security Bulletin, October 2026 (published 5 Oct 2026)
