FOCUS FRIDAY: TPRM Insights on Critical Vulnerabilities in Progress WS_FTP, WordPress Core, MySQL, pgAdmin, and MLflow

Introduction

This week's Focus Friday highlights five significant vulnerability events that TPRM professionals must prioritize when assessing third-party exposure. Progress Software disclosed eight WS_FTP Server flaws anchored by a maximum-severity CVSS 10.0 unauthenticated credential-theft bug, in a product line with a documented ransomware-targeting history. WordPress Core shipped an emergency fix for a race-condition remote code execution flaw now listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog, with tens of thousands of attack attempts already logged against it. Oracle's October 2026 Critical Patch Update closed out 65 MySQL Server issues, including a critical flaw in the bundled curl library and an unauthenticated Group Replication takeover bug. The PostgreSQL team patched 15 pgAdmin 4 vulnerabilities, the most severe of which already has a public exploit for arbitrary command execution. And the MLflow project fixed an unauthenticated remote code execution flaw in its tracking server alongside a file-read bug under active probing and an AI-agent API key disclosure issue.

Together, these events span the full stack TPRM professionals track across a vendor portfolio — managed file transfer infrastructure, content management systems, database servers, database administration tooling, and AI/ML platforms. TPRM professionals should assess vendor exposure across each affected product category and prioritize remediation conversations for vendors operating CISA KEV-listed or actively exploited vulnerabilities. Black Kite's FocusTag® intelligence provides context on which vendors in your portfolio are exposed and the relative urgency of each disclosure.

Filtered view of vendors with the Progress WS_FTP - Nov2026 FocusTag® on the Black Kite platform.

Progress WS_FTP - Nov2026

What is this vulnerability?

Progress Software disclosed eight vulnerabilities in WS_FTP Server, a managed file transfer platform widely used for mission-critical automated data exchange in finance, healthcare, and government. CVSS scores for the cluster range from 7.7 to 10.0. The anchor flaw, CVE-2026-84295 (CVSS 10.0), is a flawed authentication logic issue (CWE-287) that lets any unauthenticated remote attacker retrieve administrative credentials and reach the management console with no valid privileges. Two OS command injection flaws, CVE-2026-90868 (CVSS 9.9, EPSS 1.49%) and CVE-2026-90865 (CVSS 9.0, EPSS 1.14%), allow arbitrary Windows command execution once an attacker holds those credentials, and three more flaws let a delegated administrator bypass scope restrictions and write files outside their authorized paths.

No public proof-of-concept exists yet and the cluster is not in CISA's KEV Catalog, but the chain is self-contained: an attacker who steals credentials through CVE-2026-84295 can pivot straight into command execution or privilege escalation without ever holding a valid account. WS_FTP carries a direct precedent for why that matters: Clop ransomware operators exploited a prior WS_FTP flaw (CVE-2023-40044) within days of its 2023 patch release, and Progress Software's MoveIT Transfer suffered mass exploitation the same year. Fixes ship in WS_FTP Server 2024.0.7 and 2025.0.4 (Windows only); installations on a version prior to 2024.0.6/2025.0.3 need the intermediate release first.

Why should TPRM professionals care?

Managed file transfer platforms sit at the center of a vendor's most sensitive data flows — financial records, healthcare data, HR files, and regulated communications all pass through them. An unauthenticated credential-theft bug in that kind of system is a single point of failure for a vendor's entire data exchange pipeline, and the established ransomware targeting of this product line raises the likelihood that exposure turns into an active incident rather than a theoretical one.

What questions should TPRM professionals ask vendors?

1. Have you upgraded every WS_FTP Server instance to 2024.0.7 or 2025.0.4, and if you were on a version prior to 2024.0.6/2025.0.3, did you apply the intermediate release first?
2. Is your WS_FTP Server administrative console reachable from the internet, and if so, have you restricted it to internal network ranges as an interim control?
3. Have you rotated WS_FTP Server administrative credentials and service account passwords given the unauthenticated nature of CVE-2026-84295?
4. Have you audited delegated Host Administrator accounts to confirm none can exceed their intended scope, per CVE-2026-90863, CVE-2026-90864, and CVE-2026-90866?

Remediation recommendations

• Upgrade all WS_FTP Server Windows installations to 2024.0.7 or 2025.0.4 immediately, applying the intermediate release first if coming from a version earlier than 2024.0.6/2025.0.3.
• Remove direct internet exposure of the administrative web console; restrict it to internal corporate network ranges only.
• Rotate all WS_FTP Server administrative accounts, service account passwords, and API keys tied to the management interface.
• Audit delegated administrator configurations and enforce least-privilege scope on all Host Administrator roles.
• Monitor access logs for unauthenticated requests to administrative endpoints, unexpected admin logons, and unusual process execution from the WS_FTP service, given the product's ransomware targeting history.

Black Kite's Progress WS_FTP - Nov2026 FocusTag® details critical insights on the event for TPRM professionals.

WordPress Core - Nov2026

What is this vulnerability?

WordPress 7.1.4, released October 28, 2026, fixes CVE-2026-119977 (CVSS 8.1), a time-of-check time-of-use race condition (CWE-367) in WordPress Core's full-package upgrade process. Full-package upgrades stage files in predictable, web-accessible paths, which lets an unauthenticated attacker execute code on the server during the brief upgrade window — including the window opened by applying the fix itself, since the pre-patch code performs that final upgrade. The flaw sits in WordPress Core, independent of any installed plugin or theme, and affects every release from 4.7.0 through 7.1.3.

Wordfence, which holds the CNA assignment, rates the flaw CVSS 8.1 because exploitation needs no authentication or user interaction and grants full server control; the WordPress project itself rates the same issue Low because the attack window lasts only seconds. That disagreement did not stop real-world activity: Wordfence logged its first matching attack request nine minutes after deploying a firewall rule on October 28, more than 18,500 requests in the first 21 hours, and 62,969 blocked attempts by October 30. CISA added the CVE to its KEV Catalog on November 3, 2026. No public proof-of-concept or confirmed compromise has surfaced, and EPSS sits at 0.6%, a figure that predates the KEV listing. WordPress powers roughly 39.5% of all websites, and automatic background updates mean every unpatched site opens this window on its own schedule.

Why should TPRM professionals care?

A remote code execution flaw in the software running two in five websites, now confirmed under active exploitation and listed in CISA's KEV Catalog, has an unusually wide blast radius across any vendor portfolio with a customer-facing or marketing web presence. A compromised WordPress site can be used to host malware, redirect customers to phishing pages, or serve as a pivot point into a vendor's broader network — all under the vendor's own domain and brand.

What questions should TPRM professionals ask vendors?

1. Have all WordPress Core installations, including staging, agency-managed, and containerized sites, been updated to 7.1.4 or the fixed release for their branch?
2. Did you block web access to the wp-content/upgrade/ directory before applying the update, since the upgrade to the fixed version itself passes through the vulnerable window?
3. Are any WordPress sites still running version 4.6 or earlier, which receives no security fixes and needs to be upgraded or taken offline?
4. Have you reviewed web server logs and WordPress administrator accounts for signs of compromise during past update windows?

Remediation recommendations

• Block access to wp-content/upgrade/ at the web server level before running any update, since the patch itself is applied through the same vulnerable mechanism.
• Upgrade to WordPress 7.1.4 or the fixed release for your branch, and confirm the version with wp core version and wp core verify-checksums.
• Move any installation on WordPress 4.6 or earlier to a supported release or take it offline — no fix exists for those versions.
• Preserve web server logs covering past update windows and review them for requests to wp-content/upgrade/ before patching.
• Check wp-config.php, administrator accounts, and file changes for signs of compromise, and rotate credentials if exposure looks plausible.
• Inventory every WordPress installation across staging, test, agency-managed, and containerized environments — updating a container image does not update an already-running volume.

Black Kite's WordPress Core - Nov2026 FocusTag® details critical insights on the event for TPRM professionals.

MySQL - Oct2026

What is this vulnerability?

Oracle's October 2026 Critical Patch Update, released October 20, 2026, delivered 98 new MySQL security patches, 65 of which this FocusTag® ties directly to MySQL Server. The highest-rated issue, CVE-2026-9547 (CVSS 9.8), actually originates in the curl library Oracle bundles with MySQL rather than in MySQL's own code — it is an SSH host-key validation flaw in libssh-backed SCP/SFTP transfers and is not reachable through the MySQL network listener; curl's own advisory rates the underlying issue Low, and NVD scores it 7.4. The most severe flaw in MySQL's own code is CVE-2026-101781 (CVSS 8.8), which lets an unauthenticated attacker on the same network segment take over a server running Group Replication. The remaining flaws, concentrated in InnoDB and the Optimizer, mostly require an authenticated, often privileged, account and cause denial of service.

Every CVE in this batch carries an EPSS score below 0.5%. None are listed in CISA's KEV Catalog, none are flagged as exploited in the EU Vulnerability Database, and no public proof-of-concept exists. Affected releases are MySQL Server 8.4.0–8.4.12, 9.7.0–9.7.3, and 26.7.0–26.7.1, fixed in 8.4.13, 9.7.4, and 26.10.0 respectively. MySQL 8.0 reached end of life on April 21, 2026, and receives no fix under this update.

Note: This FocusTag® tracks 65 CVEs tied to MySQL Server in this CPU. The remaining 57 flaws beyond the table above are authenticated denial-of-service issues in InnoDB, the Optimizer, Group Replication, and related components, rated CVSS 6.5 or below; the full CVE-by-CVE breakdown is available on the Black Kite platform.

Why should TPRM professionals care?

MySQL underpins a very large share of the web, from vendor-run WordPress sites to multi-tenant SaaS platforms. Even the authenticated denial-of-service flaws in this batch matter on shared hosting environments where many customer accounts hold database credentials — one tenant's compromised or malicious account can take down a database shared by others. The Group Replication takeover flaw is the one item in this batch worth tracking closely, since it needs no credentials at all for an attacker already positioned on the network.

What questions should TPRM professionals ask vendors?

1. Have your MySQL Server instances been upgraded to 8.4.13, 9.7.4, or 26.10.0, and if you run Percona Server or a managed cloud database, has your provider confirmed the October 2026 fixes are applied?
2. Do you have any MySQL instances still running 8.0 or earlier, which no longer receive security fixes from Oracle?
3. Is Group Replication enabled on any of your MySQL deployments, and if so, is that replication traffic isolated from general network access to mitigate CVE-2026-101781?
4. Are MySQL ports (3306, 33060, 33061) exposed to the internet on any of your systems?

Remediation recommendations

• Upgrade MySQL Server to 8.4.13, 9.7.4, or 26.10.0 depending on your release line, and confirm managed providers or distribution packages have shipped the October 2026 fixes.
• Plan migration off unsupported releases — MySQL 8.0, 5.7 and earlier, and superseded Innovation releases 8.1–8.3 and 9.0–9.6 — to a supported LTS or current release.
• Keep MySQL ports off the public internet; restrict access to trusted application hosts and isolate Group Replication traffic on its own network segment.
• Review database account grants, remove unused accounts, and enforce strong credentials, particularly in shared hosting and multi-tenant environments.
• Alert on unexpected mysqld crashes or restarts, repeated authentication failures, and unusual connections to replication ports.

Black Kite's MySQL - Oct2026 FocusTag® details critical insights on the event for TPRM professionals.

pgAdmin - Nov2026

What is this vulnerability?

The PostgreSQL Development Team disclosed 15 vulnerabilities in pgAdmin 4 on October 30, 2026, fixed the day before in version 9.19. The most severe, CVE-2026-116241 (CVSS 9.9), is an OS command injection in the Import/Export Data tool: a backslash inside a double-quoted identifier bypasses a parenthesis-balance check in the generated psql \copy command, letting a TO PROGRAM clause run arbitrary commands on the pgAdmin host. Exploitation only requires an authenticated user holding the Import/Export Data permission, which pgAdmin grants to non-admin users by default, plus a database session with standard_conforming_strings turned off — a setting the attacker can typically flip themselves. A public exploit for this flaw was published November 1, 2026.

The remaining 14 vulnerabilities span authentication bypass and cross-account impersonation, path traversal and TOCTOU file-access races, leakage of the pgAdmin service account's own SSH keys, Kerberos tickets, and password files to ordinary users, code execution via an untrusted search path, process-environment credential exposure, unauthorized server sharing, a session that survives a password change, and connection-string injection during materialized view refresh. None of the 15 CVEs is listed in CISA's KEV Catalog, and the PostgreSQL project has not confirmed in-the-wild exploitation of any of them beyond the published exploit for CVE-2026-116241.

Why should TPRM professionals care?

pgAdmin is the leading open-source administration tool for PostgreSQL, and server-mode deployments centralize database management for entire teams. A successful compromise does not stop at the pgAdmin host — it can expose the database credentials, SSH keys, and Kerberos tickets that the pgAdmin service account itself holds, opening a path into every database that instance manages.

What questions should TPRM professionals ask vendors?

1. Have all pgAdmin 4 server-mode and desktop deployments been upgraded to version 9.19?
2. Until fully patched, have you restricted the Import/Export Data permission to trusted administrators, given that CVE-2026-116241 relies on a permission granted to non-admins by default?
3. Is your pgAdmin web interface reachable only from trusted networks, and are shared storage directories disabled where not required?
4. Have you reviewed what SSH keys, Kerberos tickets, password files, and client certificates are accessible to the pgAdmin service account?

Remediation recommendations

• Upgrade all pgAdmin 4 server-mode and desktop deployments to version 9.19.
• Restrict the Import/Export Data permission to trusted administrators until the patch is fully rolled out.
• Limit network access to the pgAdmin web interface to trusted networks, and disable shared storage directories that aren't required.
• Audit SSH keys, Kerberos tickets, password files, and certificates reachable by the pgAdmin service account.
• Review Import/Export Data activity logs for unusual TO PROGRAM usage and check for unexpected processes spawned by the pgAdmin service account.

Black Kite's pgAdmin - Nov2026 FocusTag® details critical insights on the event for TPRM professionals.

MLflow - Nov2026

What is this vulnerability?

The MLflow project disclosed three vulnerabilities on October 27, 2026, fixed in version 3.17.0. The most severe, CVE-2026-116692 (CVSS 9.8), is an unauthenticated remote code execution flaw in MLflow's third-party GenAI scorer support: the tracking server checks only that a request-supplied module path starts with one of four allowed package prefixes, which lets an attacker upload a malicious Python module through MLflow's own artifact endpoints and trigger its execution via /ajax-api/3.0/mlflow/scorer/invoke before any trace ID validation runs. A published proof-of-concept achieved root-level code execution on the official MLflow Docker image, both locally and against a remote test instance. Because MLflow's tracking server has no authentication enabled by default, any exposed instance is reachable by anyone who can connect to its port.

CVE-2026-116690 (CVSS 7.5) is a path traversal flaw in prompt model version handling — an incomplete fix for an earlier CVE (CVE-2026-2614) validated only sources carrying a URL scheme, so a schemeless relative path is stored and later served by the artifact-download endpoint, letting an attacker read arbitrary files the MLflow server process can access, including the server's own SQLite tracking and auth databases. Honeypot networks recorded active probing of this flaw within a day of disclosure. CVE-2026-116691 (CVSS 6.5) causes mlflow.crewai.autolog() to serialize CrewAI agent objects into trace data without stripping credentials, leaking LLM provider API keys in cleartext — this requires the opt-in CrewAI autologging feature to be enabled. None of the three is in CISA's KEV Catalog, but a prior, unrelated MLflow SSRF flaw (CVE-2026-64849) was added to KEV on August 19, 2026, underscoring that MLflow tracking servers are an established target for attackers.

Why should TPRM professionals care?

MLflow tracking servers often sit inside a vendor's AI/ML development pipeline with no authentication at all, by design. An unauthenticated RCE flaw there is a direct path into whatever environment hosts the model training and experiment data, and the API key leak flaw adds a specific new risk as vendors adopt AI agent frameworks like CrewAI: credentials for third-party LLM providers can end up exposed through a logging feature that teams may not realize is capturing them.

What questions should TPRM professionals ask vendors?

1. Have all MLflow tracking server deployments been upgraded to version 3.17.0?
2. Is your MLflow tracking server reachable from the internet without authentication enabled, given that MLflow has none turned on by default?
3. If you use mlflow.crewai.autolog(), have you rotated any LLM provider API keys that were in use while running a version affected by CVE-2026-116691?
4. Does your MLflow server run as a non-root user with a read-only package directory, which blocks the file-placement chain CVE-2026-116692 depends on?

Remediation recommendations

• Upgrade all MLflow tracking server deployments to version 3.17.0.
• Enable MLflow authentication and restrict network access to the tracking server — it has no authentication by default.
• Run MLflow as a non-root user with a read-only package directory to block the file-placement chain CVE-2026-116692 relies on, even ahead of patching.
• Rotate any LLM provider API key used with mlflow.crewai.autolog() enabled on an affected version, and review the model-versions registry for anomalous or relative source paths.
• Review access logs for unexpected model-versions/create or scorer/invoke activity, and check for unfamiliar Python modules under MLflow's installed package directories.

Black Kite's MLflow - Nov2026 FocusTag® details critical insights on the event for TPRM professionals.

How TPRM Professionals Can Leverage Black Kite for These Vulnerabilities

This week's five FocusTags® present a diverse challenge for TPRM professionals: an unauthenticated credential-theft chain on managed file transfer infrastructure, a race-condition RCE already in CISA's KEV Catalog affecting the world's most common CMS, a 65-CVE patch cycle in the database layer underpinning much of the web, a critical command-injection flaw in the leading PostgreSQL administration tool, and a pair of unauthenticated RCE and credential-leak flaws in an AI/ML platform that ships with no authentication by default. Black Kite's platform addresses each of these with distinct detection capabilities.

For Progress WS_FTP, Black Kite's FocusTag® identifies internet-exposed WS_FTP Server instances by version and flags administrative consoles reachable from the internet as the highest-priority subset within that population — critical given that the credential-theft flaw requires no authentication and the product line carries a documented history of rapid ransomware weaponization. For WordPress Core, where the affected install base spans roughly two in five websites across dozens of version branches, Black Kite's version-aware detection pinpoints which vendors in a portfolio run a confirmed-vulnerable, internet-facing release, rather than treating the entire WordPress ecosystem as equally at risk.

For MySQL, Black Kite's Shodan-based fingerprinting of the server handshake banner identifies internet-exposed instances across the affected 8.4, 9.7, and 26.7 ranges and flags the subset exposing Group Replication ports, where the one unauthenticated flaw in this batch applies. For pgAdmin, Black Kite's favicon-based version fingerprinting identifies exposed instances down to the exact build — roughly 5,541 hosts confirmed across 80 vulnerable versions — a level of precision that matters given a public exploit already exists for the most severe flaw. For MLflow, because the product exposes no version information to passive scanning, Black Kite actively confirmed exposure host by host against each instance's /version endpoint, surfacing 162 confirmed-vulnerable internet-facing tracking servers that passive detection alone would have missed.

The Bridge™ connector enables automated questionnaire dispatch to all five FocusTag® vendor populations simultaneously, converting five parallel engagement workstreams spanning file transfer infrastructure, a CMS, two database layers, and an AI/ML platform into a single coordinated workflow.

Strengthening TPRM Outcomes with Black Kite's FocusTags®

This week's five-tag release illustrates how Black Kite's FocusTags® address scenarios that range from a single CVE already confirmed under active exploitation to a 65-CVE patch batch and default-unauthenticated AI/ML tooling.

• Ransomware-Pattern Early Warning: WS_FTP Server's credential-theft chain lands in a product line with a documented history of rapid ransomware weaponization. FocusTags® let TPRM teams flag internet-exposed WS_FTP vendors immediately, rather than waiting for a confirmed exploitation event to prioritize outreach.
• Mass-Scale CMS Exposure Prioritization: WordPress Core's CVE-2026-119977 is already listed in CISA's KEV Catalog and under active exploitation, yet the affected install base spans roughly two in five websites globally. FocusTags® let TPRM teams identify which vendors in their own portfolio run a confirmed-vulnerable, internet-facing WordPress Core version, rather than treating the entire WordPress ecosystem as equally at risk.
• Large-Batch Patch Tracking: Oracle's October Critical Patch Update closed 65 MySQL Server issues in a single release. FocusTags® consolidate that batch into a single vendor-exposure view, letting TPRM teams track patch currency across a large CVE set without manually reconciling dozens of advisories per vendor.
• Version-Precise Admin Tool Detection: pgAdmin's exact-version fingerprinting lets TPRM teams distinguish vendors already on the fixed 9.19 release from the roughly 5,541 hosts still running one of 80 vulnerable versions, which matters given the public exploit already available for the most severe flaw.
• Default-Unauthenticated AI Tooling Visibility: MLflow tracking servers carry no authentication by default, and the version isn't visible to passive scanning. FocusTags® close that visibility gap with active, per-host confirmation — surfacing AI/ML infrastructure risk that standard TPRM inventories, built around application-layer assets, typically miss.
• The Bridge™: Coordinated Multi-Tag Engagement: With five FocusTag® activations spanning file transfer infrastructure, a CMS, two database layers, and an AI/ML platform in a single week, The Bridge™ connector dispatches questionnaires to all five affected vendor populations as one coordinated workflow instead of five separate outreach efforts.

FocusTags® in the Last 30 Days

• Progress WS_FTP - Nov2026: CVE-2026-84295, CVE-2026-90868, and 6 additional CVEs — Unauthenticated Administrative Credential Theft and OS Command Injection in Progress WS_FTP Server
• WordPress Core - Nov2026: CVE-2026-119977 — Unauthenticated Race-Condition Remote Code Execution in WordPress Core
• MySQL - Oct2026: CVE-2026-9547, CVE-2026-101781, and 63 additional CVEs — Critical Bundled-curl Flaw and Group Replication Takeover in MySQL Server
• pgAdmin - Nov2026: CVE-2026-116241, CVE-2026-116238, and 13 additional CVEs — Critical OS Command Injection in pgAdmin
• MLflow - Nov2026: CVE-2026-116692, CVE-2026-116690, CVE-2026-116691 — Unauthenticated Remote Code Execution and API Key Disclosure in MLflow
• php2shell: CVE-2026-109618, CVE-2026-109619 — Two Critical Use-After-Free RCEs in PHP Core
• Plex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 — Four-CVE Unauthenticated RCE Exploit Chain in Plex Media Server
• PAN-OS - Oct2026: CVE-2026-0322 — Code Injection in PAN-OS Management Interface
• Drupal Core: CVE-2026-108097, CVE-2026-108515, CVE-2026-108514 — Critical RCE in Drupal Field UI Module
• GitLab - Oct2026: CVE-2026-110264, CVE-2026-97229, CVE-2026-90970, CVE-2026-16301, CVE-2026-14814, CVE-2026-112212 — Unauthenticated RCE and Cache-Poisoning Vulnerabilities in GitLab CE/EE
• Oracle WebLogic - Oct2026: CVE-2026-91323, CVE-2026-87302, CVE-2026-91502, CVE-2026-101515 — Unauthenticated Full Server Takeover in Oracle WebLogic Server
• BeyondTrust Remote Support - Oct2026: CVE-2026-102764 — Authentication Bypass by Spoofing in BeyondTrust Remote Support
• Fortinet - Oct2026 [Suspected]: CVE-2026-104286, CVE-2026-106173 — Path Traversal and Unauthenticated RCE in FortiMail and FortiSIEM
• Apache Tomcat - Oct2026: CVE-2026-101356, CVE-2026-101296, CVE-2026-34483, CVE-2026-65182 — HTTP/2 Request/Response Mix-up and Authentication Bypass in Apache Tomcat
• Citrix NetScaler - Oct2026: CVE-2026-107406, CVE-2026-88771, CVE-2026-88772, CVE-2026-3055, CVE-2026-4368 — Memory Overflow and Session-Mixup Vulnerabilities in Citrix NetScaler
• ONLYOFFICE Docs: CVE-2021-3199 — Path Traversal to Remote Code Execution in ONLYOFFICE Docs Server
• MSSQL - Oct2026: CVE-2026-94512, CVE-2026-65674, and 20 additional CVEs — Heap Buffer Overflow and Deserialization RCE in Microsoft SQL Server
• Exchange Server - Oct2026 (Latest): CVE-2026-70279, CVE-2026-70571, CVE-2026-77910, CVE-2026-87692, CVE-2026-87695, CVE-2026-87696 — Unauthenticated Stack Buffer Overflow RCE in Microsoft Exchange Server
• SharePoint - Oct2026: CVE-2026-85900, CVE-2026-88155, and 34 additional CVEs — Largest Disclosure Batch on Record, Including Crypto Signature Bypass, in Microsoft SharePoint
• NGINX UI: CVE-2026-107806, CVE-2026-42238 — Unauthenticated and Authenticated RCE in NGINX UI Backup Restore Pipeline
• MariaDB - Oct2026: CVE-2026-107815, CVE-2026-107818, CVE-2026-107814, and 6 additional CVEs — Stack Out-of-Bounds Write and TLS Validation Bypass in MariaDB
• ProFTPD - Oct2026: CVE-2015-3306 — Unauthenticated Arbitrary File Read/Write via mod_copy in ProFTPD
• Citrix NetScaler - Oct2026 (Latest): CVE-2025-6543, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-88778 — Memory Overflow in Gateway Mode Requiring a New Build in Citrix NetScaler
• SonicWall SMA1000 - Oct2026: CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, CVE-2026-83548, CVE-2026-83549 — Zip Slip and Stored XSS Extending the Pre-Auth SSRF/RCE Chain in SonicWall SMA1000
• Exchange Server - Oct2026: CVE-2026-96940 — Weak Authorization Enabling Privilege Escalation in Microsoft Exchange Server
• Cisco NX-OS - Oct2026: CVE-2026-76471, and 6 additional CVEs — Unauthenticated Root-Level RCE via NX-API in Cisco NX-OS
• Atlassian - Oct2026: CVE-2026-21589 — Critical Cross-Product Vulnerability in Atlassian Data Center Products
• Langflow - Oct2026: CVE-2026-104334, CVE-2026-93674, and 19 additional CVEs — Unauthenticated and Authenticated RCE Vulnerabilities in Langflow OSS
• Elastic - Oct2026: CVE-2026-102406, CVE-2026-103007, CVE-2026-103009, and 5 additional CVEs — Cross-Tenant Authorization Bypass and Privilege Escalation in Elastic Kibana and Elasticsearch
• Kiteworks: Precautionary Shutdown Advisory Following a Federal Intelligence Warning for Kiteworks

References

https://www.cve.org/CVERecord?id=CVE-2026-84295

https://www.cve.org/CVERecord?id=CVE-2026-90868

https://www.cve.org/CVERecord?id=CVE-2026-90863

https://www.cve.org/CVERecord?id=CVE-2026-90864

https://www.cve.org/CVERecord?id=CVE-2026-90866

https://www.cve.org/CVERecord?id=CVE-2026-90865

https://www.cve.org/CVERecord?id=CVE-2026-90867

https://www.cve.org/CVERecord?id=CVE-2026-84294

https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

https://nvd.nist.gov/vuln/detail/CVE-2026-119977

https://www.cve.org/CVERecord?id=CVE-2026-119977

https://wordpress.org/news/2026/10/wordpress-7-1-4/

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114575

https://dev.mysql.com/community/security/advisories/2026-10-20/

https://www.oracle.com/security-alerts/cpuoct2026.html

https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-13.html

https://curl.se/docs/CVE-2026-9547.html

https://nvd.nist.gov/vuln/detail/CVE-2026-9547

https://nvd.nist.gov/vuln/detail/CVE-2026-101781

https://securityonline.info/oracle-mysql-vulnerabilities-october-2026/

https://nvd.nist.gov/vuln/detail/CVE-2026-116241

https://www.cve.org/CVERecord?id=CVE-2026-116241

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-116241

https://www.pgadmin.org/docs/pgadmin4/9.19/release_notes_9_19.html

https://www.postgresql.org/about/news/pgadmin-4-v919-released-3426/

https://www.strix.ai/cve/CVE-2026-116241

https://nvd.nist.gov/vuln/detail/CVE-2026-116690

https://nvd.nist.gov/vuln/detail/CVE-2026-116691

https://nvd.nist.gov/vuln/detail/CVE-2026-116692

https://github.com/advisories/GHSA-m65p-9j7q-6w33

https://github.com/advisories/GHSA-j7qq-vr8c-xvw3

https://github.com/advisories/GHSA-26p8-2jq9-3vq9

https://github.com/mlflow/mlflow/releases/tag/v3.17.0

https://securityonline.info/mlflow-vulnerability-exploited-poc/