IBM, the CVE numbering authority for Langflow OSS, published a security bulletin on 28 October 2026 (updated 29 October) saying Langflow OSS 1.0.0 through 1.12.8 is affected by vulnerabilities that could allow a remote attacker to bypass authentication controls, execute arbitrary code, expose API credentials, or disclose information through vulnerable dependencies. IBM lists an incomplete remediation of an auto-login security control, agentic code execution via a third-party library, operator-injected API key exposure reachable without intended authorization, and unauthenticated remote code execution exploitable through model context protocol (MCP) tool enumeration. The Langflow entries are CVE-2026-93680 (improper authentication, 9.8), CVE-2026-110186 (code injection, 9.8), CVE-2026-110193 (a low-privileged authenticated user can make the Agentic Assistant generate or submit component code that runs operating system commands on the server, 8.8) and CVE-2026-110192 (insufficiently protected credentials, 6.5); the bulletin also lists three Hono framework flaws (CVE-2026-84363, CVE-2026-84364, CVE-2026-84365; 5.3 to 6.5, fixed in Hono 4.13.5) among the open-source dependencies included in the product. IBM lists no workarounds or mitigations. This is a separate fix from IBM's 2 October Langflow bulletin already on Cyberstack (fixed in 1.12.3), so 1.12.x installs up to 1.12.8 are affected. (source: IBM) Correction (02 Nov 2026): removed The Hacker News as a source; the card now rests on IBM's 28 Oct bulletin and the CVE records carrying CISA's 30 Oct assessment. (source: IBM; CVE records)
IBM — Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (28 Oct 2026, updated 29 Oct 2026)
Canonical said in a security advisory dated 28 October 2026 that a critical vulnerability affecting LXD and MicroCloud, referred to it by the Incus project, allows an attacker able to reach the LXD HTTPS API to authenticate as any trusted TLS client for which the attacker has the public certificate. Canonical says the mutual TLS authentication logic compared all certificates sent by the client against the trust store, although only the leaf certificate proves ownership of the signing key, so an attacker could place a trusted client's public certificate as an intermediate certificate in the chain. In MicroCloud, Canonical says an attacker can intercept the public TLS certificate of a joining cluster member and then authenticate as that member, and that depending on the privilege of the impersonated user the attacker may gain root access to the host machine. Canonical urges all LXD and MicroCloud users to update immediately and says the LXD point releases are in progressive roll-out from candidate to stable. (source: Canonical) The CVE record, published by Canonical as CNA, lists affected LXD versions 4.0.14, 5.0.10, 5.21.8 and 6.9 before 4.0.15, 5.0.11, 5.21.9 and 6.10.1, rates the flaw CVSS 4.0 10.0 (Critical), and carries a CISA assessment dated 30 October 2026 of exploitation: none. (source: CVE record) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Ubuntu Discourse; CVE record)
Ubuntu Discourse — Security advisory: Critical vulnerability found in Canonical LXD and MicroCloud (28 Oct 2026)
The Drupal Security Team published advisory SA-CONTRIB-2026-254 on 28 October 2026 for Commerce Core, the Drupal module for selling goods and services through a shopping cart and checkout form or through decoupled applications via APIs. Drupal says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor", tracked as CVE-2026-118539, and that "this vulnerability is being actively exploited in the wild." It rates the advisory Highly critical (Drupal risk score 21/25) and lists affected versions as <2.41 and >=3.0.0 <3.3.13. Drupal says sites on 3.x should upgrade to Commerce Core 3.3.13, sites on earlier versions to Commerce Core 8.x-2.41, and that sites should audit their orders for inconsistencies. It credits Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the flaw. (source: Drupal) UPDATE (31 Oct 2026): The CVE record for CVE-2026-118539, with Drupal as CNA, was published on 30 October (11:09 am Perth). It describes a missing authorization vulnerability in Commerce Core that allows forceful browsing, affecting versions before 2.41 and from 3.0.0 before 3.3.13. Drupal gives no CVSS score in the record; CISA's ADP enrichment, added at 11:56 am Perth on 31 October, scores it CVSS 3.1 6.5 (Medium) and lists exploitation as 'none' as of 30 October, while Drupal's advisory says the flaw is being actively exploited. CVE-2026-118539 was not in CISA's KEV catalog as of its 30 October release (version 2026.10.30). (source: CVE-2026-118539 record (cve.org)) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Drupal; CVE record)
WordPress.org released WordPress 7.1.4 on 28 October 2026 as a security release and recommends that sites update immediately; sites with automatic background updates will update automatically. The release post credits reporters for: a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (Umut Bayram); several stored cross-site scripting (XSS) bugs, including in specially crafted block markup, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, Privacy Data Removal Requests and specially crafted user logins (the last two reported by Anthropic); a stored denial-of-service issue in the Interactivity API; unpublished Customizer changesets that unauthenticated users can discover; and Notes that privileged users can read without access to edit the attached post. The release also updates the bundled root certificates because of the eMudhra revocation. WordPress says the security fixes are being backported to all branches eligible for security fixes (currently back to 4.7) and will ship as they become ready, and that WordPress 7.2 Beta 3 contains all applicable fixes. The post does not give CVE numbers or severity scores and does not say any of the flaws is being exploited. (source: WordPress.org) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: WordPress.org)
WordPress.org News — WordPress 7.1.4 (28 Oct 2026)
Sophos published an advisory on 28 October 2026, rated Critical, for CVE-2026-118633, a path traversal vulnerability in Sophos UTM reported through its bug bounty program by external researcher Sam Pizzey. Sophos says the fix prevents an unauthenticated remote adversary from executing arbitrary commands with root privileges after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos says all versions of Sophos UTM are affected, that UTM is end-of-life and the patch must be installed manually, and that urgent customer action is required: customers still using Email Protection features on UTM should apply the patch as soon as possible. Sophos lists no workaround and recommends upgrading to a supported version of Sophos Firewall. Sophos's CVE record scores the flaw 9.2 (CVSS 4.0, Critical) and 8.1 (CVSS 3.1, High) and lists SG UTM versions up to and including 9.724 as affected. The advisory does not mention exploitation. (source: Sophos)
Sophos — Resolved Pre-Auth RCE Vulnerability in Sophos UTM (CVE-2026-118633) (sophos-sa-20261028-utm-rce, 28 Oct 2026)
Cisco's security advisory for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk; first published 25 February 2026; version 2.1, last updated 28 October 21:54 GMT, which is 29 October 05:54 Perth) says a vulnerability in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges; it says the Cisco PSIRT is aware of limited exploitation, lists no workarounds and now refers customers to a Talos post. (source: Cisco) Cisco Talos said on 28 October 2026 that it has identified UAT-11473, which it describes as a highly sophisticated advanced persistent threat actor, exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller instances, to gain unauthorized access and then install a custom malware framework it tracks as KeyDrift. Talos describes its post as an analysis of historical UAT-11473 activity and does not give dates for the intrusions. According to Talos, KeyDrift's primary component, PolyFlame, is a memory-resident module deployed through modified runit service paths and injected into legitimate vdaemon processes, where it can act as a TinyShell-style backdoor or as an intermediate command-and-control relay; another component, LittleFilch, hooks SSL_read inside vdaemon, extracts keying material for a list of predefined edge nodes (which Talos assesses as OMP-distributed AES-256 IPsec data-plane key material) and stages it RSA-encrypted in /var/tmp/vdaemon.bin for exfiltration. Talos says observed targeting spans space and satellite services, defense and aerospace technology, and policy research, and assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network (see the Silent Train card). Talos published Snort rules 67387 through 67416 (Snort 2) and 7:44 through 7:73 (Snort 3) for the KeyDrift artifacts; SIDs 65938 and 65958 already cover the CVE itself. (source: Cisco Talos) CISA has listed CVE-2026-20127 in its Known Exploited Vulnerabilities catalog since 25 February 2026. (source: CISA KEV)
Cisco Security Advisory — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk; first published 25 Feb 2026, v2.1 updated 28 Oct 2026 GMT)
CISA added CVE-2026-41709, a Broadcom VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October 2026 based on evidence of active exploitation; the KEV entry gives US federal agencies a due date of 11 November and lists known ransomware campaign use as 'Unknown'. Broadcom's advisory VMSA-2026-0006 (issued 29 July 2026, updated 19 August) says VMware ESX contains an insufficient logging vulnerability that a malicious administrator could exploit to perform certain operations without them being logged; Broadcom rates it Low severity with a maximum CVSSv3 base score of 2.7 and credits Ian Barton of CrowdStrike for reporting it. Broadcom lists no workaround. The same advisory also covers the critical vCenter flaws CVE-2026-59309 and CVE-2026-59310 (see the CVE-2026-59310 card). CISA's alert does not say who exploited the flaw or how. UPDATE (29 Oct 2026, Perth; CrowdStrike): In a blog post dated 28 October on its 2026 Legal Threat Landscape Report, CrowdStrike says the China-nexus adversary it tracks as WARP PANDA deployed several forms of malware in victims' VMware vCenter environments in multiple intrusions at US-based entities, including targets in the legal sector, and that in several of these cases, and as late as early 2026, it exploited CVE-2026-41709, which CrowdStrike calls an ESXi command logging bypass vulnerability, as a zero-day. CISA's KEV entry does not name an actor. (source: CrowdStrike)
TeamViewer published security bulletin TV-2026-1011 on 27 October 2026 (last updated 28 October), rated Important with CVSS scores up to 8.8 (High), fixing three flaws in TeamViewer clients in version 15.83. TeamViewer says CVE-2026-111585 (CVSS 3.1 8.8) is an integer overflow in the remote-control screen processing of the Full Client, Portable and Remote Control App before 15.83 that may let a malicious remote host cause a denial of service or, depending on the platform, potentially execute arbitrary code with the viewer's privileges; exploitation requires a user to start a remote-control session to an attacker-controlled or compromised host. The bulletin also fixes CVE-2026-92372 (CVSS 8.8), an out-of-bounds write in the screen-image decoder of the Full Client for Linux and macOS that can allow remote code execution through crafted screen-image data in a session or a crafted .tvs session recording, and CVE-2026-92374 (CVSS 7.8), a race condition in the macOS privileged helper of the Full Client and Host that can give a local low-privileged attacker root. TeamViewer says it was not aware of active exploitation at the time of publication. Researcher Remedio, which reported CVE-2026-111585, says the attack works in the default configuration once the session is accepted, and that on Windows it went from a repeatable crash to running code of its choosing in the viewer. A companion bulletin, TV-2026-1012, fixes six local privilege escalation flaws (up to CVSS 7.8) in TeamViewer's Remote Management add-ons. (sources: TeamViewer; Remedio) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: TeamViewer; Remedio)
TeamViewer — TV-2026-1011 Security Update for Vulnerabilities in TeamViewer Clients (issued 27 Oct 2026, updated 28 Oct)
WatchGuard published 17 Fireware OS security advisories on 27 October 2026, seven of them with CVSS 4.0 scores of 9.0 or higher in WatchGuard's CVE records. CVE-2026-93857 (9.2): a stack-based buffer overflow in Fireware OS's SIP proxy lets a remote, unauthenticated attacker execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy. CVE-2026-93866 (9.2): an integer overflow in the WebSocket connection handling used by the Access Portal lets a remote, unauthenticated attacker write beyond the bounds of a heap buffer while the Access Portal feature is enabled. CVE-2026-93865 (9.2): missing authentication in the FireCluster synchronization daemon lets a remote, unauthenticated attacker invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when clustering is enabled. CVE-2026-112709 and CVE-2026-112710 (9.2 each): heap-based buffer overflows in the authentication service let an attacker who controls or intercepts traffic to the configured Active Directory server cause a denial of service and potentially execute arbitrary code. CVE-2026-103594 (9.5): a stack-based buffer overflow in WireGuard configuration processing on Fireboxes configured as a FireCloud Gateway, exploitable by an attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud. CVE-2026-103593 (9.1): a stack-based buffer overflow in the logging service on Fireboxes in FIPS mode with an external log server, exploitable by an attacker who can impersonate or intercept traffic to the log server. For each of these seven, WatchGuard says it is not aware of any exploitation in the wild. The same day WatchGuard also published a Mobile VPN with SSL Client for Windows advisory (CVE-2026-115495, 5.7). (source: WatchGuard PSIRT)
WatchGuard — Security Advisories: Published WatchGuard CVEs and advisories
Adobe's security bulletin APSB26-162, published 27 October 2026, says Adobe has released a priority 2 security update for Adobe Campaign Classic that addresses vulnerabilities rated critical that could result in arbitrary code execution, security feature bypass and privilege escalation. The bulletin lists ACC v7 7.4.4 build 9402 and earlier on Windows and Linux as affected, and ACC v7 7.4.4 build 9403 as the updated version. All eight CVEs are rated Critical by Adobe: CVE-2026-104351 (code injection, CVSS 9.9), CVE-2026-104353 (OS command injection, 9.9) and CVE-2026-105780 (incorrect authorization, 9.9), each with arbitrary code execution as the impact; CVE-2026-105489 (SQL injection, 9.9), CVE-2026-105781 (SQL injection, 9.8 in Adobe's bulletin, with a vector that requires no privileges; 10.0 in Adobe's CVE record, published 27 October 2026, 17:03 UTC, 28 October 1:03 am AWST), CVE-2026-104354 (SQL injection, 9.1) and CVE-2026-105779 (SQL injection, 9.1), each with security feature bypass as the impact; and CVE-2026-104350 (reflected cross-site scripting, 9.3) with privilege escalation as the impact. Adobe says it is not aware of any exploits in the wild for any of the issues addressed in this update. Correction (29 Oct 2026): CVE-2026-105781 now shows both of Adobe's scores: 9.8 in bulletin APSB26-162 and 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) in the CVE record Adobe published. (sources: Adobe; CVE record) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Adobe; CVE record)
Adobe Security Bulletin — Security update available for Adobe Campaign Classic | APSB26-162 (27 Oct 2026)
Google's Chrome Releases blog says the Stable channel was updated on 27 October 2026 to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux, rolling out over the coming days and weeks, with 52 security fixes: four Critical, 46 High and two Medium. The Critical bugs are CVE-2026-118306 (memory corruption in FileSystem) and CVE-2026-118331 (improper input validation in FileAPI), both reported by Xinyang Ge (Anthropic), assisted by Claude, and CVE-2026-118348 (improper input validation in Skia) and CVE-2026-118344 (use-after-free in Layout), both reported by Xinyang Ge. High-rated fixes include use-after-free and memory-corruption bugs in V8, Turbolev, ANGLE, Skia, PDFium, SVG, Media and FileSystem; Google is credited with 20 of the 52 bugs, and four High bugs are credited to OpenAI Codex Security. Google does not say any of the flaws is exploited and does not publish CVSS scores; bug details stay restricted until most users have updated. Chrome 156.0.8078.73 for Android, released the same day, carries the same security fixes as desktop. This follows the Chrome 156 Stable release (156.0.8078.47/.48, 20 October), which is a separate card. (source: Chrome Releases) Correction (30 Oct 2026): the number of fixes credited to Google now matches the Chrome Releases post. (source: Chrome Releases)
Chrome Releases — Stable Channel Update for Desktop, Chrome 156.0.8078.73/.74 (27 Oct 2026)
CISA added CVE-2026-48356, an unrestricted upload of file with dangerous type flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a remediation due date of 10 November 2026 for US federal agencies; CISA lists known ransomware use as Unknown and points to Adobe bulletin APSB26-73. According to the CVE record from Adobe (published 14 July 2026), the flaw could result in arbitrary code execution in the context of the current user, exploitation requires user interaction (a victim visiting a crafted URL or interacting with a compromised page), and the scope is changed. The record lists Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events 1.20.0 and earlier as affected. Adobe's own bulletin APSB26-73 (published 14 July 2026) rates CVE-2026-48356 Critical with a CVSS 3.1 base score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L), lists its impact as privilege escalation and says no authentication is required to exploit it; the CVE record gives 9.3 and arbitrary code execution. Both are shown here as each source states them. Correction (28 Oct 2026): Adobe's bulletin APSB26-73, which was unreadable on the previous pass, is now readable and gives a CVSS score of 9.6 with privilege escalation as the impact, while the CVE record gives 9.3 and arbitrary code execution; the card now shows both, each credited. (source: Adobe)
CISA Known Exploited Vulnerabilities Catalog — CVE-2026-48356 (added 27 Oct 2026)
