IBM, the CVE numbering authority for Langflow OSS, published a security bulletin on 28 October 2026 (updated 29 October) saying Langflow OSS 1.0.0 through 1.12.8 is affected by vulnerabilities that could allow a remote attacker to bypass authentication controls, execute arbitrary code, expose API credentials, or disclose information through vulnerable dependencies. IBM lists an incomplete remediation of an auto-login security control, agentic code execution via a third-party library, operator-injected API key exposure reachable without intended authorization, and unauthenticated remote code execution exploitable through model context protocol (MCP) tool enumeration. The Langflow entries are CVE-2026-93680 (improper authentication, 9.8), CVE-2026-110186 (code injection, 9.8), CVE-2026-110193 (a low-privileged authenticated user can make the Agentic Assistant generate or submit component code that runs operating system commands on the server, 8.8) and CVE-2026-110192 (insufficiently protected credentials, 6.5); the bulletin also lists three Hono framework flaws (CVE-2026-84363, CVE-2026-84364, CVE-2026-84365; 5.3 to 6.5, fixed in Hono 4.13.5) among the open-source dependencies included in the product. IBM lists no workarounds or mitigations. This is a separate fix from IBM's 2 October Langflow bulletin already on Cyberstack (fixed in 1.12.3), so 1.12.x installs up to 1.12.8 are affected. (source: IBM) Correction (02 Nov 2026): removed The Hacker News as a source; the card now rests on IBM's 28 Oct bulletin and the CVE records carrying CISA's 30 Oct assessment. (source: IBM; CVE records)
IBM — Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (28 Oct 2026, updated 29 Oct 2026)
Canonical said in a security advisory dated 28 October 2026 that a critical vulnerability affecting LXD and MicroCloud, referred to it by the Incus project, allows an attacker able to reach the LXD HTTPS API to authenticate as any trusted TLS client for which the attacker has the public certificate. Canonical says the mutual TLS authentication logic compared all certificates sent by the client against the trust store, although only the leaf certificate proves ownership of the signing key, so an attacker could place a trusted client's public certificate as an intermediate certificate in the chain. In MicroCloud, Canonical says an attacker can intercept the public TLS certificate of a joining cluster member and then authenticate as that member, and that depending on the privilege of the impersonated user the attacker may gain root access to the host machine. Canonical urges all LXD and MicroCloud users to update immediately and says the LXD point releases are in progressive roll-out from candidate to stable. (source: Canonical) The CVE record, published by Canonical as CNA, lists affected LXD versions 4.0.14, 5.0.10, 5.21.8 and 6.9 before 4.0.15, 5.0.11, 5.21.9 and 6.10.1, rates the flaw CVSS 4.0 10.0 (Critical), and carries a CISA assessment dated 30 October 2026 of exploitation: none. (source: CVE record) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Ubuntu Discourse; CVE record)
Ubuntu Discourse — Security advisory: Critical vulnerability found in Canonical LXD and MicroCloud (28 Oct 2026)
The Drupal Security Team published advisory SA-CONTRIB-2026-254 on 28 October 2026 for Commerce Core, the Drupal module for selling goods and services through a shopping cart and checkout form or through decoupled applications via APIs. Drupal says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor", tracked as CVE-2026-118539, and that "this vulnerability is being actively exploited in the wild." It rates the advisory Highly critical (Drupal risk score 21/25) and lists affected versions as <2.41 and >=3.0.0 <3.3.13. Drupal says sites on 3.x should upgrade to Commerce Core 3.3.13, sites on earlier versions to Commerce Core 8.x-2.41, and that sites should audit their orders for inconsistencies. It credits Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the flaw. (source: Drupal) UPDATE (31 Oct 2026): The CVE record for CVE-2026-118539, with Drupal as CNA, was published on 30 October (11:09 am Perth). It describes a missing authorization vulnerability in Commerce Core that allows forceful browsing, affecting versions before 2.41 and from 3.0.0 before 3.3.13. Drupal gives no CVSS score in the record; CISA's ADP enrichment, added at 11:56 am Perth on 31 October, scores it CVSS 3.1 6.5 (Medium) and lists exploitation as 'none' as of 30 October, while Drupal's advisory says the flaw is being actively exploited. CVE-2026-118539 was not in CISA's KEV catalog as of its 30 October release (version 2026.10.30). (source: CVE-2026-118539 record (cve.org)) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Drupal; CVE record)
WordPress.org released WordPress 7.1.4 on 28 October 2026 as a security release and recommends that sites update immediately; sites with automatic background updates will update automatically. The release post credits reporters for: a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (Umut Bayram); several stored cross-site scripting (XSS) bugs, including in specially crafted block markup, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, Privacy Data Removal Requests and specially crafted user logins (the last two reported by Anthropic); a stored denial-of-service issue in the Interactivity API; unpublished Customizer changesets that unauthenticated users can discover; and Notes that privileged users can read without access to edit the attached post. The release also updates the bundled root certificates because of the eMudhra revocation. WordPress says the security fixes are being backported to all branches eligible for security fixes (currently back to 4.7) and will ship as they become ready, and that WordPress 7.2 Beta 3 contains all applicable fixes. The post does not give CVE numbers or severity scores and does not say any of the flaws is being exploited. (source: WordPress.org) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: WordPress.org)
WordPress.org News — WordPress 7.1.4 (28 Oct 2026)
Sophos published an advisory on 28 October 2026, rated Critical, for CVE-2026-118633, a path traversal vulnerability in Sophos UTM reported through its bug bounty program by external researcher Sam Pizzey. Sophos says the fix prevents an unauthenticated remote adversary from executing arbitrary commands with root privileges after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos says all versions of Sophos UTM are affected, that UTM is end-of-life and the patch must be installed manually, and that urgent customer action is required: customers still using Email Protection features on UTM should apply the patch as soon as possible. Sophos lists no workaround and recommends upgrading to a supported version of Sophos Firewall. Sophos's CVE record scores the flaw 9.2 (CVSS 4.0, Critical) and 8.1 (CVSS 3.1, High) and lists SG UTM versions up to and including 9.724 as affected. The advisory does not mention exploitation. (source: Sophos)
Sophos — Resolved Pre-Auth RCE Vulnerability in Sophos UTM (CVE-2026-118633) (sophos-sa-20261028-utm-rce, 28 Oct 2026)
Cisco's security advisory for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk; first published 25 February 2026; version 2.1, last updated 28 October 21:54 GMT, which is 29 October 05:54 Perth) says a vulnerability in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges; it says the Cisco PSIRT is aware of limited exploitation, lists no workarounds and now refers customers to a Talos post. (source: Cisco) Cisco Talos said on 28 October 2026 that it has identified UAT-11473, which it describes as a highly sophisticated advanced persistent threat actor, exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller instances, to gain unauthorized access and then install a custom malware framework it tracks as KeyDrift. Talos describes its post as an analysis of historical UAT-11473 activity and does not give dates for the intrusions. According to Talos, KeyDrift's primary component, PolyFlame, is a memory-resident module deployed through modified runit service paths and injected into legitimate vdaemon processes, where it can act as a TinyShell-style backdoor or as an intermediate command-and-control relay; another component, LittleFilch, hooks SSL_read inside vdaemon, extracts keying material for a list of predefined edge nodes (which Talos assesses as OMP-distributed AES-256 IPsec data-plane key material) and stages it RSA-encrypted in /var/tmp/vdaemon.bin for exfiltration. Talos says observed targeting spans space and satellite services, defense and aerospace technology, and policy research, and assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network (see the Silent Train card). Talos published Snort rules 67387 through 67416 (Snort 2) and 7:44 through 7:73 (Snort 3) for the KeyDrift artifacts; SIDs 65938 and 65958 already cover the CVE itself. (source: Cisco Talos) CISA has listed CVE-2026-20127 in its Known Exploited Vulnerabilities catalog since 25 February 2026. (source: CISA KEV)
Cisco Security Advisory — Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (cisco-sa-sdwan-rpa-EHchtZk; first published 25 Feb 2026, v2.1 updated 28 Oct 2026 GMT)
CISA added CVE-2026-41709, a Broadcom VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October 2026 based on evidence of active exploitation; the KEV entry gives US federal agencies a due date of 11 November and lists known ransomware campaign use as 'Unknown'. Broadcom's advisory VMSA-2026-0006 (issued 29 July 2026, updated 19 August) says VMware ESX contains an insufficient logging vulnerability that a malicious administrator could exploit to perform certain operations without them being logged; Broadcom rates it Low severity with a maximum CVSSv3 base score of 2.7 and credits Ian Barton of CrowdStrike for reporting it. Broadcom lists no workaround. The same advisory also covers the critical vCenter flaws CVE-2026-59309 and CVE-2026-59310 (see the CVE-2026-59310 card). CISA's alert does not say who exploited the flaw or how. UPDATE (29 Oct 2026, Perth; CrowdStrike): In a blog post dated 28 October on its 2026 Legal Threat Landscape Report, CrowdStrike says the China-nexus adversary it tracks as WARP PANDA deployed several forms of malware in victims' VMware vCenter environments in multiple intrusions at US-based entities, including targets in the legal sector, and that in several of these cases, and as late as early 2026, it exploited CVE-2026-41709, which CrowdStrike calls an ESXi command logging bypass vulnerability, as a zero-day. CISA's KEV entry does not name an actor. (source: CrowdStrike)
