Weekly Vulnerability Report: Oct 5 – Oct 11, 2026
25 new CVEs were published, 13 of them rated critical or high. 5 were added to CISA's exploited list.
Between October 5, 2026 and October 11, 2026, 25 new vulnerabilities were published, 4% more than the previous week (24). 13 of them, or 52%, were rated high or critical. The busiest day was October 7, 2026, with 11 CVEs.
CISA confirmed active exploitation of 5 vulnerabilities during the week. These are listed first below because attackers are already using them. Veeam had the most new CVEs (3), and improper neutralization of input during web page generation was the most common weakness type (6).
Confirmed exploited this week
- 10.0 High severity
ProFTPD Improper Access Control Exploited
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
- 7.8 High severity
ISC BIND Data Processing Errors Exploited
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
- 8.1 High severity
Apache Struts Command Injection Exploited
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
- 9.8 Critical severity
ONLYOFFICE Docs Server Path Traversal Exploited
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
- 4.9 Medium severity
Strapi Cleartext Storage of Sensitive Information Exploited
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the a
The 3 most important new vulnerabilities
- 7.5 High severity
Atlassian Multiple Products Files or Directories Accessible to External Parties Exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenti
- 8.8 High severity
AWP Classifieds: Unrestricted Upload of File with Dangerous Type
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upl
- 7.1 High severity
Adsmonetizer: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 6 | 24% |
| High | 7 | 28% |
| Medium | 12 | 48% |
| Low | 0 | 0% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.