CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-10-02 (12)

2026-10-02 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-10-02

12 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-101148 — 10.0 — The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download …
  • CVE-2026-15989 — 9.8 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg()…
  • CVE-2026-75957 — 9.8 — The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkout_form parameter of the `login_c…
  • CVE-2026-56154 — 9.8 — Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • CVE-2026-57941 — 9.8 — Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • CVE-2026-59797 — 9.8 — Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • CVE-2026-104286 — 9.8 — An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 thr… [KEV]
  • CVE-2026-62071 — 9.3 — Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.
  • CVE-2026-103922 — 9.3 — Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its…
  • CVE-2026-92966 — 9.1 — The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the sof…
  • CVE-2026-103264 — 9.1 — Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers wh…
  • CVE-2026-79898 — 9.1 — Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell c…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.