CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-10-06 (9)

2026-10-06 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-10-06

9 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-32579 — 10.0 — Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
  • CVE-2026-104711 — 9.8 — Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action map…
  • CVE-2026-105641 — 9.8 — Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that r…
  • CVE-2026-98323 — 9.8 — In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callbac…
  • CVE-2026-98365 — 9.8 — In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered…
  • CVE-2026-106016 — 9.8 — Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.
  • CVE-2026-105638 — 9.1 — Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and…
  • CVE-2026-105640 — 9.1 — Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying t…
  • CVE-2026-105793 — 9.1 — Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code param…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.