Daily briefing · October 23, 2026
Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patching
Verdict of the day — calm
Verdict for the day: CALM. No vulnerability became a weaponized exploit, none is under active exploitation (KEV), and none was seen by VulnCheck ahead of CISA, even with 479 new CVEs and 35 critical ones published. Even so, the featured list is dominated by CVSS 9.8 to 9.9 flaws, including sandbox escapes in Wasmtime, an authentication bypass in a learning management system and a stack overflow in OpenWrt's odhcpd, which call for monitoring and prioritized patching.
Today’s brief
- Verdict CALM: 0 weaponized exploits, 0 in active exploitation, 0 seen by VulnCheck before CISA.
- 479 new CVEs and 35 critical ones; the highlights are all CVSS 9.8 to 9.9.
- Wasmtime has two critical flaws in the Cranelift compiler that can lead to sandbox escape or miscompilation.
- Unauthenticated authentication bypass in the WizLearn LMS and a public PoC for odhcpd (OpenWrt) deserve priority.
35
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
In Postiz, a signed-in user can invoke internal backend helper functions that were never meant to be exposed, including one that reads files from the server's disk. The risk is exposure of sensitive server data by any authenticated account.
2
In Wasmtime on aarch64, a Wasm br_table with a very large number of targets can be compiled with an incorrect branch target, allowing a malicious module to escape the sandbox. It is serious for anyone running untrusted Wasm; update to the patched versions (36.0.19, 48.0.7, 49.0.4).
3
A bit-packing overflow of SSA indices in Wasmtime's Cranelift can cause miscompilation and type confusion when compiling large or crafted functions. It affects environments that compile third-party Wasm; patches are available in 36.0.19 and 43.0.0.
4
A 'Pwn Request' flaw in a GitHub Actions workflow in the Conda infrastructure, triggered by issue comments, can expose the CI pipeline to abuse. It is a reminder of the supply chain risk posed by poorly isolated workflows.
5
In WizLearn's LMS, a crafted POST request lets an unauthenticated attacker bypass password and OAuth authentication, potentially gaining full administrative control. Exposed instances are an attractive target even with a low EPSS (1%).
6
Insecure deserialization (object injection) in the Participants Database WordPress plugin, up to version 2.7.8.5. It can lead to compromise of the site if a suitable exploitation chain exists; low EPSS (0%), but critical impact.
7
In Goobi viewer core, the filename taken from the Content-Disposition header is used without stripping directory components, enabling path traversal when a malicious server responds. This can result in files being written to unintended locations; fixed in 26.05.
8
The download WebSocket endpoint of Goobi viewer core accepts requests from unauthenticated users. It widens the exposed attack surface of public instances; patched in 26.05.
9
A stack buffer overflow in odhcpd (OpenWrt) is reachable over the network through a single unauthenticated DHCPv6 REQUEST, and it already has a proof of concept. It is not a weaponized exploit, but it puts routers and gateways at risk until they are updated to 25.12.
10
Untrusted data deserialization (object injection) in the Hostme v2 theme, up to version 7.0. It can allow remote compromise of WordPress sites using the theme.
Ransomware today
Over the last 30 days, the most active groups were N0n (6 victims, all in Brazil), emperador (5), thegentlemen (5), lockbit5 (3), incransom (3) and akira (2). The Brazilian concentration among these groups stands out.
N0n 6emperador 5thegentlemen 5lockbit5 3incransom 3akira 2
Active groups & APTs
Groups listed as active or updated include Elderwood (China), Lazarus Group (North Korea), APT29 (Russia), WIRTE, TA577 and vicesociety. No known victims are tied to them in the data for the period, so they serve as context for monitoring rather than a concrete alert.
Brazil focus
Recent Brazilian victims include Hospital Sírio-Libanês (Healthcare, THE SEVEN DEADLY SINS), CLIMEDI (Healthcare, thegentlemen), Universidade de Passo Fundo (Education, thegentlemen) and Pantanal Agricola (Agriculture, thegentlemen). The industrial sector also appears, with GTL Concreto e Logística and MPI LTDA (emperador) and Prafesta (N0n), in addition to Suhai Segurança Pessoal (thegentlemen).
GTL Concreto e Logística LTDA
Suhai Segurana Pessoal
CLIMEDI
Hospital Sírio-Libanês
Prafesta Ind. e Com. de Embalagens Ltda
Universidade de Passo Fundo
Pantanal Agricola
MPI LTDA
Today’s recommendation: Prioritize updating Wasmtime, odhcpd (OpenWrt) and Goobi viewer, and review any internet-exposed LMS, WordPress plugins and themes. Audit GitHub Actions workflows triggered by comments and restrict their permissions.
Even on a calm day, critical flaws keep appearing across many types of software, and the only way to know whether they affect you is to regularly validate your own attack surface.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →