Daily briefing · October 25, 2026
Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the Disclosures
Verdict of the day — calm
The day is rated CALM: of 142 new CVEs, only 2 are critical, and none are in active exploitation (KEV), weaponized, or seen by VulnCheck ahead of CISA. The standouts are authentication bypasses in Snipe-IT and Parse Server, followed by a cluster of unauthenticated SQL injection and path traversal flaws. This calls for monitoring and prompt patching, not emergency response.
Today’s brief
- CALM day: 142 new CVEs, 2 critical, 0 in KEV, 0 weaponized exploits.
- Authentication bypass in Snipe-IT (CVSS 9.2) and Parse Server (CVSS 9.1) tops the list.
- YesWiki has two unauthenticated SQL injections that can expose password hashes.
- Rclone path traversal (CVE-2026-116191) has a proof of concept that appeared on the day of disclosure.
2
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
Snipe-IT's Google SSO callback ignores the activated flag, so deactivated users with email-shaped usernames can regain sessions at their original permission level, including admin. Organizations that rely on deactivation for offboarding are exposed.
2
In Parse Server, custom adapters subclassing AuthAdapter fall back to an inherited default that accepts any authData. Attackers can sign up, link identities, or log in as existing users, a serious risk for any app using custom authentication.
3
Unauthenticated SQL injection in YesWiki's Bazar entry creation on default installs lets attackers exfiltrate password hashes from the users table. Credential exposure can lead to account takeover.
4
A second unauthenticated SQL injection in YesWiki, this time in the public Bazar entries search API, where a backtick allows subquery injection. It increases the exposure of any public YesWiki instance until it is updated to 4.7.0.
5
vLLM can be forced into outbound connections via the X-Request-Id header (SSRF), leaking the NCCL unique_id and KV-cache tensors or blocking the worker. It threatens the confidentiality and availability of inference infrastructure exposed to API callers.
6
On MongoDB deployments, Parse Server lets clients without the master key delete the stored schema of any class, removing field definitions, class-level permissions, and protected fields. The result may be data exposure and loss of access controls.
7
Path traversal in Paisa lets unauthenticated attackers read any server-readable file and delete backups outside the intended directories. The combination of data disclosure and destruction of recovery points is especially harmful.
8
A non-atomic nonce check in Snipe-IT's SAML handler allows a captured assertion to be replayed concurrently to obtain multiple victim sessions that evade IdP-driven revocation. It undermines centralized session control.
9
Rclone's serve webdav lets unauthenticated attackers write above the served root and create, overwrite, or delete other tenants' files. A proof of concept appeared on the day of disclosure, a sign of attacker interest, though it is not yet a weaponized exploit.
10
phpMyFAQ has an object-level authorization bypass that lets unauthenticated attackers (after solving the CAPTCHA) modify or delete any visitor question and forge history entries. The impact is mainly on content integrity, but it is trivially abusable on public instances.
Ransomware today
The most active groups over the past 30 days are N0n (6 victims), thegentlemen (5), and emperador (4), followed by akira, Vexy Ransomware, and Eclipse with 2 each. According to the data, all victims attributed to these groups are in Brazil.
N0n 6thegentlemen 5emperador 4akira 2Vexy Ransomware 2Eclipse 2
Active groups & APTs
Groups active or recently updated include mamona, mogilevich, mosesstaff (Iran), ransomhouse, Elderwood (China), and dragonforce. None of them has known victims in the dataset, so this is monitoring information with no confirmed impact.
Brazil focus
Recent Brazilian victims span several sectors: healthcare (CLIMEDI, Hospital Sírio-Libanês), education (Universidade de Passo Fundo), manufacturing (GTL Concreto e Logística, Prafesta), agriculture (Pantanal Agricola), and services (Suhai Segurança Pessoal, MPI LTDA). Thegentlemen and emperador stand out among the groups claiming these victims, along with N0n and THE SEVEN DEADLY SINS.
GTL Concreto e Logística LTDA
Suhai Segurana Pessoal
CLIMEDI
Hospital Sírio-Libanês
Prafesta Ind. e Com. de Embalagens Ltda
Universidade de Passo Fundo
Pantanal Agricola
MPI LTDA
Today’s recommendation: Prioritize updating Snipe-IT, Parse Server, and YesWiki, and review SSO and SAML configurations and session revocation. Restrict public exposure of services such as rclone serve webdav, Paisa, and vLLM API endpoints, and verify that backups are isolated and tested.
Even on a calm day, flaws that can be exploited without authentication show why validating your own attack surface is the only reliable way to know whether you are exposed.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →