Daily briefing · October 28, 2026
Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical Flaws
Verdict of the day — attention2 seen before CISA
The verdict for 2026-10-28 is ATTENTION: no vulnerability has reached weaponized status, but two were seen exploited by VulnCheck ahead of the CISA, which signals real-world activity before official confirmation. The day recorded 599 new CVEs and 32 critical ones, with highlights including a Cisco ASA/FTD denial-of-service flaw, a WordPress plugin allowing unauthenticated file upload, and a cluster of critical Dell PowerProtect Data Domain flaws. Teams should prioritize internet-exposed assets and monitor developments.
Today’s brief
- Two CVEs (WooCommerce plugin and Cisco ASA/FTD) were seen exploited by VulnCheck before the CISA, an early warning of in-the-wild activity.
- CVE-2026-103688 allows unauthenticated file upload with possible remote code execution and has a public proof of concept.
- Dell PowerProtect Data Domain has four critical flaws (CVSS 9.8) at once, involving authentication, hard-coded keys and remote access.
- AVideo-Encoder has two CVSS 10.0 flaws, and qilin continues to hit Brazilian organizations.
32
critical
2
Actively exploited
2
Before CISA
0
Weaponized
Critical highlights
1
The Checkout Files Upload for WooCommerce plugin (before 2.4.0) accepts any file type when the settings field is empty, allowing unauthenticated uploads that can lead to PHP code execution. Exploitation was observed by VulnCheck before the CISA, and a proof of concept exists, so the urgency is high for exposed WordPress sites.
2
CVE-2026-76418◆ VulnCheckHIGH 8.6affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
A flaw in the Remote Access SSL VPN service of Cisco ASA and FTD lets an unauthenticated remote attacker force a device reload, causing denial of service. Exploitation was observed by VulnCheck before the CISA, and edge VPN devices are priority targets, so organizations with exposed remote access should act quickly.
3
In AVideo (before 8.1.0), the live-streaming endpoint trusts a JSON response from an attacker-controlled service as session state, allowing an unauthenticated attacker to grant themselves logged-in and streaming privileges. The CVSS 10.0 score reflects the ease of abuse and the severity of the authentication bypass.
4
The unauthenticated installer endpoint of AVideo (before 8.1.0) interpolates request parameters into the generated configuration file without escaping, enabling PHP injection that runs as the web-server user. With CVSS 10.0, it can result in full server compromise if the installer remains reachable.
5
The excerpt-include macro in xwiki-pro-macros (1.13 to 1.14.5) does not properly escape the included page's title and runs excerpt content with the macro's rights. With CVSS 9.9, it poses a risk of privilege escalation and code execution in XWiki environments that use the Confluence migration macros.
6
An improper authentication flaw in Dell PowerProtect Data Domain allows an unauthenticated remote attacker to potentially execute arbitrary commands. Because this is a backup platform, compromise can affect data recovery capability, making it a high-value target.
7
The Contact Manager plugin for WordPress (up to 9.1.2) has an incomplete extension blacklist that can be bypassed with a trailing dot, allowing arbitrary file upload through the add_message function. The risk is web shell placement and server takeover on unpatched sites.
8
Dell PowerProtect Data Domain contains a hard-coded cryptographic key that a remote, unauthenticated attacker could potentially abuse. It is part of a set of critical flaws in the same product, which increases the importance of patching all affected versions together.
9
Another improper authentication flaw in Dell PowerProtect Data Domain, which could grant privileged access to an unauthenticated remote attacker. Combined with the other CVEs in the product, it reinforces the need to restrict network exposure of backup appliances.
10
An authorization bypass in the /nodered functionality of FUXA (version 1.3.2-2809) allows an unauthenticated HTTP request to lead to arbitrary code execution. Because FUXA is used in industrial and supervisory interfaces, exposure to the internet or to unsegmented networks is particularly concerning.
Ransomware today
The group qilin appears with newly discovered victims in Brazil, including P&B Textiles (Manufacturing), Animart Pet Stores (Retail & E-Commerce) and bio3g.com (Healthcare). Over the last 30 days, the most active groups include N0n (6 victims), emperador, thegentlemen and qilin (4 each), followed by akira and Vexy Ransomware (2 each), all with activity concentrated in Brazil.
P&B Textiles BR
Animart Pet Stores BR
bio3g.com BR
N0n 6emperador 4thegentlemen 4qilin 4akira 2Vexy Ransomware 2
Active groups & APTs
Groups with recent activity or updates include mamona, mogilevich, mosesstaff (origin: Iran), ransomhouse, Elderwood (origin: China) and dragonforce. None of them has known victims recorded in the data provided, so the information serves mainly as a monitoring reference.
Brazil focus
Brazil concentrates the recent victims of the most active groups, with a strong presence in Manufacturing, such as GTL Concreto e Logística LTDA (emperador), Prafesta Ind. e Com. de Embalagens Ltda (N0n) and P&B Textiles (qilin). Education and Healthcare also appear, with Universidade de Passo Fundo (thegentlemen), bio3g.com (qilin) and Hospital Sírio-Libanês (THE SEVEN DEADLY SINS), in addition to Suhai Segurana Pessoal (thegentlemen) in Professional Services.
Animart Pet Stores
P&B Textiles
bio3g.com
GTL Concreto e Logística LTDA
Prafesta Ind. e Com. de Embalagens Ltda
Universidade de Passo Fundo
Suhai Segurana Pessoal
Hospital Sírio-Libanês
Today’s recommendation: Prioritize patching or mitigating the Cisco ASA/FTD flaw and the WooCommerce plugin, as both show exploitation signals, and update the Dell PowerProtect Data Domain and AVideo instances. Restrict internet exposure of backup, VPN and administrative interfaces, and review upload directories for unexpected files.
With critical flaws appearing every day in widely used components, the question is not only which vulnerabilities exist, but whether any of them is actually reachable in your own environment, and that can only be answered by testing your attack surface.Before an attacker finds it, find it first: run a free initial exposure assessment and see whether your infrastructure is vulnerable to flaws like these.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →