Daily briefing · October 29, 2026
Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attention
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
The verdict for October 29 is CALM: no vulnerabilities turned into weaponized exploits, none are under active exploitation (KEV), and none were seen by VulnCheck ahead of CISA. Even so, 58 of the 502 new CVEs were critical, and the featured list is dominated by unauthenticated and remote code execution flaws, including two CVSS 10.0 issues in WS_FTP Server and AjaxLoadMore Cache. This is a day for monitoring and prioritized patching, not emergency response.
Today’s brief
- Verdict CALM: 0 weaponized, 0 in active exploitation, 0 seen by VulnCheck before CISA.
- Two CVSS 10.0 flaws lead the list: WS_FTP Server (CVE-2026-84295) and AjaxLoadMore Cache (CVE-2026-61991).
- Langflow OSS has three RCE flaws (CVE-2026-107327, -107328, -107329) with proof of concept, plus another WS_FTP command injection.
- Several WordPress plugins offer unauthenticated takeover or file upload paths; qilin keeps hitting Brazilian victims.
Critical highlights
1
Improper authentication in WS_FTP Server (before 2024.0.6 and 2025.0.3, Windows) lets an unauthenticated remote attacker obtain sensitive data, including administrative credentials. CVSS 10.0 on a file transfer server that is often internet-facing makes this a patching priority.
2
Unauthenticated remote code execution in AjaxLoadMore Cache up to 3.1.1, with CVSS 10.0. Without any login requirement, any exposed WordPress site running this plugin is potentially at full-compromise risk.
3
The Automated Import Products to Cart plugin (before 1.0.4) allows low-privileged users, such as subscribers, to read and delete arbitrary files, including those holding database credentials. A proof of concept exists, though EPSS is currently 0%.
4
OS command injection in WS_FTP Server (before 2024.0.7 and 2025.0.4, Windows) could allow arbitrary command execution under certain configurations. Combined with the other WS_FTP flaw of the day, administrators of this product should review exposure and update.
5
Missing authorization in Langflow OSS 1.0.0 through 1.12.4 lets an authenticated remote attacker execute arbitrary code. A proof of concept is available, raising the risk for exposed AI workflow instances.
6
Improper neutralization of code in eval/exec in Langflow OSS 1.0.0 through 1.12.4 enables remote code execution by an authenticated attacker. A proof of concept exists, so exposure of Langflow instances should be reviewed.
7
Improper control of code generation in Langflow OSS 1.0.0 through 1.12.4 also allows authenticated remote code execution, with a proof of concept available. Together with the two sibling CVEs, it makes upgrading beyond 1.12.4 important.
8
The Bot for Telegram on WooCommerce plugin (up to 1.3.0) exposes a REST endpoint with no permission check or webhook signature verification, enabling unauthenticated account takeover via forged bot updates. EPSS is 1%, but the attack barrier is very low.
9
The Chat AI with Dispatcher plugin (before 2.4) trusts a spoofable client-supplied content type, letting unauthenticated attackers upload arbitrary files, including PHP, and reach remote code execution. A proof of concept exists.
10
The LogixFast Auth plugin (before 1.0.4) sends the password-reset code to the address supplied in the request, not the account owner's, allowing unauthenticated attackers to take over any account, including administrators. A proof of concept exists.
Ransomware today
Recently discovered victims include P&B Textiles (Manufacturing), Animart Pet Stores (Retail & E-Commerce) and bio3g.com (Healthcare), all in Brazil and all claimed by the qilin group. Over the past 30 days the most active groups are N0n (6 victims), qilin (4), thegentlemen (4), emperador (3), akira (2) and Vexy Ransomware (2), all with their victims concentrated in Brazil.
P&B Textiles BRqilin · Manufacturing
Animart Pet Stores BRqilin · Retail & E-Commerce
bio3g.com BRqilin · Healthcare
N0n 6qilin 4thegentlemen 4emperador 3akira 2Vexy Ransomware 2
Active groups & APTs
Groups updated or active in the feed include mamona, mogilevich, mosesstaff (origin: Iran), ransomhouse, Elderwood (origin: China) and dragonforce. None of them has known victims recorded in the data, so there is no concrete link to today's featured CVEs.
Brazil focus
Brazil remains a heavy target for ransomware, with recent victims across several sectors: Animart Pet Stores, P&B Textiles and bio3g.com (qilin); GTL Concreto e Logística LTDA (emperador); Prafesta Ind. e Com. de Embalagens Ltda (N0n); Universidade de Passo Fundo and Suhai Segurana Pessoal (thegentlemen); and Hospital Sírio-Libanês (THE SEVEN DEADLY SINS). Manufacturing and Healthcare stand out among the affected sectors.
Animart Pet Storesqilin · Retail & E-Commerce
P&B Textilesqilin · Manufacturing
bio3g.comqilin · Healthcare
GTL Concreto e Logística LTDAemperador · Manufacturing
Prafesta Ind. e Com. de Embalagens LtdaN0n · Manufacturing
Universidade de Passo Fundothegentlemen · Education
Suhai Segurana Pessoalthegentlemen · Professional Services
Hospital Sírio-LibanêsTHE SEVEN DEADLY SINS · Healthcare
Today’s recommendation: Prioritize updating WS_FTP Server, Langflow OSS and the affected WordPress plugins, starting with internet-exposed instances, and remove or restrict any that cannot be patched promptly. Review access logs for anomalous requests to these services.
With so many critical flaws that need no credentials, the real question is whether any of them is reachable in your own environment, and only validating your attack surface can answer that.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →