Daily briefing · October 30, 2026
Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flaw
Verdict of the day — attention5 seen before CISA
The day's verdict is ATTENTION: of the 10 highlighted vulnerabilities, five show exploitation observed by VulnCheck ahead of any CISA confirmation, and none has yet become a weaponized exploit. The standouts are CVE-2025-31704 (Dahua, remote code execution) and CVE-2026-103039 (Gravity Forms, PHP object injection), both CVSS 9.8. Another wave of critical flaws, several with CVSS 10.0, rounds out the list, even though the KEV catalog recorded no new entries for the day.
Today’s brief
- Five CVEs were observed exploited by VulnCheck before CISA, an early warning of real-world attacks.
- CVE-2025-31704 (Dahua) and CVE-2026-103039 (Gravity Forms) lead the list with CVSS 9.8 and signs of exploitation.
- Three CVSS 10.0 flaws (Bazarr, LXD, CoPilot) allow unauthenticated access or severe compromise.
- In Brazil, qilin, thegentlemen, emperador and N0n keep hitting companies, universities and hospitals.
43
critical
5
Actively exploited
5
Before CISA
0
Weaponized
Critical highlights
1
Remote code execution in Dahua Intelligent Connection Center through a crafted request, with no apparent need for credentials. Exploitation was seen by VulnCheck before CISA's confirmation, which makes it the day's top priority.
2
PHP object injection in the Gravity Forms WordPress plugin (up to 3.1.2) via a List-type Post Custom Field, caused by use of the unrestricted global deserialization function. Exploitation was observed ahead of CISA, so sites running the plugin should update promptly.
3
File inclusion via path traversal in DedeCMS before 5.7, allowing an unauthenticated attacker to read local files. It is an old flaw with a proof of concept, but with exploitation observed by VulnCheck, which shows legacy systems are still being targeted.
4
Missing authorization in Drupal Commerce Core allows forceful browsing, exposing resources that should be restricted. Medium severity, but with exploitation already observed ahead of CISA, so e-commerce sites should apply the fixed versions.
5
Reflected XSS in Netsweeper's webadmin interface, which requires inducing a user to open a malicious link. It has a proof of concept and exploitation observed by VulnCheck, which is relevant for administrators of content-filtering consoles.
6
CVSS 10.0: Bazarr's Plex OAuth namespace lacks authentication, letting anonymous callers clear credentials and disable the integration. It is a trivial attack on any exposed instance.
7
CVSS 10.0: improper certificate validation in Canonical LXD's HTTPS listener lets an unauthenticated attacker pose as any trusted client via a crafted certificate chain. The result is full access to the cluster and its managed virtual machines.
8
CVSS 10.0: in SOCFortress CoPilot (before 0.1.77), the GCP report upload endpoint passes the raw filename from the header to the file-saving function, which opens the way to compromising the security platform itself. Requires an admin or analyst account, but the impact is severe.
9
Arbitrary server-side code execution in ThingLinks (before 1.4.0) through user-supplied Groovy scripts compiled without a sandbox. It requires authentication, but threatens the whole IoT platform and its rule engine.
10
Stored markup injection in the CoPilot customer portal, reachable even by customer_user accounts through the alert comment endpoint. In a SOC tool, this can turn into compromise of analysts' sessions.
Ransomware today
The most active groups over the past 30 days are N0n (6 victims, all in Brazil), thegentlemen, qilin (4 each, all in Brazil), emperador (3, all in Brazil), plus Vexy Ransomware and akira (2 each). The concentration of Brazilian victims among the top groups stands out.
N0n 6thegentlemen 4qilin 4emperador 3Vexy Ransomware 2akira 2
Active groups & APTs
Among the active groups, lockbit5 leads with 54 Brazilian victims listed on leak sites, followed by thegentlemen and lockbit3 (39 each), ransomhub (35, of Russian origin), Akira (24) and arcusmedia (23). All are flagged as targeting Brazil.
lockbit5 mira BRthegentlemen mira BRlockbit3 mira BRransomhub mira BRAkira mira BRarcusmedia mira BR
Brazil focus
Recent Brazilian victims include Animart Pet Stores, P&B Textiles and bio3g.com (qilin), GTL Concreto e Logística (emperador), Prafesta Embalagens (N0n), and Universidade de Passo Fundo and Suhai Segurança Pessoal (thegentlemen). Hospital Sírio-Libanês also appears, tied to the group THE SEVEN DEADLY SINS, with manufacturing, healthcare and education among the sectors affected.
Animart Pet Stores
P&B Textiles
bio3g.com
GTL Concreto e Logística LTDA
Prafesta Ind. e Com. de Embalagens Ltda
Universidade de Passo Fundo
Suhai Segurana Pessoal
Hospital Sírio-Libanês
Today’s recommendation: Prioritize patching the five CVEs with exploitation observed (Dahua, Gravity Forms, DedeCMS, Drupal Commerce, Netsweeper) and restrict public exposure of administrative interfaces such as Bazarr, LXD and CoPilot. Review access controls and update Gravity Forms beyond 3.1.2 and CoPilot to the fixed versions.
With exploitation showing up before official confirmation, regularly testing and validating your own attack surface is the most reliable way to know whether these risks actually reach you.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →