Do Son 
Between October 5 and 11, 2026, CVE Watchtower logged 3,255 new vulnerabilities. This weekly CVE report highlights six exploited flaws that Daily Cybersecurity’s intelligence sources surfaced but CISA has not yet listed. Three of them, in SonicWall, Atlassian and Rejetto products, score 9.3 or higher on CVSS.
The week in numbers
Severity skewed high this week. The tracker recorded 367 critical flaws with CVSS 9.0 or above. Another 1,151 rated high, in the 7.0 to 8.9 range. Medium flaws totaled 1,377, while 124 rated low and 236 had no score yet.
Daily Cybersecurity flagged six of these new CVEs as exploited. As of CISA KEV catalog version 2026.10.08, none of the six appear in the catalog. That makes all six exclusive to Daily Cybersecurity for now. Separately, CISA added five older flaws on October 8.
The intelligence lead: Daily Cybersecurity vs CISA KEV
The table below checks each exploited flaw in this weekly CVE report against the live CISA KEV catalog.
| CVE ID | Affected product | DC marked exploited | CISA KEV date added | Lead time |
|---|---|---|---|---|
| CVE-2026-102255 | SonicWall SMA1000 | 2026-10-09 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-105133 | Ahsay AhsayCBS | 2026-10-09 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-94504 | Ninja Forms (WordPress) | 2026-10-07 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-93836 | WPC Product Bundles for WooCommerce | 2026-10-07 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-21589 | Atlassian Data Center products | 2026-10-07 | Not listed | Not listed / Exclusive to DC |
| CVE-2026-61500 | Rejetto HFS | 2026-10-07 | Not listed | Not listed / Exclusive to DC |
No flaw appeared on both lists this week, so there is no shared lead time to measure. Instead, all six surfaced only through Daily Cybersecurity. Outside researchers confirmed attack attempts against the SonicWall, Atlassian and Rejetto bugs. However, we found no independent confirmation for the other three yet.
Caveat: the DC date and CISA’s dateAdded measure different events, so treat this as a feed-to-feed comparison. “Not listed” flaws may join KEV in a later catalog update.
Exploited vulnerabilities from CISA KEV only
| CVE ID | Affected product | Vulnerability type | CVSS | CISA KEV date added |
|---|---|---|---|---|
| CVE-2015-3306 | ProFTPD | Improper access control | 10.0 | 2026-10-08 |
| CVE-2015-5477 | ISC BIND | Denial of service | 7.5 | 2026-10-08 |
| CVE-2016-3081 | Apache Struts | Command injection | 8.1 | 2026-10-08 |
| CVE-2021-3199 | ONLYOFFICE Docs | Path traversal | 9.8 | 2026-10-08 |
| CVE-2023-22894 | Strapi | Sensitive data exposure | 4.9 | 2026-10-08 |
These bugs are years old. Even so, CISA linked them to a joint advisory on the China-linked Flax Typhoon group, according to The Hacker News.
The flaws that stand out
SonicWall SMA1000 (CVE-2026-102255)
This pre-auth SSRF flaw carries a maximum CVSS score of 10.0. It lets an unauthenticated attacker make the appliance send requests to internal services. Previdian’s honeypot network detected exploitation attempts, BleepingComputer reported. Meanwhile, Shadowserver tracks more than 400 SMA1000 appliances exposed online.
Atlassian Data Center (CVE-2026-21589)
This flaw hits eight self-hosted Atlassian products, including Jira, Confluence and Bitbucket. Attackers can read specific files in the web root without logging in. watchTowr published research and a public PoC on October 7. Within two hours, Previdian saw exploitation attempts.
Rejetto HFS (CVE-2026-61500)
Rejetto HFS builds its session signing key from a predictable random generator. As a result, attackers can forge an admin cookie and run code. VulnCheck observed attempts starting October 1, describing them as small-scale reconnaissance. A public Python PoC appeared in late September.
What defenders should do
- Patch SonicWall SMA1000 appliances first, and limit access to the WorkPlace interface.
- Apply Atlassian’s fixes across all eight products. Restrict external access and rotate Crowd credentials.
- Upgrade Rejetto HFS to version 3.2.1 or later.
- Upgrade AhsayCBS to 10.3.4. Update Ninja Forms and WPC Product Bundles to their latest releases.
- Patch the five KEV-only flaws, since a nation-state group still uses them.
Get the full weekly data
This premium content is securely locked. You must upgrade your subscription to access the full threat intelligence report, including detailed mitigation steps, deep-dive analysis, and active exploitation metrics. Your attempt to inspect the DOM will only reveal this placeholder text. Please support our work to read the actual coverage.
Unlock Premium Threat Intelligence
This is a premium content. Upgrade to Pro or Team to unlock full access and remove all reading restrictions.
Buy Me a Coffee
