lee1981 (@lee1981b) on X

What it is

CyberForge Weekly CVE Rundown #008 (26 to 31 October 2026) is a daily-edition roundup of seven CVEs with per-item fix floors and a 1 November 2026 recheck. The summary names the products. This note carries the version floors, prerequisites and scoring details it leaves out.

Preconditions / Affected

• CVE-2026-115889, Wasmtime/Cranelift: crafted Wasm overflows packed compiler indices, causing miscompilation and possible sandbox escape. The CNA keeps PR:L. Versions 37 to 42 remain affected.
• CVE-2026-115905, Rust zip: inspection and streaming extraction can trust different header views, so approval can describe the wrong filename and cause unexpected file writes. Later execution needs separate evidence.
• CVE-2026-92885, Qode Membership: a typo bypasses Facebook-token validation and gives unauthenticated access to existing accounts, including administrators. The required nonce is publicly obtainable on affected shortcode pages.
• CVE-2026-103780, Dell PowerProtect Data Domain: Dell describes potential command execution by an unauthenticated remote attacker. The service and execution account are undisclosed.
• CVE-2026-84295, WS_FTP: exposes administrative credentials without authentication.
• CVE-2026-90868, WS_FTP: command injection that needs low privileges and certain configurations. Chaining with 84295 is unverified.
• CVE-2026-118759, Kubeflow Pipelines: backend reachability plus known run and node identifiers expose live and archived logs under server authority. An independent authentication gate narrows access but gives no per-run permission.

What to do

• Wasmtime: use 36.0.19 within 36.x, or 43.0.0 and later. Check embedded compiler producers and consumers.
• Rust zip: upgrade to 9.0.5, enable the streaming checks and gate staged output on complete validation. A rejection can leave earlier writes behind.
• Qode Membership: confirm the active plugin is 2.0.6.3 or later, and investigate earlier sessions separately.
• Dell Data Domain: match your train to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or an applicable later fix. Check backup health separately.
• WS_FTP: apply both fixes, 2024.0.7 or 2025.0.4 in the matching family. Review credential and session exposure.
• Kubeflow Pipelines: upgrade the API server to 2.18.0. Review scoped readLog grants and both the live and archive log paths.

Caveats

• FIRST EPSS rows dated 31 October 2026 now exist for all seven IDs. The page calls them forward predictions, not compromise findings. The page gives no values.
• None of the seven IDs was in CISA's captured 30 October 2026 catalogue. The page says non-listing does not prove safety.
• Dell's NVD state is Undergoing Analysis, which is not an independent NIST score.
• CVE-2026-84295 has a CVSS v3.1 CNA score of 10.0 from Progress. CVE-2026-115905 has a GitHub CNA CVSS v4.0 score of 10.0. The page says not to rank the two scales against each other.
• The 1 November check was not a comprehensive campaign or PoC search.
• Patching does not show that backups are trustworthy or that exposed secrets were handled.