BETWEEN 5 and 11 October 2026, CVE Watchtower logged 3,255 new vulnerabilities. This weekly CVE report highlights six flaws that Daily Cybersecurity’s intelligence sources surfaced as exploited, but which were not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Three of the flaws affect SonicWall, Atlassian and Rejetto products and carry CVSS scores of 9.3 or higher.
Crucially, none of the six appear in the KEV catalog as of the version dated 8 October 2026, meaning these exploits are exclusive to Daily Cybersecurity for now. Separately, CISA added five older flaws to KEV on 8 October 2026.
The exploited flaws this week are CVE-2026-102255 (SonicWall SMA1000), CVE-2026-105133 (Ahsay AhsayCBS up to 10.3.2), CVE-2026-94504 (Ninja Forms for WordPress), CVE-2026-93836 (WPC Product Bundles for WooCommerce) and CVE-2026-21589 (Atlassian Data Centre products), plus CVE-2026-61500 (Rejetto HFS). Evidence cited includes exploitation attempts detected by Previdian and broader observations by Shadowserver and others; DC date and KEV date differ, so a feed-to-feed comparison is imperfect.
Authorities report active attempts against SonicWall, Atlassian and Rejetto, with independent confirmation for some, while the remaining three lack confirmed exploitation to date.
Defenders should prioritise patches: SonicWall SMA1000 first (restrict WorkPlace access), apply Atlassian fixes across all eight products (restrict external access and rotate Crowd credentials), upgrade Rejetto HFS to 3.2.1 or later, update AhsayCBS to 10.3.4, and bring Ninja Forms and WPC Product Bundles to current releases; also patch the KEV-only flaws as a precaution against ongoing activity.