StackPrism

Monthly reportIn progress

What your agent missed in October 2026

So far in October 2026, CISA has added 2 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog, GitHub has published 13 critical advisories for widely used npm and PyPI packages, 1 release line has reached end of life and 1 new release line has shipped.

October 2026 isn’t over yet: this covers October 1, 2026 to October 17, 2026 and is final after October 31, 2026.

  • 2Exploited in the wild
  • 13Critical advisories
  • 1Reached end of life
  • 1New release lines

The ones to know first

The most widely used software among this month’s items, one of each kind.

  • CVE-2023-22894 added to CISA’s exploited list (Strapi)

    Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details…

    , CISA KEV

  • handlebars: JavaScript injection (critical)

    Fixed in 4.7.10.

    , GitHub Advisory Database

  • Python 3.10 reached end of life

    No more security fixes. Latest: Python 3.15.

    , endoflife.date

Everything in October 2026

Exploited in the wild2

  • CVE-2016-3081 added to CISA’s exploited list (Apache Struts)

    Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is…

    , CISA KEV

  • CVE-2023-22894 added to CISA’s exploited list (Strapi)

    Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details…

    , CISA KEV

Critical advisories13

  • handlebars: JavaScript injection (critical)

    Fixed in 4.7.10.

    , GitHub Advisory Database

  • handlebars: JavaScript injection via Own Property check bypass (critical)

    Fixed in 4.7.10.

    , GitHub Advisory Database

  • payload: unauthorized update to collection documents (critical)

    Fixed in 3.90.0.

    , GitHub Advisory Database

  • payload: Payload authentication token field handling issue (critical)

    Fixed in 3.90.0.

    , GitHub Advisory Database

  • langflow: OS command injection (critical)

    Fixed in 1.10.3.

    , GitHub Advisory Database

  • payload: field access control bypass on auth collections (critical)

    Fixed in 3.90.0.

    , GitHub Advisory Database

  • payload: SQL injection in SQLite and Postgres (critical)

    Fixed in 3.88.0.

    , GitHub Advisory Database

  • langflow: PythonREPLComponent executes unsandboxed Python code, enabling… (critical)

    Fixed in 1.10.1.

    , GitHub Advisory Database

  • simple-git: simple-git unsafe-operation guard does not block trailer command… (critical)

    Fixed in 4.0.1.

    , GitHub Advisory Database

  • seroval: fromJSON() Promise thenable assimilation invokes plugin-produced… (critical)

    Fixed in 1.6.2.

    , GitHub Advisory Database

  • proxy-addr: IP spoofing via IPv4-mapped IPv6 trust subnet (critical)

    Fixed in 2.0.8.

    , GitHub Advisory Database

  • langflow: weak Fernet key via random.seed() (critical)

    Fixed in 1.10.1.

    , GitHub Advisory Database

  • langflow: unauthenticated Flow execution via webhook authentication bypass (critical)

    Fixed in 1.9.1.

    , GitHub Advisory Database

Reached end of life1

  • Python 3.10 reached end of life

    No more security fixes. Latest: Python 3.15.

    , endoflife.date

New release lines1

  • Python 3.15 released

    Latest version: 3.15.0.

    , endoflife.date

Which models can’t know this

Every model in our cutoff table has a knowledge cutoff before October 2026, so none of them knows about any of this unless a tool gives it live data.

Anthropic

xAI

OpenAI

Google

Microsoft

Meta

Last checked against CISA KEV, GitHub Advisory Database and endoflife.date.

What counts: vulnerabilities CISA confirms are exploited, in software web apps commonly run; critical GitHub advisories on widely used npm and PyPI packages; and release lines of popular runtimes, frameworks and databases reaching end of life or shipping. Also as Markdown.