# What your agent missed in October 2026 _Draft: October 2026 is still in progress._ So far in October 2026, CISA has added 2 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog, GitHub has published 13 critical advisories for widely used npm and PyPI packages, 1 release line has reached end of life and 1 new release line has shipped. The ones to know first: - **Oct 8, 2026**: CVE-2023-22894 added to CISA’s exploited list (Strapi). Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details… [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894) - **Oct 8, 2026**: handlebars: JavaScript injection (critical). Fixed in 4.7.10. [GitHub Advisory Database](https://github.com/advisories/GHSA-8r5x-fm3f-whwj) - **Oct 1, 2026**: Python 3.10 reached end of life. No more security fixes. Latest: Python 3.15. [endoflife.date](https://endoflife.date/python) ## Exploited in the wild (2) - **Oct 8, 2026**: CVE-2016-3081 added to CISA’s exploited list (Apache Struts). Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is… [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081) - **Oct 8, 2026**: CVE-2023-22894 added to CISA’s exploited list (Strapi). Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details… [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894) ## Critical advisories (13) - **Oct 8, 2026**: handlebars: JavaScript injection (critical). Fixed in 4.7.10. [GitHub Advisory Database](https://github.com/advisories/GHSA-8r5x-fm3f-whwj) - **Oct 8, 2026**: handlebars: JavaScript injection via Own Property check bypass (critical). Fixed in 4.7.10. [GitHub Advisory Database](https://github.com/advisories/GHSA-p8wg-vrv2-v86f) - **Oct 7, 2026**: payload: unauthorized update to collection documents (critical). Fixed in 3.90.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-f7hx-52q9-hcrf) - **Oct 7, 2026**: payload: Payload authentication token field handling issue (critical). Fixed in 3.90.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-66wr-7vmr-p5jq) - **Oct 7, 2026**: langflow: OS command injection (critical). Fixed in 1.10.3. [GitHub Advisory Database](https://github.com/advisories/GHSA-w794-rj3p-xv45) - **Oct 6, 2026**: payload: field access control bypass on auth collections (critical). Fixed in 3.90.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-vc4h-q48j-5hcx) - **Oct 6, 2026**: payload: SQL injection in SQLite and Postgres (critical). Fixed in 3.88.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-v49j-62m6-pgrr) - **Oct 6, 2026**: langflow: PythonREPLComponent executes unsandboxed Python code, enabling… (critical). Fixed in 1.10.1. [GitHub Advisory Database](https://github.com/advisories/GHSA-8qpj-27x8-pwpq) - **Oct 5, 2026**: simple-git: simple-git unsafe-operation guard does not block trailer command… (critical). Fixed in 4.0.1. [GitHub Advisory Database](https://github.com/advisories/GHSA-x6jw-m9v5-85vh) - **Oct 5, 2026**: seroval: fromJSON() Promise thenable assimilation invokes plugin-produced… (critical). Fixed in 1.6.2. [GitHub Advisory Database](https://github.com/advisories/GHSA-p6vx-979v-rg4c) - **Oct 5, 2026**: proxy-addr: IP spoofing via IPv4-mapped IPv6 trust subnet (critical). Fixed in 2.0.8. [GitHub Advisory Database](https://github.com/advisories/GHSA-jqcg-44mw-7w3h) - **Oct 5, 2026**: langflow: weak Fernet key via random.seed() (critical). Fixed in 1.10.1. [GitHub Advisory Database](https://github.com/advisories/GHSA-jxw3-mjmx-3pqm) - **Oct 5, 2026**: langflow: unauthenticated Flow execution via webhook authentication bypass (critical). Fixed in 1.9.1. [GitHub Advisory Database](https://github.com/advisories/GHSA-cf6m-vc3m-7cgm) ## Reached end of life (1) - **Oct 1, 2026**: Python 3.10 reached end of life. No more security fixes. Latest: Python 3.15. [endoflife.date](https://endoflife.date/python) ## New release lines (1) - **Oct 9, 2026**: Python 3.15 released. Latest version: 3.15.0. [endoflife.date](https://endoflife.date/python) ## Which models can’t know this Every model below has a knowledge cutoff before October 2026, so it can’t know about any of this unless a tool gives it live data. - Claude Fable 5.1 (Anthropic): June 2026 - Claude Haiku 5.5 (Anthropic): June 2026 - Claude Opus 5.5 (Anthropic): June 2026 - Claude Sonnet 5.5 (Anthropic): June 2026 - Claude Opus 5 (Anthropic): May 2026 - Grok 4.7 (xAI): May 2026 - GPT-6 Luna (OpenAI): May 18, 2026 - GPT-6 Astra (OpenAI): April 30, 2026 - GPT-6.1 Sol (OpenAI): April 30, 2026 - GPT-6 Sol (OpenAI): April 20, 2026 - Gemini 3.8 Flash (Google): March 2026 - Gemini 4 Argon (Google): March 2026 - GPT-5.6 Sol (OpenAI): February 16, 2026 - Claude Fable 5 (Anthropic): January 2026 - Claude Opus 4.7 (Anthropic): January 2026 - Claude Opus 4.8 (Anthropic): January 2026 - Claude Sonnet 5 (Anthropic): January 2026 - Grok 4.6 (xAI): January 2026 - MAI-Code-1.1-Flash (Microsoft): December 2025 - GPT-5.5 (OpenAI): December 1, 2025 - Claude Sonnet 4.6 (Anthropic): August 2025 - GPT-5.3-Codex (OpenAI): August 31, 2025 - GPT-5.4 (OpenAI): August 31, 2025 - GPT-5.4 Mini (OpenAI): August 31, 2025 - Claude Opus 4.5 (Anthropic): May 2025 - Claude Opus 4.6 (Anthropic): May 2025 - Claude Haiku 4.5 (Anthropic): February 2025 - Claude Sonnet 4.5 (Anthropic): January 2025 - Gemini 2.5 Flash (Google): January 2025 - Gemini 2.5 Pro (Google): January 2025 - Gemini 3 Flash (Google): January 2025 - Gemini 3.1 Pro (Google): January 2025 - GPT-5 (OpenAI): September 30, 2024 - GPT-5-Codex (OpenAI): September 30, 2024 - GPT-5.1 (OpenAI): September 30, 2024 - Llama 4 Maverick (Meta): August 2024 - GPT-4.1 (OpenAI): June 1, 2024 - o3 (OpenAI): June 1, 2024 - GPT-5 Mini (OpenAI): May 31, 2024 - GPT-4o (OpenAI): October 1, 2023 --- Checked Oct 17, 2026 against [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [GitHub Advisory Database](https://github.com/advisories) and [endoflife.date](https://endoflife.date). Full report: https://stackprism.ai/reports/2026-10