Adobe released eleven bulletins addressing 174 CVEs across various products. Critical issues were found in ColdFusion, Commerce, and Experience Manager, with ColdFusion being the most urgent due to multiple critical vulnerabilities including pre-authentication remote code execution. Commerce patches are also high priority due to its value as a target and a recent zero-day exploit. Experience Manager also had serious server-side flaws alongside numerous XSS vulnerabilities. All other Adobe patches are considered lower priority and were not publicly known or actively attacked.Microsoft set a new record with 1,415 new CVEs in October 2026, exceeding any previous year's total. This volume is attributed partly to AI accelerating bug discovery on both ends. Despite the high number, only one vulnerability was under active attack, a Windows Shell security feature bypass. Two bugs were publicly known but not actively exploited: a .NET Framework feature bypass and a MessagePack-CSharp denial-of-service bug.Notable Microsoft vulnerabilities include a SharePoint elevation of privilege exploit and a SQL Server remote code execution flaw, both exploitable by authenticated attackers. An Exchange Server remote code execution vulnerability was also released, though its exploitability is considered difficult. The release contained an alarming 59 potential wormable bugs, requiring urgent attention. Microsoft is also introducing "risk cohorts" to help customers organize their vulnerability analysis.