ColdFusion (APSB26-144): unauthenticated unrestricted file upload leading to code execution, CVE-2026-105899 (CVSS 10.0), plus SSRF CVE-2026-106622 (10.0) and several 9.x code-execution bugs. Fixed in ColdFusion 2025.0.14 and 2023.0.26. Commerce / Magento Open Source (APSB26-153): template-engine injection CVE-2026-103849 (10.0, no authentication) and B2B authorization bug CVE-2026-92909 (9.8). Install the 2026-oct builds and keep the Sept hotfix for CVE-2026-75650 (APSB26-146). Adobe says it is not aware of exploits in the wild for either bulletin (both priority 2), but both products have been on CISA KEV before, so patch internet-facing instances early. Update Oct 16: Sansec named the Commerce bug "BlockStrap", built four working exploit routes in a day, and warns a plain Composer install doesn't apply the fix (see separate item).