by Kastro
View options
Daily brief · Thursday 5 November 2026 · generated 06:05 UTC

120 new criticals.
11 to patch today.

Nothing new entered CISA KEV overnight. Mozilla shipped 18 criticals.

Missed a few days? Read the weekend edition →

cvelistV500:11Z
CISA KEV00:16Z
Vulnrichment00:11Z
NVD00:11Z
EPSS00:16Z

Patch today

In KEV, publicly exploited, or SSVC “Act”. Ordered by priority.
Adobe1 vulnerabilityMax CVSS 10.0Priority 100KEV 1
CVE-2026-75650·Adobe Adobe Commerce

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.… From CVE record

Edimax1 vulnerabilityMax CVSS 10.0Priority 57KEV 0
FreeRDP2 vulnerabilitiesMax CVSS 9.8Priority 49KEV 0
mitre1 vulnerabilityMax CVSS 9.8Priority 48KEV 0
readest1 vulnerabilityMax CVSS 9.3Priority 48KEV 0
David-Crty1 vulnerabilityMax CVSS 9.2Priority 47KEV 0
vtenext1 vulnerabilityMax CVSS 9.8Priority 47KEV 0
LMFDB1 vulnerabilityMax CVSS 9.8Priority 39KEV 0
openemr1 vulnerabilityMax CVSS 9.6Priority 39KEV 0
Project-MONAI1 vulnerabilityMax CVSS 9.3Priority 38KEV 0
CVE-2026-48705·Project-MONAI MONAI

MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without… From CVE record

public exploitCVSS 9.3

Also new today (110)

New CVSS ≥ 9.0 records outside the patch list, ordered by priority.

Open Operator view →
Linksys4 vulnerabilitiesMax CVSS 10.0Priority 47KEV 0
  1. 47Priority
    CVE-2026-121932 · Linksys E5350

    Linksys E5350 apply.cgi system os command injection

    CVSS 10.0
  2. 45Priority
    CVE-2026-121930 · Linksys WRT54GL

    Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection

    CVSS 9.4
  3. 45Priority
    CVE-2026-121931 · Linksys WRT54GL

    Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection

    CVSS 9.4
  4. 43Priority
    CVE-2026-121933 · Linksys E5350

    Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication

    CVSS 10.0
Comfast1 vulnerabilityMax CVSS 10.0Priority 42KEV 0
  1. 42Priority
    CVE-2026-122013 · Comfast CF-WR632AX

    Comfast CF-WR632AX Multipart webmgnt path traversal

    CVSS 10.0
xerrors1 vulnerabilityMax CVSS 9.9Priority 41KEV 0
  1. 41Priority
    CVSS 9.9
rubyonrails1 vulnerabilityMax CVSS 9.8Priority 40KEV 0
  1. 40Priority
    CVSS 9.8
Shenzhen Shine Industrial Co., Ltd.2 vulnerabilitiesMax CVSS 9.8Priority 40KEV 0
  1. 40Priority
    CVE-2026-54384 · Shenzhen Shine Industrial Co., Ltd. VitaFit

    VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

    CVSS 9.8
  2. 32Priority
    CVE-2026-54378 · Shenzhen Shine Industrial Co., Ltd. VitaFit

    VitaFit Cloud API Broken Access Control via S3 Token Endpoint

    CVSS 9.6
Apple3 vulnerabilitiesMax CVSS 9.8Priority 38KEV 0
  1. 38Priority
    CVE-2026-112514 · Apple iOS and iPadOS

    A use-after-free issue was addressed with improved memory management.

    CVSS 9.1
  2. 38Priority
    CVE-2026-84539 · Apple macOS

    An out-of-bounds write issue was addressed with improved bounds checking.

    CVSS 9.8
  3. 30Priority
    CVE-2026-112521 · Apple macOS

    A buffer overflow was addressed with improved bounds checking.

    CVSS 9.3
kyverno7 vulnerabilitiesMax CVSS 9.9Priority 38KEV 0
  1. 38Priority
    CVSS 9.9
  2. 36Priority
    CVE-2026-122304 · kyverno kyverno

    Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

    CVSS 9.9
  3. 36Priority
    CVE-2026-122310 · kyverno kyverno

    Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath

    CVSS 9.9
  4. 35Priority
    CVSS 9.9
  5. 35Priority
    CVSS 9.9
  6. 34Priority
    CVE-2026-122302 · kyverno kyverno

    Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check

    CVSS 9.8
  7. 30Priority
    CVE-2026-122321 · kyverno kyverno

    Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass

    CVSS 9.1
Mozilla18 vulnerabilitiesMax CVSS 9.8Priority 38KEV 0
  1. 38Priority
    CVE-2026-117862 · Mozilla Firefox

    Privilege escalation due to incorrect boundary conditions in the Networking component

    CVSS 9.8
  2. 38Priority
    CVE-2026-117917 · Mozilla Firefox

    Invalid pointer in the Graphics: WebRender component

    CVSS 9.8
  3. 36Priority
    CVE-2026-117861 · Mozilla Firefox

    Sandbox escape in the DOM: Navigation component

    CVSS 9.6
  4. 36Priority
    CVE-2026-117868 · Mozilla Firefox

    Sandbox escape in the DOM: Networking component

    CVSS 9.6
  5. 35Priority
    CVE-2026-117920 · Mozilla Firefox

    Use-after-free in the DOM: HTML Parser component

    CVSS 9.6
  6. 35Priority
    CVE-2026-118177 · Mozilla Thunderbird

    Calendar discovery accepted local file and remote network share locations

    CVSS 9.1
  7. 31Priority
    CVE-2026-117945 · Mozilla Firefox

    Incorrect boundary conditions in the XML component

    CVSS 9.8
  8. 31Priority
    CVE-2026-117946 · Mozilla Firefox

    Incorrect boundary conditions in the JavaScript Engine component

    CVSS 9.8
  9. 31Priority
    CVE-2026-117971 · Mozilla Firefox

    Sandbox escape due to use-after-free in the Print Preview component

    CVSS 9.6
  10. 31Priority
    CVE-2026-117980 · Mozilla Firefox

    Use-after-free in the Graphics component

    CVSS 9.8
  11. 31Priority
    CVE-2026-117981 · Mozilla Firefox

    Privilege escalation in the Toolkit component

    CVSS 9.8
  12. 31Priority
    CVE-2026-117982 · Mozilla Firefox

    Invalid pointer in the JavaScript Engine: JIT component

    CVSS 9.8
  13. 31Priority
    CVE-2026-118027 · Mozilla Firefox

    Frame poisoning in the Layout component

    CVSS 9.1
  14. 30Priority
    CVSS 9.6
  15. 30Priority
    CVE-2026-117985 · Mozilla Firefox

    Sandbox escape due to use-after-free in the Graphics component

    CVSS 9.6
  16. 30Priority
    CVSS 9.6
  17. 30Priority
    CVE-2026-117990 · Mozilla Firefox

    Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

    CVSS 9.6
  18. 30Priority
    CVE-2026-117997 · Mozilla Firefox

    Sandbox escape due to use-after-free in the Widget component

    CVSS 9.6
OPNsense1 vulnerabilityMax CVSS 9.4Priority 38KEV 0
  1. 38Priority
    CVSS 9.4
WatchGuard3 vulnerabilitiesMax CVSS 9.2Priority 38KEV 0
  1. 38Priority
    CVE-2026-121639 · WatchGuard AuthPoint Authentication Gateway

    WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

    CVSS 9.2
  2. 35Priority
    CVE-2026-121640 · WatchGuard AuthPoint Authentication Gateway

    WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions

    CVSS 9.1
  3. 32Priority
    CVE-2026-121638 · WatchGuard AuthPoint Authentication Gateway

    WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks

    CVSS 9.1
Crocoblock1 vulnerabilityMax CVSS 9.8Priority 37KEV 0
  1. 37Priority
    CVE-2026-119481 · Crocoblock JetFormBuilder

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

    CVSS 9.8
GnuPG1 vulnerabilityMax CVSS 9.8Priority 37KEV 0
  1. 37Priority
    CVE-2026-118131 · GnuPG GnuPG

    CVE-2026-118131

    CVSS 9.8
IBM1 vulnerabilityMax CVSS 9.8Priority 37KEV 0
  1. 37Priority
    CVE-2026-82418 · IBM Watson Speech Services Cartridge

    IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL

    CVSS 9.8
Uncanny Owl1 vulnerabilityMax CVSS 9.8Priority 37KEV 0
  1. 37Priority
    CVE-2026-65555 · Uncanny Owl Uncanny Toolkit for LearnDash

    WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability

    CVSS 9.8
Unknown1 vulnerabilityMax CVSS 9.8Priority 36KEV 0
  1. 36Priority
    CVE-2026-100109 · Unknown Security For WooCommerce

    Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

    CVSS 9.8
Yealink1 vulnerabilityMax CVSS 9.0Priority 36KEV 0
  1. 36Priority
    CVSS 9.0
CPANSec3 vulnerabilitiesMax CVSS 9.8Priority 35KEV 0
  1. 35Priority
    CVSS 9.8
  2. 33Priority
    CVSS 9.8
  3. 32Priority
    CVSS 9.1
Delinea2 vulnerabilitiesMax CVSS 9.9Priority 35KEV 0
  1. 35Priority
    CVE-2026-115829 · Delinea Secret Server (On-Prem)

    Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force

    CVSS 9.9
  2. 34Priority
    CVE-2026-115828 · Delinea Secret Server (On-Prem)

    Secret Server device validation error

    CVSS 9.4
Google8 vulnerabilitiesMax CVSS 9.8Priority 35KEV 0
  1. 35Priority
    CVSS 9.6
  2. 34Priority
    CVSS 9.8
  3. 34Priority
    CVSS 9.8
  4. 34Priority
    CVSS 9.8
  5. 33Priority
    CVSS 9.6
  6. 33Priority
    CVSS 9.6
  7. 32Priority
    CVSS 9.6
  8. 32Priority
    CVSS 9.8
gpustack2 vulnerabilitiesMax CVSS 9.8Priority 35KEV 0
  1. 35Priority
    CVSS 9.8
  2. 31Priority
    CVSS 9.1
glpi-project1 vulnerabilityMax CVSS 9.2Priority 34KEV 0
  1. 34Priority
    CVE-2026-52848 · glpi-project glpi

    GLPI: MFA bypass

    CVSS 9.2
Apache Software Foundation17 vulnerabilitiesMax CVSS 10.0Priority 33KEV 0
  1. 33Priority
    CVE-2026-114230 · Apache Software Foundation Apache Qpid Proton C

    Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

    CVSS 9.8
  2. 32Priority
    CVE-2026-105042 · Apache Software Foundation Apache Qpid Proton C

    Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

    CVSS 9.8
  3. 31Priority
    CVE-2026-111108 · Apache Software Foundation Apache Kafka

    Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

    CVSS 9.1
  4. 30Priority
    CVE-2026-111115 · Apache Software Foundation Apache Kafka

    Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

    CVSS 9.1
  5. 30Priority
    CVE-2026-121489 · Apache Software Foundation Apache Juneau

    Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

    CVSS 10.0
  6. 30Priority
    CVE-2026-73098 · Apache Software Foundation Apache Juneau

    Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

    CVSS 10.0
  7. 30Priority
    CVE-2026-73099 · Apache Software Foundation Apache Juneau

    Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override

    CVSS 10.0
  8. 30Priority
    CVE-2026-73100 · Apache Software Foundation Apache Juneau

    Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

    CVSS 10.0
  9. 30Priority
    CVSS 10.0
  10. 30Priority
    CVE-2026-73116 · Apache Software Foundation Apache Juneau

    Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

    CVSS 10.0
  11. 30Priority
    CVSS 10.0
  12. 30Priority
    CVE-2026-96677 · Apache Software Foundation Apache Juneau

    Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

    CVSS 10.0
  13. 29Priority
    CVE-2026-111496 · Apache Software Foundation Apache Kafka

    Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

    CVSS 9.1
  14. 29Priority
    CVE-2026-82907 · Apache Software Foundation Apache OFBiz

    Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

    CVSS 9.8
  15. 29Priority
    CVE-2026-83542 · Apache Software Foundation Apache OFBiz

    Apache OFBiz: Unauthenticated RCE via login-page widget injection

    CVSS 9.8
  16. 28Priority
    CVSS 9.1
  17. 28Priority
    CVSS 9.1
G4KLX1 vulnerabilityMax CVSS 9.2Priority 33KEV 0
  1. 33Priority
    CVSS 9.2
pgadmin.org4 vulnerabilitiesMax CVSS 9.6Priority 33KEV 0
  1. 33Priority
    CVE-2026-116244 · pgadmin.org pgAdmin 4

    pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

    CVSS 9.6
  2. 32Priority
    CVE-2026-116242 · pgadmin.org pgAdmin 4

    pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

    CVSS 9.6
  3. 30Priority
    CVE-2026-116245 · pgadmin.org pgAdmin 4

    pgAdmin 4: Connection services are not restricted in server mode

    CVSS 9.6
  4. 29Priority
    CVE-2026-116247 · pgadmin.org pgAdmin 4

    pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate

    CVSS 9.6
SEPPmail AG2 vulnerabilitiesMax CVSS 9.2Priority 33KEV 0
  1. 33Priority
    CVE-2026-114425 · SEPPmail AG SEPPmail Secure Email Gateway (SEG)

    Forged LFT metadata permits arbitrary file read and deletion

    CVSS 9.2
  2. 31Priority
    CVE-2026-114424 · SEPPmail AG SEPPmail Secure Email Gateway (SEG)

    Code execution through double evaluation in address replacement rules

    CVSS 9.2
wpo3651 vulnerabilityMax CVSS 9.1Priority 33KEV 0
  1. 33Priority
    CVE-2026-122220 · wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

    WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

    CVSS 9.1
Strapi1 vulnerabilityMax CVSS 9.1Priority 32KEV 0
  1. 32Priority
    CVE-2026-118170 · Strapi Strapi Open Source and Enterprise Headless CMS

    CVE-2026-118170

    CVSS 9.1
Sonatype1 vulnerabilityMax CVSS 9.1Priority 31KEV 0
  1. 31Priority
    CVE-2026-113373 · Sonatype Nexus Repository 3

    Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again

    CVSS 9.1
Imagination Technologies1 vulnerabilityMax CVSS 9.8Priority 30KEV 0
  1. 30Priority
    CVE-2026-74912 · Imagination Technologies Graphics DDK

    GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB

    CVSS 9.8
pocket-id1 vulnerabilityMax CVSS 9.6Priority 30KEV 0
  1. 30Priority
    CVSS 9.6
SuiteCRM2 vulnerabilitiesMax CVSS 9.9Priority 30KEV 0
  1. 30Priority
    CVE-2026-71550 · SuiteCRM SuiteCRM

    SuiteCRM: LFI to RCE via AOW_WorkFlow

    CVSS 9.9
  2. 28Priority
    CVE-2026-100358 · SuiteCRM SuiteCRM

    SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

    CVSS 9.4
TPC Software3 vulnerabilitiesMax CVSS 9.9Priority 30KEV 0
  1. 30Priority
    CVSS 9.9
  2. 30Priority
    CVE-2026-111490 · TPC Software Matchpoint

    Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

    CVSS 9.9
  3. 27Priority
    CVE-2026-111494 · TPC Software Matchpoint

    Incorrect validation of TLS certificates in the MatchPoint Android app

    CVSS 9.1
bitcoinjs1 vulnerabilityMax CVSS 9.3Priority 29KEV 0
  1. 29Priority
    CVSS 9.3
BTCPay Server1 vulnerabilityMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVE-2026-119757 · BTCPay Server BTCPay Server

    BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

    CVSS 9.8
espressif1 vulnerabilityMax CVSS 9.3Priority 29KEV 0
  1. 29Priority
    CVE-2026-113780 · espressif esp-idf

    ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary

    CVSS 9.3
kubeflow1 vulnerabilityMax CVSS 9.6Priority 29KEV 0
  1. 29Priority
    CVE-2026-77596 · kubeflow pipelines

    Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

    CVSS 9.6
signalwire3 vulnerabilitiesMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVE-2026-116779 · signalwire freeswitch

    FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

    CVSS 9.8
  2. 27Priority
    CVSS 9.1
  3. 27Priority
    CVE-2026-116790 · signalwire freeswitch

    FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

    CVSS 9.1
tinyhumansai2 vulnerabilitiesMax CVSS 9.8Priority 29KEV 0
  1. 29Priority
    CVSS 9.8
  2. 27Priority
    CVE-2026-54141 · tinyhumansai openhuman

    OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

    CVSS 9.0
dcmjs-org1 vulnerabilityMax CVSS 9.1Priority 27KEV 0
  1. 27Priority
    CVE-2026-46350 · dcmjs-org dcmjs

    dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

    CVSS 9.1
jhuckaby1 vulnerabilityMax CVSS 9.0Priority 27KEV 0
  1. 27Priority
    CVSS 9.0
Red Hat1 vulnerabilityMax CVSS 9.1Priority 27KEV 0
  1. 27Priority
    CVE-2026-117691 · Red Hat Red Hat Build of Keycloak

    Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

    CVSS 9.1
ultravioletrs1 vulnerabilityMax CVSS 9.1Priority 27KEV 0
  1. 27Priority
    CVE-2026-119344 · ultravioletrs cocos

    Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

    CVSS 9.1

Newly exploited

Nothing added to CISA KEV overnight.

EPSS movers

CVE-2026-75650
Adobe Adobe Commerce
35%
+31 pts

Vendor clusters

Mozilla18× · Firefox, ThunderbirdApache Software Foundation17× · Apache Qpid Proton C, Apache Kafka, Apache Juneau, Apache OFBizGoogle8× · Chrome, Androidkyverno7× · kyvernoLinksys4× · E5350, WRT54GLpgadmin.org4× · pgAdmin 4Apple3× · macOS, iOS and iPadOSCPANSec3× · signalwire3× · freeswitchTPC Software3× · MatchpointWatchGuard3× · AuthPoint Authentication GatewayDelinea2× · Secret Server (On-Prem)FreeRDP2× · FreeRDPgpustack2× · gpustackSEPPmail AG2× · SEPPmail Secure Email Gateway (SEG)Shenzhen Shine Industrial Co., Ltd.2× · VitaFitSuiteCRM2× · SuiteCRMtinyhumansai2× · openhuman

25 more single-vendor criticals in the full list →