The National Vulnerability Database (NVD) published 9 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-120198 | 10 | A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. |
| CVE-2026-120195 | 10 | A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early … |
| CVE-2026-120189 | 10 | A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. |
| CVE-2026-120224 | 9.9 | A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-120197 | 9.9 | A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure. |
| CVE-2026-120196 | 9.9 | A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure. |
| CVE-2026-120209 | 9.8 | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution. |
| CVE-2026-120201 | 9.8 | Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features. |
| CVE-2026-120225 | 9.1 | A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but… |
New advisories from CERTs and vendors
Microsoft MSRC
- Chromium: CVE-2026-118340 Memory corruption in Skia
- Chromium: CVE-2026-118336 Improper input validation in Headless
- Chromium: CVE-2026-118338 Use after free in Animation
- Chromium: CVE-2026-118354 Improper input validation in Skia
- Chromium: CVE-2026-118358 Memory corruption in WebAudio
- Chromium: CVE-2026-118346 Use after free in Compositing
- Chromium: CVE-2026-118350 Use after free in Turbolev
- Chromium: CVE-2026-118316 Improper input validation in V8
- Chromium: CVE-2026-118318 Improper access control in V8
- Chromium: CVE-2026-118315 Improper input validation in SVG
- Chromium: CVE-2026-118312 Memory corruption in Paint
- Chromium: CVE-2026-118317 Memory corruption in HTML
- Chromium: CVE-2026-118311 Memory corruption in Media
- Chromium: CVE-2026-118313 Use after free in Video
- Chromium: CVE-2026-118304 Improper input validation in SVG
- Chromium: CVE-2026-118308 Use after free in SVG
- Chromium: CVE-2026-118344 Use after free in Layout
- Chromium: CVE-2026-118310 Improper input validation in Views
- Chromium: CVE-2026-118348 Improper input validation in Skia
- Chromium: CVE-2026-118305 Memory corruption in Turbolev
- Chromium: CVE-2026-118352 Memory corruption in Cache
- Chromium: CVE-2026-118307 Use after free in Paint
- Chromium: CVE-2026-118356 Use after free in WTF
- Chromium: CVE-2026-118306 Memory corruption in FileSystem
- Chromium CVE-2026-91732: Missing authorization
Plus 25 more from Microsoft MSRC; see the source link below.
Debian
- DSA-6599-1 nss – security update