The National Vulnerability Database (NVD) published 10 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-120534 | 9.8 | The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrar… |
| CVE-2026-86596 | 9.8 | The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been … |
| CVE-2026-102435 | 9.8 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requ… |
| CVE-2026-77876 | 9.8 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution i… |
| CVE-2026-73695 | 9.8 | Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion. |
| CVE-2026-73696 | 9.8 | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting usernam… |
| CVE-2026-73697 | 9.8 | Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker wit… |
| CVE-2026-120442 | 9.8 | ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data. |
| CVE-2026-120446 | 9.4 | madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans. |
| CVE-2026-120518 | 9.1 | The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file … |
New advisories from CERTs and vendors
Canonical (Ubuntu)
- USN-8961-1: Linux kernel vulnerabilities
- USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilities
- USN-8959-1: Linux kernel vulnerabilities
- USN-8968-1: Linux kernel vulnerabilities
- USN-8967-1: Linux kernel (AWS) vulnerability
- USN-8960-1: Linux kernel (OEM) vulnerabilities
- USN-8966-1: Linux kernel vulnerabilities
- USN-8965-1: Linux kernel (BlueField) vulnerabilities
- USN-8962-1: Linux kernel (Azure CVM) vulnerabilities
- USN-8964-1: Linux kernel vulnerabilities
Canadian Centre for Cyber Security
- SUSE Linux security advisory (AV26-1113)
- Barracuda Networks security advisory (AV26-1112)
- Red Hat security advisory (AV26-1111)
- Dell security advisory (AV26-1110)
- Google security advisory (AV26-1109)
Debian
- DSA-6602-1 linux – security update
- DSA-6605-1 chromium – security update
- DSA-6603-1 git-annex – security update
- DSA-6604-1 incus – security update
CERT-FR
- Multiples vulnérabilités dans Tenable Identity Exposure (02 novembre 2026)
- Multiples vulnérabilités dans Redmine (02 novembre 2026)
- Multiples vulnérabilités dans les produits Synology (02 novembre 2026)
- Multiples vulnérabilités dans Ivanti Connect Secure (02 novembre 2026)
- Multiples vulnérabilités dans Microsoft Edge (02 novembre 2026)
- Multiples vulnérabilités dans Qnap QNE (02 novembre 2026)
- Multiples vulnérabilités dans macmon et NRSW (02 novembre 2026)
- Vulnérabilité dans Microsoft Visual Studio (02 novembre 2026)
- Bulletin d'actualité CERTFR-2026-ACT-046 (02 novembre 2026)
- Vulnérabilité dans Traefik (02 novembre 2026)