The National Vulnerability Database (NVD) published 5 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-107622 | 9.8 | The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-suppli… |
| CVE-2026-119757 | 9.8 | BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments. |
| CVE-2026-123198 | 9.8 | LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account. |
| CVE-2026-114630 | 9.1 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-co… |
| CVE-2026-117691 | 9.1 | A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full acc… |
New advisories from CERTs and vendors
Canonical (Ubuntu)
- USN-9003-1: Linux kernel (NVIDIA) vulnerabilities
- USN-9002-1: Linux kernel (NVIDIA Tegra) vulnerabilities
- USN-9001-1: ca-certificates update
- USN-8955-2: nginx vulnerabilities
- USN-7230-3: FRR regression
- USN-8972-2: HAProxy regression
Canadian Centre for Cyber Security
- OpenBSD security advisory (AV26-1130)
- Rubyonrails security advisory (AV26-1129)
CERT-FR
- Multiples vulnérabilités dans les produits Siemens (05 novembre 2026)
- Multiples vulnérabilités dans les produits Cisco (05 novembre 2026)
- Vulnérabilité dans OpenSSH (05 novembre 2026)
- Multiples vulnérabilités dans OpenOffice (05 novembre 2026)
- Multiples vulnérabilités dans SPIP (05 novembre 2026)
- Multiples vulnérabilités dans MongoDB (05 novembre 2026)
- Multiples vulnérabilités dans Microsoft Edge (05 novembre 2026)
- Vulnérabilité dans OpenSSH (05 novembre 2026)