The National Vulnerability Database (NVD) published 105 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-106622 | 10 | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-106624 | 10 | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-105899 | 10 | ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-90532 | 10 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-48383 | 10 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-48382 | 10 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-110130 | 10 | Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account. |
| CVE-2026-103849 | 10 | Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-106612 | 9.9 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-105903 | 9.9 | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-75732 | 9.9 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-105895 | 9.9 | Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-103848 | 9.9 | Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. |
| CVE-2026-104748 | 9.8 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX action lacking any capability check for role assignment and the `save_custom_fields_to_user_meta()` function using an exclusion list that omits `wp_capabilities`, co… |
| CVE-2026-87855 | 9.8 | The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function. This is due to the startSession() function accepting an empty jtlauth parameter as a valid credential, combined with insufficient file type validation in handleImagePush(). This makes it possible for unauthenticated attackers to upload files that may … |
| CVE-2026-104800 | 9.8 | The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters directly into generated PHP source written to an included file. This makes it po… |
| CVE-2026-97657 | 9.8 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens — where the 8-byte CTR nonce is carried inside the ciphertext blob and the encryption key is looked up using the attacker-supplied `user_email` G… |
| CVE-2026-97668 | 9.8 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields … |
| CVE-2026-110002 | 9.8 | The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter before it is written to a web-executable PHP file. This m… |
| CVE-2026-93388 | 9.8 | The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter… |
| CVE-2026-49950 | 9.8 | Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server… |
| CVE-2026-63146 | 9.8 | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the… |
| CVE-2026-97816 | 9.8 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97814 | 9.8 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97815 | 9.8 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97805 | 9.8 | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97749 | 9.8 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-97016 | 9.8 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96934 | 9.8 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96924 | 9.8 | Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96909 | 9.8 | Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96864 | 9.8 | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96320 | 9.8 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96219 | 9.8 | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96096 | 9.8 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. |
| CVE-2026-96113 | 9.8 | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-92909 | 9.8 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. |
| CVE-2026-88178 | 9.8 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. |
| CVE-2026-88156 | 9.8 | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| CVE-2026-88102 | 9.8 | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85928 | 9.8 | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85809 | 9.8 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
| CVE-2026-85814 | 9.8 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85806 | 9.8 | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-85792 | 9.8 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine |
| CVE-2026-84015 | 9.8 | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83935 | 9.8 | Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83910 | 9.8 | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83869 | 9.8 | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83862 | 9.8 | Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83782 | 9.8 | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83780 | 9.8 | Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83770 | 9.8 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83748 | 9.8 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83693 | 9.8 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83578 | 9.8 | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83517 | 9.8 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. |
| CVE-2026-83519 | 9.8 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70300 | 9.8 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| CVE-2026-70291 | 9.8 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
45 further critical CVEs are listed on NVD.
New advisories from CERTs and vendors
Canonical (Ubuntu)
- USN-8925-1: YAML-LibYAML vulnerabilities
- USN-8924-1: Linux kernel vulnerabilities
- USN-8918-1: Linux kernel (Azure) vulnerabilities
- USN-8921-1: Linux kernel vulnerabilities
- USN-8920-1: Linux kernel vulnerabilities
- USN-8923-1: Linux kernel vulnerabilities
- USN-8919-1: Linux kernel vulnerabilities
- USN-8922-1: Linux kernel (Oracle) vulnerabilities
- USN-8917-1: Linux kernel vulnerabilities
- USN-8916-1: PyJWT vulnerabilities
Debian
Canadian Centre for Cyber Security
- Fortinet security advisory (AV26-1037)
- Esri security advisory (AV26-1036)
- Microsoft security advisory – October 2026 monthly rollup (AV26-1038)
- Ivanti security advisory (AV26-1035)
- Citrix security advisory (AV26-1034)
- Commvault security advisory (AV26-1033)
- JetBrains security advisory (AV26-1032)
- Progress security advisory (AV26-1031)
- SAP security advisory – October 2026 monthly rollup (AV26-1030)
- MikroTik security advisory (AV26-1029)
- GitLab security advisory (AV26-1028)
- Dell security advisory (AV26-1027)
Microsoft MSRC
- CVE-2026-69955 Windows Client for NFS Information Disclosure Vulnerability
- CVE-2026-83884 Windows Human Interface Device Information Disclosure Vulnerability
- CVE-2026-97789 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-85928 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
- CVE-2026-100217 Windows Group Policy Elevation of Privilege Vulnerability
- CVE-2026-108471 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
- CVE-2026-108400 HEVC Video Extensions Remote Code Execution Vulnerability
- CVE-2026-96233 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-105727 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
- CVE-2026-105728 Dynamics Business Central Information Disclosure Vulnerability
- CVE-2026-105725 Windows Security App Elevation of Privilege Vulnerability
- ADV260001 ADV260001 Hardening changes for ReFS volumes on removable media
- CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
- CVE-2026-96222 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-108457 Microsoft Windows PDF Remote Code Execution Vulnerability
- CVE-2026-88086 Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-108468 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-96202 Windows Raw Image Extension Remote Code Execution Vulnerability
- CVE-2026-102227 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- CVE-2026-105005 Windows Schannel Remote Code Execution Vulnerability
- CVE-2026-102229 Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-97749 Microsoft Office Outlook Remote Code Execution Vulnerability
- CVE-2026-102231 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-70172 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-102232 Visual Studio Code Security Feature Bypass Vulnerability
Plus 35 more from Microsoft MSRC; see the source link below.