The National Vulnerability Database (NVD) published 36 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-110536 | 10 | A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. |
| CVE-2026-108587 | 9.8 | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for u… |
| CVE-2026-101982 | 9.8 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service. |
| CVE-2026-101983 | 9.8 | A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured. |
| CVE-2026-101954 | 9.8 | An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled. |
| CVE-2026-76519 | 9.8 | A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment… |
| CVE-2026-33796 | 9.8 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring. |
| CVE-2026-33789 | 9.8 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. |
| CVE-2026-33792 | 9.8 | A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel. |
| CVE-2026-109439 | 9.8 | Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes… |
| CVE-2026-102182 | 9.8 | A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; |
| CVE-2026-102175 | 9.8 | A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection. |
| CVE-2026-102178 | 9.8 | A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. |
| CVE-2026-102031 | 9.8 | An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. |
| CVE-2026-101990 | 9.8 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement. |
| CVE-2026-101980 | 9.8 | An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash. |
| CVE-2026-101986 | 9.8 | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. |
| CVE-2026-101956 | 9.8 | An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web web interface. |
| CVE-2026-101950 | 9.8 | A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets reaching an interface configured for Secure Vector Routing. |
| CVE-2026-110645 | 9.8 | Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges. |
| CVE-2026-110649 | 9.8 | Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(…) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs. |
| CVE-2026-110650 | 9.8 | The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges. |
| CVE-2026-110639 | 9.8 | @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges. |
| CVE-2026-110640 | 9.8 | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges. |
| CVE-2026-110643 | 9.8 | transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges. |
| CVE-2026-110644 | 9.8 | nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges. |
| CVE-2026-110634 | 9.8 | git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges. |
| CVE-2026-110635 | 9.8 | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process. |
| CVE-2026-110636 | 9.8 | pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process. |
| CVE-2026-110638 | 9.8 | doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(…) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges. |
| CVE-2026-110631 | 9.8 | Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts ty… |
| CVE-2026-110612 | 9.8 | vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances. |
| CVE-2020-37282 | 9.8 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(…), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges. |
| CVE-2026-16741 | 9.8 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.
This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331. |
| CVE-2026-16740 | 9.8 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.
This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331. |
| CVE-2026-110862 | 9.1 | Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts. |
New advisories from CERTs and vendors
Canonical (Ubuntu)
- USN-8932-1: curl vulnerabilities
- USN-8931-1: Apache HTTP Server vulnerabilities
- USN-8930-1: U-Boot vulnerabilities
- USN-8929-1: Bind vulnerabilities
- USN-8928-1: OpenSSH vulnerabilities
- USN-8927-1: curl vulnerabilities
- USN-8926-1: urllib3 vulnerabilities
- USN-8908-2: BlueZ regression
Canadian Centre for Cyber Security
- Palo Alto Networks security advisory (AV26-1041)
- IBM security advisory (AV26-1040)
- Adobe security advisory (AV26-1039)
Cisco PSIRT
- Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
- Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Microsoft MSRC
- CVE-2026-32176 SQL Server Elevation of Privilege Vulnerability
- CVE-2026-81352 Web Media Extensions Remote Code Execution Vulnerability
- CVE-2026-72937 Windows Storage Port Driver Information Disclosure Vulnerability
- CVE-2026-62697 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-68825 Windows Bind Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-77499 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-70584 Windows Core Messaging Elevation of Privilege Vulnerability
- CVE-2026-69334 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
- CVE-2026-85870 Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2026-102188 Windows Storage Port Driver Elevation of Privilege Vulnerability
- CVE-2026-85868 Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CVE-2026-84019 Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
- CVE-2026-70245 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2026-69351 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability
- CVE-2026-69366 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-69620 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability
- CVE-2026-105723 Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
- CVE-2026-70095 Windows iSCSI Remote Code Execution Vulnerability
- CVE-2026-70011 Windows IP Over USB Service Information Disclosure Vulnerability
- CVE-2026-70287 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-88168 Windows Bind Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-83568 Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
- CVE-2026-105007 Windows NDIS Elevation of Privilege Vulnerability
- CVE-2026-96935 Windows NTFS Information Disclosure Vulnerability
Plus 34 more from Microsoft MSRC; see the source link below.
CERT-FR
- Multiples vulnérabilités dans MongoDB Server (14 octobre 2026)
- Multiples vulnérabilités dans Microsoft Windows (14 octobre 2026)
- Multiples vulnérabilités dans les produits Fortinet (14 octobre 2026)
- Vulnérabilité dans Symantec Endpoint Detection and Response (14 octobre 2026)
- Multiples vulnérabilités dans les produits Microsoft (14 octobre 2026)
- Multiples vulnérabilités dans Microsoft .Net (14 octobre 2026)
- Multiples vulnérabilités dans les produits Citrix (14 octobre 2026)
- Multiples vulnérabilités dans Xen (14 octobre 2026)
- Multiples vulnérabilités dans Curl (14 octobre 2026)
- Vulnérabilité dans Zabbix (14 octobre 2026)
- Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)
- Multiples vulnérabilités dans les produits Ivanti (14 octobre 2026)
- Multiples vulnérabilités dans Microsoft Office (14 octobre 2026)
- Multiples vulnérabilités dans les produits Adobe (14 octobre 2026)
- Multiples vulnérabilités dans Microsoft Azure (14 octobre 2026)
- Multiples vulnérabilités dans Google Chrome (14 octobre 2026)
- Multiples vulnérabilités dans les produits Mozilla (14 octobre 2026)
- Multiples vulnérabilités dans les produits Siemens (13 octobre 2026)
- Vulnérabilité dans Schneider Electric Harmony (13 octobre 2026)
- Multiples vulnérabilités dans Mozilla Firefox (13 octobre 2026)
- Vulnérabilité dans Typo3 (13 octobre 2026)
- Multiples vulnérabilités dans les produits SAP (13 octobre 2026)
FreeBSD
- FreeBSD-EN-26:25.tzdata
- FreeBSD-SA-26:72.bhyve
- FreeBSD-EN-26:27.tcp
- FreeBSD-SA-26:70.tcp
- FreeBSD-EN-26:26.hastd
- FreeBSD-SA-26:71.sound