The National Vulnerability Database (NVD) published 12 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-110958 | 10 | A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. T… |
| CVE-2026-110957 | 10 | A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bi… |
| CVE-2026-104730 | 9.8 | The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless anothe… |
| CVE-2026-89079 | 9.8 | The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations. |
| CVE-2026-103768 | 9.8 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. |
| CVE-2026-109219 | 9.8 | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers t… |
| CVE-2026-109515 | 9.8 | The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlle… |
| CVE-2026-104798 | 9.8 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=…]` shortcode; `mc_generate_calendar_nav()` then splits the `above` … |
| CVE-2026-111329 | 9.8 | JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets. |
| CVE-2026-111322 | 9.8 | Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user. |
| CVE-2026-111281 | 9.8 | Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control. |
| CVE-2026-111283 | 9 | BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter… |
New advisories from CERTs and vendors
Debian
- DSA-6565-1 spip – security update
- DSA-6566-1 expat – security update
- DSA-6562-1 chromium – security update
- DSA-6563-1 mutt – security update
- DSA-6564-1 jpeg-xl – security update
Canadian Centre for Cyber Security
- SUSE Linux security advisory (AV26-1053)
- [Control systems] Johnson Controls security advisory (AV26-1052)
- [Control systems] Schneider Electric security advisory (AV26-1051)
- JetBrains security advisory (AV26-1050)
- F5 security advisory (AV26-1049)
- SonicWall security advisory (AV26-1048)
- Drupal security advisory (AV26-1047)
- HPE security advisory (AV26-1046)
- Google security advisory (AV26-1045)
- n8n security advisory (AV26-1044)
- Juniper Networks security advisory (AV26-1043)
Canonical (Ubuntu)
- USN-8933-1: RabbitMQ Server vulnerabilities
- USN-8922-2: Linux kernel (Azure) vulnerabilities
- USN-8883-2: Go vulnerability
Microsoft MSRC
- CVE-2026-85363 .NET Framework Elevation of Privilege Vulnerability
- CVE-2026-96957 .NET Security Feature Bypass Vulnerability
- CVE-2026-97778 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-88185 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-97766 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-97747 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-108429 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-97772 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-108427 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108428 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-108426 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-105718 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-105715 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-97769 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-108430 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-97738 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-108431 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-70162 .NET Denial of Service Vulnerability
- CVE-2026-108432 Microsoft Office Word Remote Code Execution Vulnerability
- CVE-2026-97752 Microsoft Office Excel Remote Code Execution Vulnerability
- CVE-2026-108433 Microsoft Office Word Security Feature Bypass Vulnerability
- CVE-2026-108434 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-70281 Microsoft Office Outlook Information Disclosure Vulnerability
- CVE-2026-108435 Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-88210 Microsoft Office Word Security Feature Bypass Vulnerability
Plus 32 more from Microsoft MSRC; see the source link below.
CISA
- ICSA-26-288-01: Eclipse Foundation Eclipse Milo
- ICSA-26-288-02: Guangzhou Juan IoT Technology EseeCloud
CERT-FR
- Multiples vulnérabilités dans les produits Symfony (15 octobre 2026)
- Multiples vulnérabilités dans Moodle (15 octobre 2026)
- Multiples vulnérabilités dans les produits Palo Alto Networks (15 octobre 2026)
- Multiples vulnérabilités dans Drupal (15 octobre 2026)
- Vulnérabilité dans les produits Microsoft (15 octobre 2026)
- Multiples vulnérabilités dans les produits Juniper Networks (15 octobre 2026)
- Multiples vulnérabilités dans Sonicwall Network Security Manager (15 octobre 2026)
- Vulnérabilité dans Cisco AsyncOS Software pour Secure Email Gateway (15 octobre 2026)
- Multiples vulnérabilités dans les produits F5 (15 octobre 2026)
- Vulnérabilité dans PostgreSQL psqlODBC (15 octobre 2026)