The National Vulnerability Database (NVD) published 14 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-104736 | 9.8 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize(… |
| CVE-2026-111711 | 9.8 | Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code. |
| CVE-2026-111704 | 9.8 | LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data. |
| CVE-2026-111708 | 9.8 | WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections. |
| CVE-2026-111690 | 9.8 | Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens. |
| CVE-2026-111692 | 9.8 | DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API. |
| CVE-2026-111693 | 9.8 | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes. |
| CVE-2026-111687 | 9.8 | WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account. |
| CVE-2026-111673 | 9.8 | IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover. |
| CVE-2026-111643 | 9.8 | Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator. |
| CVE-2026-111641 | 9.8 | FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control. |
| CVE-2026-111626 | 9.8 | Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control. |
| CVE-2026-102764 | 9.8 | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance. |
| CVE-2026-110653 | 9.1 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10`… |
New advisories from CERTs and vendors
Canadian Centre for Cyber Security
- Google security advisory (AV26-1060)
- BMC Helix security advisory (AV26-1059)
- Progress security advisory (AV26-1058)
- Mozilla security advisory (AV26-1057)
- Palo Alto Networks security advisory (AV26-1056)
- [Control Systems] Moxa security advisory (AV26-1055)
Microsoft MSRC
- Chromium CVE-2026-106292: Buffer overflow
- Chromium CVE-2026-106207: Race condition
- Chromium CVE-2026-106412: Race condition
- Chromium CVE-2026-106228: Confused deputy
- Chromium CVE-2026-106293: Type confusion
- CVE-2026-85822 Windows exFAT File System Elevation of Privilege Vulnerability
- Chromium CVE-2026-106413: Race condition
- CVE-2026-70583 Windows Core Messaging Elevation of Privilege Vulnerability
- Chromium CVE-2026-106294: Incomplete cleanup
- Chromium CVE-2026-106370: Uninitialized resource
- Chromium CVE-2026-106415: Information leak
- Chromium CVE-2026-106379: Uninitialized resource
- Chromium CVE-2026-106295: Incorrect authorization
- Chromium CVE-2026-106389: Incorrect authorization
- Chromium CVE-2026-106416: Code injection
- Chromium CVE-2026-106399: Out of bounds read
- Chromium CVE-2026-106297: Incorrect authorization
- Chromium CVE-2026-106411: Use after free
- Chromium CVE-2026-106417: Integer overflow
- Chromium CVE-2026-106185: Improper input validation
- Chromium CVE-2026-106299: Improper input validation
- Chromium CVE-2026-106194: Missing authorization
- Chromium CVE-2026-106418: Missing authorization
- Chromium CVE-2026-106202: Uninitialized resource
- Chromium CVE-2026-106300: Race condition
Plus 131 more from Microsoft MSRC; see the source link below.
Debian
- DSA-6567-1 cifs-utils – security update
- DSA-6569-1 apache2 – security update
- DSA-6568-1 linux – security update
CERT-FR
- Multiples vulnérabilités dans les produits Microsoft (16 octobre 2026)
- Multiples vulnérabilités dans les produits Mattermost (16 octobre 2026)
- Multiples vulnérabilités dans le noyau Linux de SUSE (16 octobre 2026)
- Multiples vulnérabilités dans le noyau Linux d'Ubuntu (16 octobre 2026)
- Multiples vulnérabilités dans les produits IBM (16 octobre 2026)
- Multiples vulnérabilités dans Google Chrome (16 octobre 2026)
- Multiples vulnérabilités dans Moxa AIG-302 Series (16 octobre 2026)
- Multiples vulnérabilités dans Microsoft Office (16 octobre 2026)
- Multiples vulnérabilités dans le noyau Linux de Red Hat (16 octobre 2026)
- Multiples vulnérabilités dans Traefik (16 octobre 2026)