The National Vulnerability Database (NVD) published 11 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-102427 | 10 | Joomla Extension – ordasoft.com – Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 – site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restric… |
| CVE-2026-96658 | 9.9 | A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server. |
| CVE-2026-94541 | 9.8 | The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the ma… |
| CVE-2026-97637 | 9.8 | The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()` endpoint — which … |
| CVE-2026-19660 | 9.8 | The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, allowing it to trust an entirely attacker-controlled user ID value that … |
| CVE-2026-14378 | 9.8 | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cookie as the privileged identity: `verify_nonce_and_capability()` incorrectly checks the `manage_options` capability on the user identified by the cookie rather t… |
| CVE-2026-103764 | 9.8 | Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code executi… |
| CVE-2026-103765 | 9.4 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory. |
| CVE-2026-15896 | 9.1 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is req… |
| CVE-2026-96659 | 9.1 | A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root passwords. Furthermore, under insecure system configurations where Safemode protections are disabled, the flaw may allow the user… |
| CVE-2026-86345 | 9 | A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to… |
New advisories from CERTs and vendors
Canonical (Ubuntu)
- USN-8864-1: Linux kernel vulnerabilities
- USN-8816-4: Linux kernel (GKE) vulnerabilities
- USN-8818-6: Linux kernel (FIPS) vulnerabilities
- USN-8851-2: Linux kernel (Raspberry Pi) vulnerabilities
- USN-8863-1: GStreamer Good Plugins vulnerabilities
- USN-8862-1: libXpm vulnerability
- USN-8861-1: OpenSSL vulnerabilities
- USN-8860-1: OpenStack Designate vulnerability
- USN-8857-1: KCoreAddons vulnerability
CERT-FR
- Vulnérabilités de produits du secteur santé : Retour d'expérience du CERT Santé et du CERT-FR (02 octobre 2026)
- Multiples vulnérabilités dans CPython (01 octobre 2026)
- Multiples vulnérabilités dans Redmine (01 octobre 2026)
- Multiples vulnérabilités dans Mozilla Thunderbird (01 octobre 2026)
- Vulnérabilité dans Cisco Catalyst SD-WAN (01 octobre 2026)
Canadian Centre for Cyber Security
- Kiteworks security advisory (AV26-988)
- Fortra security advisory (AV26-987)
- MISP security advisory (AV26-986)
- n8n security advisory (AV26-985)
- Google security advisory (AV26-984)
- [Control systems] CODESYS security advisory (AV26-983)
- HPE security advisory (AV26-982)
- WatchGuard security advisory (AV26-981)
- OpenSSL security advisory (AV26-980)
- JetBrains security advisory (AV26-979)
CISA
- VA-26-275-05: Cadmos LTI
- VA-26-275-02: C-Open CANopen stack multiple vulnerabilities
- VA-26-275-04: wormhole.app WebRTC TURN relay
- VA-26-274-03: Joyland AI multiple vulnerabilities
- ICSA-26-274-01: Armatura LLC Armatura One
- ICSA-26-274-02: Monta monta.app
- ICSA-26-274-03: ABB Protection and Control IED Manager PCM600
- ICSA-26-274-04: Johnson Controls EasyIO Neo Series EC and CW Controllers
- ICSA-26-274-05: Johnson Controls EasyIO Neo Series EC and CW Controllers
- ICSA-26-274-06: Meari IoT Cloud Platform OpenAPI Service