The National Vulnerability Database (NVD) published 16 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-114575 | 10 | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used. |
| CVE-2026-114383 | 10 | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. |
| CVE-2026-114382 | 10 | A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. |
| CVE-2026-114268 | 9.9 | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. |
| CVE-2021-48014 | 9.8 | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Sh… |
| CVE-2021-48016 | 9.8 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14. |
| CVE-2026-76474 | 9.8 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have … |
| CVE-2026-76466 | 9.8 | A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.
This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for cluste… |
| CVE-2026-76473 | 9.8 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have … |
| CVE-2026-109618 | 9.8 | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code e… |
| CVE-2026-109619 | 9.8 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code ex… |
| CVE-2026-76475 | 9.3 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have … |
| CVE-2022-51022 | 9.1 | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation eviden… |
| CVE-2026-114220 | 9.1 | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server. |
| CVE-2026-91403 | 9.1 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with… |
| CVE-2026-20043 | 9 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that… |
New advisories from CERTs and vendors
Canonical (Ubuntu)
- USN-8890-2: libsoup vulnerabilities
- USN-8951-1: c-ares vulnerabilities
- USN-8947-1: NSS update
- USN-8950-1: poppler vulnerability
- USN-8930-2: U-Boot vulnerabilities
- USN-8949-1: Ghostscript vulnerabilities
- USN-8948-2: PHP vulnerabilities
- USN-8948-1: PHP vulnerabilities
- USN-8946-1: Unbound vulnerabilities
Cisco PSIRT
- Vulnerabilities in PHP Affecting Cisco Products: October 2026
- Multiple Cisco Products Snort 3 Denial of Service Vulnerability
- Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
- Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability
- Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
- Cisco Unified Communications Products Security Hardening Release: October 2026
- Cisco Expressway Series Remote Code Execution Vulnerability
- Cisco Expressway Series Security Hardening Release: October 2026
- Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
- Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
- Cisco Unified Communications Manager Improper Access Control Vulnerability
- Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
- Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
- Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
- Cisco Expressway Series Information Disclosure Vulnerability
Canadian Centre for Cyber Security
- Cisco security advisory (AV26-1073)
- ISC BIND security advisory (AV26-1072)
- Oracle Corporation security advisory (AV26-1071)
- PHP security advisory (AV26-1070)
- Google Chrome security advisory (AV26-1069)
- SolarWinds security advisory (AV26-1068)
CISA
Microsoft MSRC
- CVE-2026-97783 Microsoft Office SharePoint Spoofing Vulnerability
- CVE-2026-69902 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-83709 Windows NTLM Elevation of Privilege Vulnerability
- CVE-2026-61359 Windows Storage Elevation of Privilege Vulnerability
CERT-FR
- Multiples vulnérabilités dans PHP (21 octobre 2026)
- Multiples vulnérabilités dans les produits Mozilla (21 octobre 2026)
- Multiples vulnérabilités dans les produits StormShield (21 octobre 2026)
- Vulnérabilité dans MongoDB PHP Driver (21 octobre 2026)
- Multiples vulnérabilités dans Google Chrome (21 octobre 2026)
- Multiples vulnérabilités dans Mattermost Server (21 octobre 2026)
- Vulnérabilité dans Traefik (21 octobre 2026)
- Multiples vulnérabilités dans Apache Tomcat (21 octobre 2026)
- Multiples vulnérabilités dans Oracle Weblogic (21 octobre 2026)