The National Vulnerability Database (NVD) published 7 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-42922 | 9.8 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. |
| CVE-2026-109516 | 9.8 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.c… |
| CVE-2026-118579 | 9.8 | A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. |
| CVE-2026-118690 | 9.8 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control. |
| CVE-2026-103409 | 9.8 | A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.
Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device… |
| CVE-2026-103406 | 9.8 | An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID. |
| CVE-2026-117574 | 9.1 | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This fl… |
New advisories from CERTs and vendors
Microsoft MSRC
- CVE-2026-19175 Use after free in Payments
- CVE-2026-62740 Windows Imaging Component Information Disclosure Vulnerability
- CVE-2026-62877 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-57083 Windows Media Photo Codec Information Disclosure Vulnerability
- CVE-2026-57084 Windows File Explorer Information Disclosure Vulnerability
- Chromium: CVE-2026-79293 Information leak in Animation
- Chromium: CVE-2026-79292 Integer overflow in Chromecast
- Chromium: CVE-2026-79291 Information leak in CSS
- Chromium: CVE-2026-79290 Use after free in Aura
- Chromium: CVE-2026-79289 Improper control of a resource through its lifetime in Workers
- Chromium: CVE-2026-79287 Observable discrepancy in Forms
- Chromium: CVE-2026-79285 Uninitialized resource in ANGLE
- Chromium: CVE-2026-79284 UI misrepresentation in Core
- Chromium: CVE-2026-79283 UI misrepresentation in Geometry
- Chromium: CVE-2026-79276 Improper privilege management in FileSystem
- Chromium: CVE-2026-79275 Use after free in ANGLE
- Chromium: CVE-2026-79274 Information leak in GPU
- Chromium: CVE-2026-79272 Improper input validation in FindInPage
- Chromium: CVE-2026-79271 Information leak in DOM
- Chromium: CVE-2026-79179 Incorrect authorization in DOM
- Chromium: CVE-2026-79270 Uninitialized resource in ANGLE
- Chromium: CVE-2026-79269 Uninitialized resource in ANGLE
- Chromium: CVE-2026-79178 Incorrect authorization in Web Authentication (Passkeys & Security Keys)
- Chromium: CVE-2026-79177 Incorrect authorization in Media
- Chromium: CVE-2026-79267 Race condition in Workers
Plus 35 more from Microsoft MSRC; see the source link below.
Cisco PSIRT
- Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
- Cisco Advance Notification for Publication of November 4, 2026, Security Advisories
Canadian Centre for Cyber Security
- VMware security advisory (AV26-763) – Update 2
- Juniper Networks security advisory (AV26-1101)
- Mozilla security advisory (AV26-1100)
- Apple security advisory (AV26-1099)
- AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
- Progress security advisory (AV26-1098)
- Tanium security advisory (AV26-1097)
- Veeam security advisory (AV26-1096)
- Google Chrome security advisory (AV26-1095)
- WatchGuard security advisory (AV26-1094)
- TeamViewer security advisory (AV26-1093)
- Adobe security advisory (AV26-1092)
CERT-FR
- Multiples vulnérabilités dans les produits Veeam (28 octobre 2026)
- Vulnérabilité dans CPython (28 octobre 2026)
- Multiples vulnérabilités dans Palo Alto Networks PAN-OS (28 octobre 2026)
- Multiples vulnérabilités dans Mitel OpenScape Endpoint Management (28 octobre 2026)
- Multiples vulnérabilités dans Google Chrome (28 octobre 2026)
- Vulnérabilité dans Axis Camera Station Pro (28 octobre 2026)
- Vulnérabilité dans les produits Belden (28 octobre 2026)
- Multiples vulnérabilités dans Docker Desktop (28 octobre 2026)
- Multiples vulnérabilités dans Microsoft Edge (28 octobre 2026)
- Vulnérabilité dans Samba (28 octobre 2026)
- Multiples vulnérabilités dans Metabase (28 octobre 2026)
- Multiples vulnérabilités dans les produits Mozilla (28 octobre 2026)
Debian
- DSA-6592-1 chromium – security update
- DSA-6590-1 firefox-esr – security update
- DSA-6591-1 openjdk-25 – security update
- DSA-6589-1 php-mongodb – security update
- DSA-6587-1 pdns – security update
- DSA-6588-1 openjdk-21 – security update
- DSA-6585-2 thunderbird – regression update