The National Vulnerability Database (NVD) published 8 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-119145 | 9.9 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server. |
| CVE-2026-107327 | 9.9 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization. |
| CVE-2026-107328 | 9.9 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. |
| CVE-2026-107329 | 9.9 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. |
| CVE-2026-103039 | 9.8 | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes =>… |
| CVE-2026-93680 | 9.8 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. |
| CVE-2026-110186 | 9.8 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. |
| CVE-2026-104339 | 9.8 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. |
New advisories from CERTs and vendors
Canonical (Ubuntu)
Canadian Centre for Cyber Security
CERT-FR
- Vulnérabilité dans les produits NetApp (29 octobre 2026)
- Multiples vulnérabilités dans Elastic Cloud Enterprise (29 octobre 2026)
- Multiples vulnérabilités dans Veeam Backup for Microsoft 365 (29 octobre 2026)
- Multiples vulnérabilités dans PostgreSQL Anonymizer (29 octobre 2026)
- Vulnérabilité dans les produits Kaspersky (29 octobre 2026)
- Vulnérabilité dans Mattermost Server (29 octobre 2026)
- Multiples vulnérabilités dans les produits Juniper Networks (29 octobre 2026)
- Multiples vulnérabilités dans WordPress (29 octobre 2026)
- Multiples vulnérabilités dans Apache Kafka (29 octobre 2026)
- Vulnérabilité dans les produits ESET (29 octobre 2026)
- Vulnérabilité dans les produits Cisco (29 octobre 2026)
- Multiples vulnérabilités dans Foxit Online Services (29 octobre 2026)