The National Vulnerability Database (NVD) published 12 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-118235 | 9.8 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. Th… |
| CVE-2026-119096 | 9.8 | The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()`… |
| CVE-2026-116512 | 9.8 | The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP funct… |
| CVE-2026-109220 | 9.8 | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by… |
| CVE-2026-119706 | 9.8 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process. |
| CVE-2026-119660 | 9.8 | MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots. |
| CVE-2026-119597 | 9.8 | OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys. |
| CVE-2026-103882 | 9.1 | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can eas… |
| CVE-2026-89270 | 9.1 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. T… |
| CVE-2026-116557 | 9.1 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar. |
| CVE-2026-104317 | 8.1 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. |
| CVE-2026-18894 | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code. |
New advisories from CERTs and vendors
Debian
- DSA-6597-1 dpdk – security update
- DSA-6598-1 thunderbird – security update
Canadian Centre for Cyber Security
- Linux security advisory (AV26-1108)
- MongoDB security advisory (AV26-1107)
- HashiCorp security advisory (AV26-1106)
Microsoft MSRC
- CVE-2026-69446 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- CVE-2026-118147 Visual Studio Spoofing Vulnerability
CERT-FR
- Vulnérabilité dans Stormshield Management Center (30 octobre 2026)
- Multiples vulnérabilités dans les produits Apple (30 octobre 2026)
- Vulnérabilité dans CPython (30 octobre 2026)
- Multiples vulnérabilités dans Google Chrome (30 octobre 2026)
- Vulnérabilité dans Tenable Nessus Plugin (30 octobre 2026)
- Multiples vulnérabilités dans le noyau Linux de SUSE (30 octobre 2026)
- Multiples vulnérabilités dans les produits MongoDB (30 octobre 2026)
- Multiples vulnérabilités dans le noyau Linux de Red Hat (30 octobre 2026)
- Multiples vulnérabilités dans Suricata (30 octobre 2026)
- Multiples vulnérabilités dans Veeam Management Pack (30 octobre 2026)
- Vulnérabilité dans GitLab (30 octobre 2026)
- Multiples vulnérabilités dans les produits IBM (30 octobre 2026)
- Vulnérabilité dans Ruby on Rails trilogy (30 octobre 2026)