The National Vulnerability Database (NVD) published 22 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-76482 | 10 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76482 are related… |
| CVE-2026-85097 | 9.8 | The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot fi… |
| CVE-2026-107459 | 9.8 | The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server. |
| CVE-2026-76268 | 9.8 | In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more … |
| CVE-2026-76501 | 9.8 | A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device.
This vulnerability is due to improper input validation of IP traffic when the NGOAM and SRv6 features are ena… |
| CVE-2026-76485 | 9.8 | A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device.
This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this v… |
| CVE-2026-76486 | 9.8 | A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device.
This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this v… |
| CVE-2026-76498 | 9.8 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76498 are related to improper access control is… |
| CVE-2026-76499 | 9.8 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization is… |
| CVE-2026-76500 | 9.8 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76500 are related to issues with imprope… |
| CVE-2026-76471 | 9.8 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.
The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-AP… |
| CVE-2026-76480 | 9.8 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76480 are related… |
| CVE-2026-76465 | 9.8 | A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper validation when an affected… |
| CVE-2026-76455 | 9.8 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76455 are related to improper access control issues that are grouped under the Common Weak… |
| CVE-2026-107204 | 9.8 | LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process. |
| CVE-2026-76464 | 9.6 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by this CVE-2026-76464 are related to buffer management issues that are grouped under the Common … |
| CVE-2026-106237 | 9.6 | Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-107206 | 9.4 | LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' cached data. |
| CVE-2026-17609 | 9.1 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This… |
| CVE-2026-76483 | 9.1 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76483 are … |
| CVE-2026-76454 | 9.1 | A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.
This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit… |
| CVE-2026-20328 | 9.1 | A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application.
This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-base… |
New advisories from CERTs and vendors
Microsoft MSRC
- Chromium: CVE-2025-11215 Off by one error in V8
- Chromium: CVE-2025-11219 Use after free in V8
- CVE-2026-69436 Windows State Repository Service Elevation of Privilege Vulnerability
Canonical (Ubuntu)
- USN-8896-1: GStreamer Ugly Plugins vulnerabilities
- USN-8900-1: Go Networking vulnerabilities
- USN-8897-1: lxml vulnerabilities
- USN-8895-1: Sudo vulnerability
- USN-8894-1: poppler vulnerabilities
- LSN-0122-1: Kernel Live Patch Security Notice
- USN-8891-1: librsvg vulnerability
Canadian Centre for Cyber Security
- SonicWall security advisory (AV26-1017)
- wolfSSL security advisory (AV26-1016)
- Arista Networks security advisory (AV26-1015)
- AMD security advisory (AV26-1014)
- Qualcomm security advisory (AV26-1013)
- JetBrains security advisory (AV26-1012)
- HPE security advisory (AV26-1011)
- [Control Systems] Johnson Controls security advisory (AV26-1010)
- Veeam security advisory (AV26-1009)
- Broadcom VMware security advisory (AV26-1008)
- GitHub security advisory (AV26-1007)
- Google security advisory (AV26-1006)
Cisco PSIRT
- Cisco License (Smart Software Manager) On-Prem Vulnerabilities
- Cisco NX-OS Software Python Sandbox Escape Vulnerability
- Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
- Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026
- Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities
- Cisco Meraki Security Hardening Release: October 2026
- Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability
- Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026
- Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability
- Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability
- Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability
- Cisco Finesse Server-Side Request Forgery Vulnerability
- Cisco NX-OS Software Security Hardening Release: October 2026
- Cisco NX-OS Software Control Plane Denial of Service Vulnerability
CERT-FR
- Multiples vulnérabilités dans Google Pixel (07 octobre 2026)
- Vulnérabilité dans les produits Mozilla (07 octobre 2026)
- Multiples vulnérabilités dans Google Chrome (07 octobre 2026)
- Multiples vulnérabilités dans les produits HPE Aruba Networking (07 octobre 2026)
- Multiples vulnérabilités dans Traefik (07 octobre 2026)
- Multiples vulnérabilités dans OpenSSH (07 octobre 2026)
- Multiples vulnérabilités dans Microsoft Edge (07 octobre 2026)
- Multiples vulnérabilités dans WordPress (07 octobre 2026)
- Multiples vulnérabilités dans GLPI (07 octobre 2026)
- Multiples vulnérabilités dans Sonicwall Secure Mobile Access (07 octobre 2026)
- Multiples vulnérabilités dans les produits Elastic (07 octobre 2026)
- Multiples vulnérabilités dans SPIP (07 octobre 2026)
- Multiples vulnérabilités dans les produits Veeam (07 octobre 2026)