🔴 CVE Digest — 30 Oct 2026
2 critical vulnerabilities
🔴 CVE-2026-119597 · CVSS 9.8
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to...
🔴 CVE-2026-119568 · CVSS 9.1
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-119597 · CVSS 9.8
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to...
🔴 CVE-2026-119568 · CVSS 9.1
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-119597 - OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin…
🔴 CVE Digest — 30 Oct 2026
10 critical vulnerabilities
🔴 CVE-2026-93327 · CVSS 9.4
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration...
🔴 CVE-2026-61738 · CVSS 10.0
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to...
🔴 CVE-2026-61737 · CVSS 9.8
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret...
🔴 CVE-2026-61730 · CVSS 9.3
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected...
🔴 CVE-2026-61729 · CVSS 9.4
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to...
🔴 CVE-2026-61728 · CVSS 9.9
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected...
🔴 CVE-2026-119660 · CVSS 9.8
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge...
🔴 CVE-2026-112905 · CVSS 9.0
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to...
🔴 CVE-2026-110799 · CVSS 9.8
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to...
🔴 CVE-2026-119706 · CVSS 9.8
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows...
#CVE #Critical #Vulnerability
10 critical vulnerabilities
🔴 CVE-2026-93327 · CVSS 9.4
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration...
🔴 CVE-2026-61738 · CVSS 10.0
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to...
🔴 CVE-2026-61737 · CVSS 9.8
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret...
🔴 CVE-2026-61730 · CVSS 9.3
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected...
🔴 CVE-2026-61729 · CVSS 9.4
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to...
🔴 CVE-2026-61728 · CVSS 9.9
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected...
🔴 CVE-2026-119660 · CVSS 9.8
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge...
🔴 CVE-2026-112905 · CVSS 9.0
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to...
🔴 CVE-2026-110799 · CVSS 9.8
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to...
🔴 CVE-2026-119706 · CVSS 9.8
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-93327 - Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted…
🔴 CVE Digest — 30 Oct 2026
3 critical vulnerabilities
🔴 CVE-2026-118697 · CVSS 9.0
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon...
🔴 CVE-2026-61826 · CVSS 10.0
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in...
🔴 CVE-2026-112816 · CVSS 10.0
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,...
#CVE #Critical #Vulnerability
3 critical vulnerabilities
🔴 CVE-2026-118697 · CVSS 9.0
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon...
🔴 CVE-2026-61826 · CVSS 10.0
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in...
🔴 CVE-2026-112816 · CVSS 10.0
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-118697 - JetBrains Toolbox and IntelliJ IDEA Improper Certificate Validation Vulnerability
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates
🔴 CVE Digest — 30 Oct 2026
7 critical vulnerabilities
🔴 CVE-2026-61620 · CVSS 9.8
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other...
🔴 CVE-2026-116241 · CVSS 9.9
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the...
🔴 CVE-2026-55598 · CVSS 9.1
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user...
🔴 CVE-2026-90888 · CVSS 9.8
Unauthenticated PHP Object Injection in LeadSnap
🔴 CVE-2026-39738 · CVSS 9.8
Unauthenticated PHP Object Injection in FunnelKit Automations
🔴 CVE-2026-39732 · CVSS 9.3
Unauthenticated SQL Injection in Transliterator
🔴 CVE-2026-119526 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
This issue affects...
#CVE #Critical #Vulnerability
7 critical vulnerabilities
🔴 CVE-2026-61620 · CVSS 9.8
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other...
🔴 CVE-2026-116241 · CVSS 9.9
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the...
🔴 CVE-2026-55598 · CVSS 9.1
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user...
🔴 CVE-2026-90888 · CVSS 9.8
Unauthenticated PHP Object Injection in LeadSnap
🔴 CVE-2026-39738 · CVSS 9.8
Unauthenticated PHP Object Injection in FunnelKit Automations
🔴 CVE-2026-39732 · CVSS 9.3
Unauthenticated SQL Injection in Transliterator
🔴 CVE-2026-119526 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
This issue affects...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-61620 - HoneySQL unchecked entity names can lead to SQL injection results
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection…
👍1
🔴 CVE Digest — 30 Oct 2026
6 critical vulnerabilities
🔴 CVE-2026-62863 · CVSS 9.6
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its...
🔴 CVE-2026-62853 · CVSS 9.9
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts...
🔴 CVE-2026-62849 · CVSS 9.1
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the...
🔴 CVE-2026-117666 · CVSS 9.1
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary...
🔴 CVE-2026-78403 · CVSS 9.8
Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows...
🔴 CVE-2026-61850 · CVSS 9.3
Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two...
#CVE #Critical #Vulnerability
6 critical vulnerabilities
🔴 CVE-2026-62863 · CVSS 9.6
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its...
🔴 CVE-2026-62853 · CVSS 9.9
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts...
🔴 CVE-2026-62849 · CVSS 9.1
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the...
🔴 CVE-2026-117666 · CVSS 9.1
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary...
🔴 CVE-2026-78403 · CVSS 9.8
Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows...
🔴 CVE-2026-61850 · CVSS 9.3
Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-62863 - MoLing: unauthenticated SSE and wildcard CORS expose tool sessions
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A…
🔴 CVE Digest — 31 Oct 2026
2 critical vulnerabilities
🔴 CVE-2026-117656 · CVSS 9.3
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth...
🔴 CVE-2026-63377 · CVSS 9.8
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-117656 · CVSS 9.3
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth...
🔴 CVE-2026-63377 · CVSS 9.8
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-117656 - Unverified Sign in with Apple callback parameter can override verified ID token claims
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple…
🔴 CVE Digest — 31 Oct 2026
5 critical vulnerabilities
🔴 CVE-2026-116512 · CVSS 9.8
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress...
🔴 CVE-2026-119096 · CVSS 9.8
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and...
🔴 CVE-2026-89270 · CVSS 9.1
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to...
🔴 CVE-2026-116557 · CVSS 9.1
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to...
🔴 CVE-2026-109220 · CVSS 9.8
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object...
#CVE #Critical #Vulnerability
5 critical vulnerabilities
🔴 CVE-2026-116512 · CVSS 9.8
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress...
🔴 CVE-2026-119096 · CVSS 9.8
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and...
🔴 CVE-2026-89270 · CVSS 9.1
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to...
🔴 CVE-2026-116557 · CVSS 9.1
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to...
🔴 CVE-2026-109220 · CVSS 9.8
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-116512 - Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized…
🔴 CVE Digest — 31 Oct 2026
2 critical vulnerabilities
🔴 CVE-2026-118235 · CVSS 9.8
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is...
🔴 CVE-2026-103882 · CVSS 9.1
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-118235 · CVSS 9.8
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is...
🔴 CVE-2026-103882 · CVSS 9.1
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-118235 - SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in…
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side…
🔴 CVE Digest — 31 Oct 2026
2 critical vulnerabilities
🔴 CVE-2026-120209 · CVSS 9.8
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens...
🔴 CVE-2026-120201 · CVSS 9.8
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-120209 · CVSS 9.8
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens...
🔴 CVE-2026-120201 · CVSS 9.8
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120209 - AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader…
🔴 CVE Digest — 31 Oct 2026
1 critical vulnerability
🔴 CVE-2026-118636 · CVSS 9.8
**UNSUPPORTED WHEN ASSIGNED**
JavaNativeMessageDecoder in the MINA 3.0 codec module calls...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-118636 · CVSS 9.8
**UNSUPPORTED WHEN ASSIGNED**
JavaNativeMessageDecoder in the MINA 3.0 codec module calls...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-118636 - Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the…
🔴 CVE Digest — 01 Nov 2026
1 critical vulnerability
🔴 CVE-2026-120189 · CVSS 10.0
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-120189 · CVSS 10.0
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120189 - D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack…
🔴 CVE Digest — 01 Nov 2026
3 critical vulnerabilities
🔴 CVE-2026-120197 · CVSS 9.9
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file...
🔴 CVE-2026-120196 · CVSS 9.9
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file...
🔴 CVE-2026-120195 · CVSS 10.0
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the...
#CVE #Critical #Vulnerability
3 critical vulnerabilities
🔴 CVE-2026-120197 · CVSS 9.9
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file...
🔴 CVE-2026-120196 · CVSS 9.9
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file...
🔴 CVE-2026-120195 · CVSS 10.0
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120197 - WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit…
🔴 CVE Digest — 01 Nov 2026
1 critical vulnerability
🔴 CVE-2026-120198 · CVSS 10.0
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-120198 · CVSS 10.0
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120198 - WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack…
🔴 CVE Digest — 01 Nov 2026
2 critical vulnerabilities
🔴 CVE-2026-120225 · CVSS 9.1
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function...
🔴 CVE-2026-120224 · CVSS 9.9
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-120225 · CVSS 9.1
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function...
🔴 CVE-2026-120224 · CVSS 9.9
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120225 - Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack…
🔴 CVE Digest — 01 Nov 2026
6 critical vulnerabilities
🔴 CVE-2026-120229 · CVSS 9.1
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the...
🔴 CVE-2026-120228 · CVSS 9.9
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the...
🔴 CVE-2026-120308 · CVSS 9.9
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path...
🔴 CVE-2026-120307 · CVSS 9.9
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the...
🔴 CVE-2026-120306 · CVSS 9.9
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on...
🔴 CVE-2026-120227 · CVSS 9.9
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file...
#CVE #Critical #Vulnerability
6 critical vulnerabilities
🔴 CVE-2026-120229 · CVSS 9.1
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the...
🔴 CVE-2026-120228 · CVSS 9.9
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the...
🔴 CVE-2026-120308 · CVSS 9.9
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path...
🔴 CVE-2026-120307 · CVSS 9.9
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the...
🔴 CVE-2026-120306 · CVSS 9.9
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on...
🔴 CVE-2026-120227 · CVSS 9.9
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120229 - WAVLINK WN553X1-B ioos sub_416B50 os command injection
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely.…
🔴 CVE Digest — 01 Nov 2026
4 critical vulnerabilities
🔴 CVE-2026-62048 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web /...
🔴 CVE-2026-120338 · CVSS 10.0
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno...
🔴 CVE-2026-120231 · CVSS 9.9
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of...
🔴 CVE-2026-120230 · CVSS 9.9
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web...
#CVE #Critical #Vulnerability
4 critical vulnerabilities
🔴 CVE-2026-62048 · CVSS 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web /...
🔴 CVE-2026-120338 · CVSS 10.0
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno...
🔴 CVE-2026-120231 · CVSS 9.9
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of...
🔴 CVE-2026-120230 · CVSS 9.9
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-62048 - WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
🔴 CVE Digest — 01 Nov 2026
2 critical vulnerabilities
🔴 CVE-2026-120239 · CVSS 9.9
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the...
🔴 CVE-2026-120238 · CVSS 9.9
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-120239 · CVSS 9.9
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the...
🔴 CVE-2026-120238 · CVSS 9.9
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120239 - WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection.…
🔴 CVE Digest — 01 Nov 2026
1 critical vulnerability
🔴 CVE-2026-120240 · CVSS 9.9
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-120240 · CVSS 9.9
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120240 - WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command…
🔴 CVE Digest — 02 Nov 2026
2 critical vulnerabilities
🔴 CVE-2026-120277 · CVSS 10.0
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function...
🔴 CVE-2026-120276 · CVSS 10.0
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-120277 · CVSS 10.0
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function...
🔴 CVE-2026-120276 · CVSS 10.0
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120277 - WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command…
🔴 CVE Digest — 02 Nov 2026
6 critical vulnerabilities
🔴 CVE-2026-120322 · CVSS 9.9
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file...
🔴 CVE-2026-120283 · CVSS 10.0
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file...
🔴 CVE-2026-120282 · CVSS 9.9
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file...
🔴 CVE-2026-120281 · CVSS 10.0
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of...
🔴 CVE-2026-120280 · CVSS 10.0
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group...
🔴 CVE-2026-120279 · CVSS 10.0
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file...
#CVE #Critical #Vulnerability
6 critical vulnerabilities
🔴 CVE-2026-120322 · CVSS 9.9
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file...
🔴 CVE-2026-120283 · CVSS 10.0
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file...
🔴 CVE-2026-120282 · CVSS 9.9
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file...
🔴 CVE-2026-120281 · CVSS 10.0
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of...
🔴 CVE-2026-120280 · CVSS 10.0
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group...
🔴 CVE-2026-120279 · CVSS 10.0
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-120322 - Termix-SSH Termix transferToHost path traversal
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated…