Cybersecurity Weekly News Review
The past 7 days of vulnerabilities and security news, compiled from CVE.org, NIST NVD, CISA and The Hacker News.
Covering Oct 27, 2026 07:13 – Nov 3, 2026 07:13 UTC
This week at a glance
- Published
- 3,129
- Critical
- 280
- High
- 1,007
- Medium
- 1,094
- Low
- 117
- Unscored
- 631
- Known exploited
- 1
- Added to CISA KEV
- 8
Added to CISA KEV this week
| CVE | Vendor / Product | Vulnerability | Date added | CISA due date | Ransomware |
|---|---|---|---|---|---|
| CVE-2026-118527 | Ivanti / Connect Secure | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Oct 30, 2026 | Nov 13, 2026 | — |
| CVE-2026-111357 | Ivanti / Connect Secure | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | Oct 30, 2026 | Nov 2, 2026 | — |
| CVE-2026-97229 | GitLab / Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | Oct 29, 2026 | Nov 1, 2026 | — |
| CVE-2026-76418 | Cisco / Secure Firewall ASA Software and Cisco Secure FTD Software | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | Oct 29, 2026 | Nov 1, 2026 | — |
| CVE-2026-46300 | Linux / Kernel | Linux Kernel Missing Initialization of a Variable Vulnerability | Oct 28, 2026 | Oct 31, 2026 | — |
| CVE-2026-41709 | Broadcom / VMware ESX | Broadcom VMWare ESX Insufficient Logging Vulnerability | Oct 28, 2026 | Nov 11, 2026 | — |
| CVE-2026-48356 | Adobe / Commerce and Magento | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | Oct 27, 2026 | Nov 10, 2026 | — |
| CVE-2026-111497 | Google / Brotli | Google Brotli Unchecked Return Value Vulnerability | Oct 27, 2026 | Nov 10, 2026 | — |
CVEs published in the past 7 days, ranked
Ranked by known exploitation (CISA KEV) first, then severity, then CVSS score.
| Rank | CVE | Title | Severity | Exploited | Published |
|---|---|---|---|---|---|
| 1 | CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability | Oct 28, 2026 | ||
| 2 | CVE-2026-120345 | WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection | — | Nov 2, 2026 | |
| 3 | CVE-2026-120344 | WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection | — | Nov 2, 2026 | |
| 4 | CVE-2026-120283 | Linksys E8450 portal.cgi strcpy stack-based overflow | — | Nov 2, 2026 | |
| 5 | CVE-2026-120281 | WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow | — | Nov 2, 2026 | |
| 6 | CVE-2026-120280 | WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection | — | Nov 2, 2026 | |
| 7 | CVE-2026-120279 | WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection | — | Nov 2, 2026 | |
| 8 | CVE-2026-120277 | WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection | — | Nov 1, 2026 | |
| 9 | CVE-2026-120276 | WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection | — | Nov 1, 2026 | |
| 10 | CVE-2026-120338 | Prefab UI Pyodide sandbox escape to host RCE | — | Nov 1, 2026 | |
| 11 | CVE-2026-120198 | WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection | — | Nov 1, 2026 | |
| 12 | CVE-2026-120195 | WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection | — | Nov 1, 2026 | |
| 13 | CVE-2026-120189 | D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow | — | Nov 1, 2026 | |
| 14 | CVE-2026-61826 | Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery | — | Oct 30, 2026 | |
| 15 | CVE-2026-112816 | Improper certificate validation in the HTTPS listener in LXD | — | Oct 30, 2026 | |
| 16 | CVE-2026-61738 | SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) | — | Oct 30, 2026 | |
| 17 | CVE-2026-84295 | Improper Authentication in Progress WS_FTP Server | — | Oct 29, 2026 | |
| 18 | CVE-2026-61991 | WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability | — | Oct 29, 2026 | |
| 19 | CVE-2026-61567 | AVideo-Encoder: unauthenticated command execution through streamer login trust | — | Oct 28, 2026 | |
| 20 | CVE-2026-61564 | AVideo-Encoder: unauthenticated installer PHP code injection | — | Oct 28, 2026 | |
| 21 | CVE-2026-105781 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | — | Oct 27, 2026 | |
| 22 | CVE-2026-65145 | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution,… | — | Oct 27, 2026 | |
| 23 | CVE-2026-120308 | Beta9 host filesystem exposure via volume path traversal | — | Nov 1, 2026 | |
| 24 | CVE-2026-120307 | Beta9 container escape via unvalidated sandbox file paths | — | Nov 1, 2026 | |
| 25 | CVE-2026-120306 | Beta9 build sandbox escape via chroot-only isolation | — | Nov 1, 2026 | |
| 26 | CVE-2026-62853 | ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks | — | Oct 30, 2026 | |
| 27 | CVE-2026-61728 | SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover | — | Oct 30, 2026 | |
| 28 | CVE-2026-90868 | OS Command Injection in Progress WS_FTP Server | — | Oct 29, 2026 | |
| 29 | CVE-2026-107327 | Langflow OSS is affected by multiple vulnerabilities | — | Oct 29, 2026 | |
| 30 | CVE-2026-107328 | Langflow OSS is affected by multiple vulnerabilities | — | Oct 29, 2026 | |
| 31 | CVE-2026-107329 | Langflow OSS is affected by multiple vulnerabilities | — | Oct 29, 2026 | |
| 32 | CVE-2026-113617 | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal | — | Oct 29, 2026 | |
| 33 | CVE-2026-44179 | XWiki Pro Macros: excerpt-include title and content injection executes code | — | Oct 28, 2026 | |
| 34 | CVE-2026-105780 | Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) | — | Oct 27, 2026 | |
| 35 | CVE-2026-104353 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | — | Oct 27, 2026 | |
| 36 | CVE-2026-105489 | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | — | Oct 27, 2026 | |
| 37 | CVE-2026-104351 | Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) | — | Oct 27, 2026 | |
| 38 | CVE-2026-120534 | Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type | — | Nov 3, 2026 | |
| 39 | CVE-2026-86596 | s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter | — | Nov 2, 2026 | |
| 40 | CVE-2026-102435 | Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field | — | Nov 2, 2026 | |
| 41 | CVE-2026-118636 | Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder | — | Oct 31, 2026 | |
| 42 | CVE-2026-118235 | SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data | — | Oct 31, 2026 | |
| 43 | CVE-2026-116512 | Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection | — | Oct 31, 2026 | |
| 44 | CVE-2026-119096 | Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter | — | Oct 31, 2026 | |
| 45 | CVE-2026-109220 | PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field | — | Oct 31, 2026 | |
| 46 | CVE-2026-63377 | TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover | — | Oct 30, 2026 | |
| 47 | CVE-2026-61620 | HoneySQL unchecked entity names can lead to SQL injection results | — | Oct 30, 2026 | |
| 48 | CVE-2026-116386 | WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability | — | Oct 30, 2026 | |
| 49 | CVE-2026-90888 | WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability | — | Oct 30, 2026 | |
| 50 | CVE-2026-39738 | WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability | — | Oct 30, 2026 |
Showing ranks 1–50 of 3129
CISA alerts and advisories
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Siemens Mendix SAML Module
- Hitachi Energy TRO600 series products
- Hitachi Energy CoreTec Product
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- EPICS Base
- Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
Top stories this week from The Hacker News
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
- Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
- TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
- ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
- Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
- China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Headlines link to the original articles on thehackernews.com.