SGRC Daily Cyber Brief - 03 Nov 2026

Read sourced cyber advisories and next steps, or connect your agent to check which entries match your software.

Beta. Review the issue dates, sources and coverage before acting. Usage disclaimer.

Issue date
Reference
SGRC-DCB-20261103
Version
1.0
Last updated
Source checks recorded
Entries
26

Date-stamped approved issue. Check the original issue and source-check dates before acting.

Revision history
  1. 1.0 First published. 26 entries in total.

Freshness uses your device clock and Eastern Time. Automated issue: scripts collected these rows and checked them against their cited sources. No person reviewed it. Controls are blank where no sourced mapping exists.

Read the latest approved brief

Bottom line

  • What is listed. 1 of 26 entries are on CISA's Known Exploited Vulnerabilities list.
  • Past deadline. 1 entry has passed the US federal due date. The oldest was November 2, 2026.
  • Fix status. 11 of 26 entries list a fixed version in these records. Not listed does not mean no fix exists, so check the vendor advisory.
  • Canada. No entry carries a cited Canadian source. That does not establish that Canadian organizations are unaffected.

Findings

Open a row for affected versions, fix steps, checks and sources.

26 of 26 entries

Sorted by Issue order (Canada first).

  1. Number 1Ivanti Connect SecureCVE-2026-111357Widely deployedIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.CVSS 7EPSS 0.5%Deadline passedCISA due Nov 2, 2026, passed

    What happened

    Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

    How to fix

    1. Upgrade Ivanti Connect Secure to 25.1.1.3 or later (fixed versions per the NVD record).
    2. CISA KEV required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal due date 2026-11-02.
    3. Follow the vendor advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 25.1.0.0 up to, not including, 25.1.1.3
    • 22.8r2
    • 22.8r2.1
    • 22.8r2.2
    • 22.8r2.3
    • 22.8r2.4
    • 22.8r2.5

    Fixed versions

    • 25.1.1.3

    Risk record

    Severity
    Critical
    Response
    Immediate
    Added to KEV
    Oct 30, 2026

    Question for leadership

    The federal deadline passed on 2026-11-02. Can you show this product is patched or isolated here, and who holds the evidence?

    Control mapping

    ISO 27001
    A.8.8, A.8.9, A.8.16
    NIST CSF 2.0
    ID.AM-02, PR.PS-02, RS.MA-01
    CIS v8
    2, 7
    ITSG-33
    SI-2, RA-5, SI-4
    OSFI B-13
    B-13 Patch Mgmt, B-13 Vulnerability Management

    Analytical mapping, not an audit finding.

    Sources

  2. Number 2LinuxCVE-2026-98432Widely deployedIn the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build().CVSS 9.8EPSS 0.5%Widely deployedCISA due None

    What happened

    In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build().

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    This flaw scores 9.8 in widely used software. Do you know every place it runs, and who can approve an emergency update?

    Sources

  3. Number 3Eclipse Foundation Eclipse MnestixCVE-2026-89292In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.CVSS 9.2EPSS Not scoredNew criticalCISA due None

    What happened

    In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

    How to fix

    1. Upgrade Eclipse Foundation Eclipse Mnestix to 2.3.0 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 1.6.0 up to, not including, 2.3.0

    Fixed versions

    • 2.3.0

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.2) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  4. Number 4AxxonSoft Axxon OneCVE-2026-121022Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.CVSS 9.2EPSS Not scoredNew criticalCISA due None

    What happened

    Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

    How to fix

    1. Upgrade AxxonSoft Axxon One to 3.0.0 or later (fixed versions per the CVE record).
    2. Vendor solution (CVE record): Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login.

    If you cannot update yet: On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.

    Not a fix: the update is still required.

    Workaround source (opens in a new tab)

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • before 3.0.0

    Fixed versions

    • 3.0.0

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.2) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  5. Number 5ACF Extended Advanced Custom Fields: Extended PROCVE-2026-120534The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.CVSS 9.8EPSS Not scoredNew criticalCISA due None

    What happened

    The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-434 (Unrestricted Upload of File with Dangerous Type), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • through 0.9.2.6

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.8) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  6. Number 6kalengi BuddyPress XProfile Custom Image FieldCVE-2026-120518This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted.CVSS 9.1EPSS Not scoredNew criticalCISA due None

    What happened

    This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Operation. Use an application firewall that can detect attacks against this weakness.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • through 3.1.0

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.1) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Control mapping

    ISO 27001
    A.8.8, A.8.9, A.8.16, A.5.15
    NIST CSF 2.0
    ID.AM-01, PR.AA-05, PR.PS-02, DE.CM-01
    CIS v8
    6, 8, 12
    ITSG-33
    SI-2, SI-4, AC-6, AU-6
    OSFI B-13
    B-13 Patch Mgmt, B-13 Access Control

    Analytical mapping, not an audit finding.

    Sources

  7. Number 7clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access SubscriptionsCVE-2026-86596This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.CVSS 9.8EPSS Not scoredNew criticalCISA due None

    What happened

    This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. WordPress.org lists 261017 as the current release, newer than the last affected version in the CVE record. A newer release does not prove a fix: confirm it in the plugin changelog.
    3. Generic hardening for CWE-94 (Improper Control of Generation of Code), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Operation. Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • through 260927

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.8) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  8. Number 8Absolute Security Secure AccessCVE-2026-97718Because of a bypassed security control, an attacker can cause an admin to create an account under their control.CVSS 9.4EPSS Not scoredNew criticalCISA due None

    What happened

    Because of a bypassed security control, an attacker can cause an admin to create an account under their control.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 14.60

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.4) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  9. Number 9Absolute Security Secure AccessCVE-2026-116769Attackers can modify security settings of a client via the server.CVSS 9.3EPSS Not scoredNew criticalCISA due None

    What happened

    Attackers can modify security settings of a client via the server.

    How to fix

    1. Upgrade Absolute Security Secure Access to 14.61 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 13.0 up to, not including, 14.61

    Fixed versions

    • 14.61

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.3) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  10. Number 10themefic Ultra Addons for Contact Form 7CVE-2026-102435This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).CVSS 9.8EPSS Not scoredNew criticalCISA due None

    What happened

    This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. WordPress.org lists 3.5.57 as the current release, newer than the last affected version in the CVE record. A newer release does not prove a fix: confirm it in the plugin changelog.
    3. Generic hardening for CWE-502 (Deserialization of Untrusted Data), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Operation. Use an application firewall that can detect attacks against this weakness.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • through 3.5.54

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.8) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  11. Number 11joomlaboat.com Custom Tables extension for JoomlaCVE-2026-105606Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response.CVSS 9.5EPSS Not scoredNew criticalCISA due None

    What happened

    Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-434 (Unrestricted Upload of File with Dangerous Type), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 1.0-3.7.7

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.5) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  12. Number 12dj-extensions.com DJ-Classifieds extension for JoomlaCVE-2026-105604Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.CVSS 9.3EPSS Not scoredNew criticalCISA due None

    What happened

    Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Operation. Use an application firewall that can detect attacks against this weakness.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 1.0-3.11.2

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.3) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  13. Number 13dj-extensions.com DJ-Classifieds extension for JoomlaCVE-2026-105603Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.CVSS 9.4EPSS Not scoredNew criticalCISA due None

    What happened

    Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-434 (Unrestricted Upload of File with Dangerous Type), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 1.0-3.11.2

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.4) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  14. Number 14SUSE RancherCVE-2026-88811Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers.CVSS 9.1EPSS Not scoredNew criticalCISA due None

    What happened

    Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers.

    How to fix

    1. Upgrade SUSE Rancher to the fixed release for your branch: 2.11.19, 2.12.15, 2.13.11, 2.14.7, 2.15.3 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 2.15.0 up to, not including, 2.15.3
    • 2.14.0 up to, not including, 2.14.7
    • 2.13.0 up to, not including, 2.13.11
    • 2.12.0 up to, not including, 2.12.15
    • 2.11.0 up to, not including, 2.11.19

    Fixed versions

    • 2.11.19
    • 2.12.15
    • 2.13.11
    • 2.14.7
    • 2.15.3

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.1) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  15. Number 15chainguard kanikoCVE-2026-105769kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no…CVSS 9.3EPSS Not scoredNew criticalCISA due None

    What happened

    kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no…

    How to fix

    1. Upgrade chainguard kaniko to 1.25.20 or later (fixed versions per the CVE record).
    2. Vendor solution (CVE record): Upgrade to kaniko 1.25.20 or later. The repository publishes no binaries or images, so rebuild the executor, the warmer and docker-credential-acr-env from 1.25.20 or later. Go module consumers should update github.com/chainguard-dev/kaniko to 1.25.20 or later. The fixed version carries a patched copy of the helper under third_party/docker-credential-acr-env that accepts a host only if it is exactly host[:port] and the hostname is mcr.microsoft.com or a well-formed name ending in.azurecr.io,.azurecr.cn,.azurecr.de or.azurecr.us.

    If you cannot update yet: Do not let untrusted builds reach an Azure identity: remove Azure credentials, federated tokens, MSI_ENDPOINT and MSI_SECRET from the build environment, and block access to the Instance Metadata Service (169.254.169.254) from build pods. If kaniko's built-in ACR authentication is not needed, set AZURE_ENVIRONMENT to a value that names no Azure cloud (for example AZURE_ENVIRONMENT=none) in the kaniko container. If config.json sets "credsStore": "acr-env", replace it with per-host credHelpers entries for your own ACR registries; on its own this closes only the standalone-binary path. If untrusted Dockerfiles were built with an Azure identity available, treat access tokens issued to that identity during those builds as compromised, review Entra ID sign-in logs and Azure activity logs, and… See the CVE record.

    Not a fix: the update is still required.

    Workaround source (opens in a new tab)

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • before 1.25.20

    Fixed versions

    • 1.25.20

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.3) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  16. Number 16SUSE RancherCVE-2026-94290As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges.CVSS 9.1EPSS Not scoredNew criticalCISA due None

    What happened

    As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges.

    How to fix

    1. Upgrade SUSE Rancher to the fixed release for your branch: 0.13.17, 0.14.12, 0.15.8, 0.16.3 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 0.16.0 up to, not including, 0.16.3
    • 0.15.0 up to, not including, 0.15.8
    • 0.14.0 up to, not including, 0.14.12
    • 0.13.0 up to, not including, 0.13.17

    Fixed versions

    • 0.13.17
    • 0.14.12
    • 0.15.8
    • 0.16.3

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.1) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  17. Number 17Control Web PanelCVE-2026-77876Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action.CVSS 9.3EPSS Not scoredNew criticalCISA due None

    What happened

    Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action.

    How to fix

    1. Upgrade Control Web Panel to 1.16 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • before 1.16

    Fixed versions

    • 1.16

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.3) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  18. Number 18Control Web PanelCVE-2026-73696Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect.CVSS 9.3EPSS Not scoredNew criticalCISA due None

    What happened

    Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect.

    How to fix

    1. Upgrade Control Web Panel to 1.12 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • before 1.12

    Fixed versions

    • 1.12

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.3) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  19. Number 19mpdavis python-joseCVE-2026-120459python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets.CVSS 9.1EPSS Not scoredNew criticalCISA due None

    What happened

    python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • through 3.5.0

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.1) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  20. Number 20bufanyun HotGoCVE-2026-120447HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send.CVSS 9.2EPSS Not scoredNew criticalCISA due None

    What happened

    HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-287 (Improper Authentication), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • 2.8.4 through 2.15.1

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.2) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  21. Number 21madong-code madong-admin-saasCVE-2026-120446Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.CVSS 8.8EPSS Not scoredNew criticalCISA due None

    What happened

    Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-306 (Missing Authentication for Critical Functionality), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • through 5.1.4

    Risk record

    Severity
    High
    Response
    7 days

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 8.8) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  22. Number 22xianhc ape-volo-adminCVE-2026-120442ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json.CVSS 9.3EPSS Not scoredNew criticalCISA due None

    What happened

    ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json.

    How to fix

    1. Upgrade xianhc ape-volo-admin to 3.6.1 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • before 3.6.1

    Fixed versions

    • 3.6.1

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.3) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  23. Number 23Barracuda Networks Barracuda Email Security Gateway (ESG)CVE-2026-116606An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.CVSS 9.3EPSS Not scoredNew criticalCISA due None

    What happened

    An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

    How to fix

    1. Upgrade Barracuda Networks Barracuda Email Security Gateway (ESG) to 9.4.0.030 or later (fixed versions per the CVE record).

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Affected versions

    • before 9.4.0.030

    Fixed versions

    • 9.4.0.030

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.3) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  24. Number 24WSO2 WSO2 API ManagerCVE-2026-4052This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing.CVSS 9.8EPSS Not scoredNew criticalCISA due None

    What happened

    This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing.

    How to fix

    1. Vendor solution (CVE record): Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/#solution

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.8) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  25. Number 25Zohocorp Log360CVE-2026-13594Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.CVSS 9.1EPSS Not scoredNew criticalCISA due None

    What happened

    Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-284 (Improper Access Control), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design, Operation. Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.1) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

  26. Number 26AWS virtual-engineering-workbenchCVE-2026-119085Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role.CVSS 9.4EPSS Not scoredNew criticalCISA due None

    What happened

    Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role.

    How to fix

    1. No fixed version or vendor solution for this product is confirmed in the CVE or NVD records. Check the vendor advisory for the current patch status.
    2. Generic hardening for CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), from the MITRE CWE catalog. This is general weakness guidance, not a vendor fix or workaround for this CVE. Phase: Architecture and Design. Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

    No public detection rule for this CVE was found in Nuclei, Sigma or ET Open.

    Risk record

    Severity
    Critical
    Response
    Immediate

    Question for leadership

    The NVD record carries a critical score under at least one CVSS version (primary score 9.4) and it was published in the last day. Do you know whether it runs here, and who checks the vendor fix status today?

    Sources

Control mapping

Controls these entries touch, with the number of entries for each. Analytical mapping, not an audit finding. 24 of 26 entries have no sourced control mapping.

ISO 27001
  • A.8.162
  • A.8.82
  • A.8.92
  • A.5.151
NIST CSF 2.0
  • PR.PS-022
  • DE.CM-011
  • ID.AM-011
  • ID.AM-021
  • PR.AA-051
  • RS.MA-011
CIS v8
  • 121
  • 21
  • 61
  • 71
  • 81
ITSG-33
  • SI-22
  • SI-42
  • AC-61
  • AU-61
  • RA-51
OSFI B-13
  • B-13 Patch Mgmt2
  • B-13 Access Control1
  • B-13 Vulnerability Management1

Sources

Citations by publisher across this issue. Each row lists its own links. Sources checked November 3, 2026 at 07:30 a.m. EST.

Authorities
  • CVE Program26
  • NVD API26
  • GitHub Advisory Database22
  • OSV9
  • WordPress.org Plugin Directory2
  • CISA KEV1
Vendors
  • Ivanti1

Coverage is limited to the approved entries shown. Canadian context requires cited Canadian evidence; worldwide incident and campaign collection is still being expanded. The JSON Feed includes the matching data and original verification timestamps.