Monday, November 2, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- MediaTek, Inc. 56
- Gitea 19
- Apache 19
- WAVLINK 16 critical 17
- Huawei 17
- ag-ui-protocol 5
- mathurvishal 5
- Jovancoding 4
- Oray 2 critical 3
- Unknown 3
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown
Also in Trail of Bits Bleeping Computer CCCS Alerts & Advisories +1
-
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
-
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI),
Also in Infosecurity Magazine SecurityWeek
-
FBI pins $6.3B Binance crypto heist on North Korean hackers
The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazarus Group as the exchange scrambles to replace stolen funds and reassure customers. In an alert published Saturday, the agency attributed the October 29 attack to TraderTraitor, a North Korean hacking operation linked to Lazarus, which has made a lucrative career out of relieving crypto exchanges of their digital assets. Pyongyang was already in the frame before the FBI weighed in. Blockchain intelligence firms TRM Labs and Elliptic…
Also in Ars Technica Security
-
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload…
Also in SecurityWeek
-
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company
Also in Cyber Security News
-
Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft
Hackers are now using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand. CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already turned it toward real targets, and earlier reports showed how attackers targeted Fortinet FortiGate devices with the same framework. This new campaign shows the…
Also in The Hacker News The Hacker News
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44
Also in SecurityWeek
-
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October
Also in SecurityWeek
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-120338 | prefab-uiPrefectHQ | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isPrefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 t… Attack
Exploitation
|
|||||||||
| CVE-2026-120276 | WN536AX6-AWAVLINK | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os c… Attack
Exploitation
|
|||||||||
| CVE-2026-120277 | WN536AX6-AWAVLINK | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name lead… Attack
Exploitation
|
|||||||||
| CVE-2026-120279 | WN536AX6-AWAVLINK | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injecti… Attack
Exploitation
|
|||||||||
| CVE-2026-120280 | WN536AX6-AWAVLINK | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads … Attack
Exploitation
|
|||||||||
| CVE-2026-120281 | WN536AX6-AWAVLINK | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The at… Attack
Exploitation
|
|||||||||
| CVE-2026-120283 | E8450Linksys | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be ex… Attack
Exploitation
|
|||||||||
| CVE-2026-120344 | WN551X3-AWAVLINK | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os comm… Attack
Exploitation
|
|||||||||
| CVE-2026-120345 | WN551X3-AWAVLINK | Critical | 10.0 | — | — | None linked | — | CVSS 10.0No fix linked | |
What it isA vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os comman… Attack
Exploitation
|
|||||||||
| CVE-2026-120224 | Pugongying X5 ProOray | Critical | 9.9 | — | — | None linked | — | CVSS 9.9No fix linked | |
What it isA security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be la… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.