{"date_iso":"2026-11-02","date_human":"Monday, November 2, 2026","generated_utc":"2026-11-02 12:57 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts","link":"https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html","reason":"Linux","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","The Hacker News","Trail of Bits"],"coverage":4,"cve_ids":[],"summary":"Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed\u2026","source":"The Hacker News","date_rel":"2h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYHKbP_7yOsvpwAldBMCL3QkCJ9SbUVrJz1Tr_RB6m3O99Gj73H0fX20hIbzKujRWB-1qkBCWv1UEJEbrTe1NFYpPkTm0OoNqJe7OdJoZa1HcZDT2On3mUT0igQeCOsMnWw_ZfT-HsLx6B8R84XYHHg4mUI2hPzM15ggddQCFAAmzChzC5Of90LInW8RB8/s1600/artex.jpg","description":"Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where \"CL\" refers to cluster and \"UNK\" stands for unknown","related":[{"title":"Backporting security fixes at scale with Codex","link":"https://blog.trailofbits.com/2026/11/02/backporting-security-fixes-at-scale-with-codex/","source":"Trail of Bits","date_rel":"56m ago"},{"title":"Alpine Linux rebuilds GitLab after attempted RCE attack","link":"https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/","source":"Bleeping Computer","date_rel":"21h ago"},{"title":"Linux security advisory (AV26-1108)","link":"https://cyber.gc.ca/en/alerts-advisories/linux-security-advisory-av26-1108","source":"CCCS Alerts & Advisories","date_rel":"30 Oct"},{"title":"Critical Linux kernel flaw allows remote root attacks on MPTCP servers","link":"https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/","source":"Bleeping Computer","date_rel":"30 Oct"}]},{"title":"Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access","link":"https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html","reason":"Ivanti","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active\u2026","source":"The Hacker News","date_rel":"31 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeqP4vPt6j2lLPFj77A_1OthmSKb8mItfBrX_q8sQCAUVgTry1FxKizDI2SCLS4CglfjgbVkaMDN8ainqoOZm2pdaF6xw7sU4STZhwIFPCLSz84YXQTVx2tquPo7YJsZhgOWcD3V_w5td9BA_vVuOu1cFcrgL3SXyLF4E24IyGotrzDcbJ-M1mA85biDuW/s1600/1000120841.jpg","description":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a","related":[{"title":"Ivanti patches two more Connect Secure zero-days chained in attacks","link":"https://www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/","source":"Bleeping Computer","date_rel":"3h ago"},{"title":"Ivanti security advisory (AV26-1035) - Update 2","link":"https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035","source":"CCCS Alerts & Advisories","date_rel":"30 Oct"}]},{"title":"FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist","link":"https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html","reason":"Binance Koreas Heist","category":"News","sources":["Infosecurity Magazine","SecurityWeek","The Hacker News"],"coverage":3,"cve_ids":[],"summary":"The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade\u2026","source":"The Hacker News","date_rel":"1 Nov","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmb1j0HC3RkKxZ4bBQPaOa5GaLqC2EBtxXHOMnebPlgHGDJG7ryIuSBIR-9YBQuUm6HwD15-OJQgBvIkhbLIApM8XoU0DptSEF6DNhEpinxPA-06wQZhLhRiKmFGO5cVjONcaouGC3lqybhkeEsZj-xebX6u6hSR19mS7sVqOrpR02qNOlpHZJEUjf1HtB/s1600/binance-hack.png","description":"The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI),","related":[{"title":"FBI Attributes Binance Heist to North Korea\u2019s TraderTraitor","link":"https://www.infosecurity-magazine.com/news/fbi-attributes-binance-north/","source":"Infosecurity Magazine","date_rel":"2h ago"},{"title":"FBI Flags Over 600 Addresses Tied to North Korea\u2019s Binance Heist","link":"https://www.securityweek.com/fbi-flags-over-600-addresses-tied-to-north-koreas-binance-heist/","source":"SecurityWeek","date_rel":"4h ago"}]},{"title":"FBI pins $6.3B Binance crypto heist on North Korean hackers","link":"https://www.theregister.com/security/2026/11/02/fbi-pins-63b-binance-crypto-heist-on-north-korean-hackers/5306889","reason":"Exchange","category":"News","sources":["Ars Technica Security","The Register Security"],"coverage":2,"cve_ids":[],"summary":"The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazarus Group as the exchange scrambles to replace stolen\u2026","source":"The Register Security","date_rel":"1h ago","thumbnail":"https://image.theregister.com/?imageId=254844&width=800","description":"The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazarus Group as the exchange scrambles to replace stolen funds and reassure customers. In an alert published Saturday, the agency attributed the October 29 attack to TraderTraitor, a North Korean hacking operation linked to Lazarus, which has made a lucrative career out of relieving crypto exchanges of their digital assets. Pyongyang was already in the frame before the FBI weighed in. Blockchain intelligence firms TRM Labs and Elliptic\u2026","related":[{"title":"Hackers steal $6.3 billion from Binance in record crypto heist","link":"https://arstechnica.com/security/2026/10/hackers-steal-6-3-billion-from-binance-in-record-crypto-heist/","source":"Ars Technica Security","date_rel":"30 Oct"}]},{"title":"Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)","link":"https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527","reason":"CVE-2026-111357","category":"Research","sources":["Rapid7 Blog","SecurityWeek"],"coverage":2,"cve_ids":["CVE-2026-111357","CVE-2026-118527"],"summary":"Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing\u2026","source":"Rapid7 Blog","date_rel":"1h ago","thumbnail":"https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt65a432ba319f4043/6846abddaf18306debe6cf4d/ETR.webp","description":"Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload\u2026","related":[{"title":"Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain","link":"https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/","source":"SecurityWeek","date_rel":"4h ago"}]},{"title":"Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data","link":"https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html","reason":"Microsoft","category":"News","sources":["Cyber Security News","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login\u2026","source":"The Hacker News","date_rel":"1h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLv88EM1ZSjaeI7bH9DVpg2mGdkwXWUuir0S_p9IfiWG49_TgRalFdK4oQ6e7UE_JYOnNH70Z6wcftnjhcYHRY-Xc0o8GYp9r1uNzxdC_1bnXZgvon74cXkWgKpHZtwJg3IKLsqGC2HS2tcMfQS8BZu7kfrW1vAaaIA316LRzgCOn8zeGZ1WvALgJmyM4/s1600/ms-ad.jpg","description":"Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company","related":[{"title":"Top 10 Best Identity Governance & Administration (IGA) Tools in 2026","link":"https://cybersecuritynews.com/best-iga-tools/","source":"Cyber Security News","date_rel":"2h ago"}]},{"title":"Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft","link":"https://cybersecuritynews.com/hackers-use-cyberstrikeai-agents-2/","reason":"Windows","category":"News","sources":["Cyber Security News","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Hackers are now using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/Hackers-Use-CyberStrikeAI-Agents-to-Automate-Windows-Domain-Takeovers-and-Credential-Theft.webp","description":"Hackers are now using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand. CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already turned it toward real targets, and earlier reports showed how attackers targeted Fortinet FortiGate devices with the same framework. This new campaign shows the\u2026","related":[{"title":"New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value","link":"https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html","source":"The Hacker News","date_rel":"7h ago"},{"title":"NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection","link":"https://thehackernews.com/2026/11/netamloader-malware-targets-government.html","source":"The Hacker News","date_rel":"1 Nov"}]},{"title":"Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%","link":"https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html","reason":"Cloudflare","category":"News","sources":["SecurityWeek","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2\u2026","source":"The Hacker News","date_rel":"31 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9-PGmRcZy9OvjKNOWHrGVMpF2DhnvIrHU6mOwyroU7CeoEKMkrjCt8HxCKBzAOia6ZpDEvTuQcF2Xg_50vE_W8DdjmLJjxMXPUUm5Ryfym8GBhm74Z6jwZCeXSKgxuK6A57rVsM-Z1G8nfEF3Mn8QgoD77Nbqxakkj_ZxbBNDtp0ljvTKrXydLYm1BFZR/s1600/cf.jpg","description":"Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44","related":[{"title":"In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak","link":"https://www.securityweek.com/in-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-data-leak/","source":"SecurityWeek","date_rel":"30 Oct"}]},{"title":"WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours","link":"https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html","reason":"Wordpress","category":"News","sources":["SecurityWeek","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of\u2026","source":"The Hacker News","date_rel":"30 Oct","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf-pzflJO9HQoCdvBvYNtS12gwwEjAbM4dQ30ak7UYaIPzsVPN9MlFwvIDEFkbe9cWg4wQRFPbGfJ0YXjzGcBS6mUTwttwkQ8IR7OoHyTz3owZkVzYQOAObyJUqfjsC-PqMw2pv41_m68hb6ZkwJb56kGx-Ypv7GWZBtDzjyTTQ8L8i9NxA8_MDVoJSEba/s1600/wp-hack.jpg","description":"Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October","related":[{"title":"PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress","link":"https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/","source":"SecurityWeek","date_rel":"30 Oct"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-120338","vendor":"PrefectHQ","product":"prefab-ui","severity":"CRITICAL","score":10.0,"description":"Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 t\u2026","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/PrefectHQ/prefab","https://github.com/PrefectHQ/prefab/commit/030f074f85e0b1be0dd44b0283185aecb26337a2","https://github.com/PrefectHQ/prefab/pull/538"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120338"},{"id":"CVE-2026-120276","vendor":"WAVLINK","product":"WN536AX6-A","severity":"CRITICAL","score":10.0,"description":"A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os c\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_openvpn_cli_group_command_injection.md","https://vuldb.com/cve/CVE-2026-120276","https://vuldb.com/submit/919502"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120276"},{"id":"CVE-2026-120277","vendor":"WAVLINK","product":"WN536AX6-A","severity":"CRITICAL","score":10.0,"description":"A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name lead\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_wireguard_cli_group_command_injection.md","https://vuldb.com/cve/CVE-2026-120277","https://vuldb.com/submit/919503"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120277"},{"id":"CVE-2026-120279","vendor":"WAVLINK","product":"WN536AX6-A","severity":"CRITICAL","score":10.0,"description":"A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injecti\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md","https://vuldb.com/cve/CVE-2026-120279","https://vuldb.com/submit/919788"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120279"},{"id":"CVE-2026-120280","vendor":"WAVLINK","product":"WN536AX6-A","severity":"CRITICAL","score":10.0,"description":"A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads \u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md","https://vuldb.com/cve/CVE-2026-120280","https://vuldb.com/submit/919789"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120280"},{"id":"CVE-2026-120281","vendor":"WAVLINK","product":"WN536AX6-A","severity":"CRITICAL","score":10.0,"description":"A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The at\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md","https://vuldb.com/cve/CVE-2026-120281","https://vuldb.com/submit/919790"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120281"},{"id":"CVE-2026-120283","vendor":"Linksys","product":"E8450","severity":"CRITICAL","score":10.0,"description":"A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be ex\u2026","cwe":"CWE-119","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://vuldb.com/cve/CVE-2026-120283","https://vuldb.com/submit/1014924","https://vuldb.com/vuln/429627"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120283"},{"id":"CVE-2026-120344","vendor":"WAVLINK","product":"WN551X3-A","severity":"CRITICAL","score":10.0,"description":"A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os comm\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_wireguard_cli_group_command_injection.md","https://vuldb.com/cve/CVE-2026-120344","https://vuldb.com/submit/919551"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120344"},{"id":"CVE-2026-120345","vendor":"WAVLINK","product":"WN551X3-A","severity":"CRITICAL","score":10.0,"description":"A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os comman\u2026","cwe":"CWE-77","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_dns_resolution_command_injection.md","https://vuldb.com/cve/CVE-2026-120345","https://vuldb.com/submit/919579"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120345"},{"id":"CVE-2026-120224","vendor":"Oray","product":"Pugongying X5 Pro","severity":"CRITICAL","score":9.9,"description":"A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be la\u2026","cwe":"CWE-266","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352","https://vuldb.com/cve/CVE-2026-120224","https://vuldb.com/submit/1007541"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120224"}],"vendor_spikes":[{"vendor":"MediaTek, Inc.","count":56,"critical_count":0},{"vendor":"Gitea","count":19,"critical_count":0},{"vendor":"Apache","count":19,"critical_count":0},{"vendor":"WAVLINK","count":17,"critical_count":16},{"vendor":"Huawei","count":17,"critical_count":0},{"vendor":"ag-ui-protocol","count":5,"critical_count":0},{"vendor":"mathurvishal","count":5,"critical_count":0},{"vendor":"Jovancoding","count":4,"critical_count":0},{"vendor":"Oray","count":3,"critical_count":2},{"vendor":"Unknown","count":3,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":9,"new_cve_count":186,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-111357":{"anchor":"#dev-5","rank":5,"coverage":2},"CVE-2026-118527":{"anchor":"#dev-5","rank":5,"coverage":2}}}