Tuesday, November 3, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Google 141
- WordPress 4 critical 27
- Linux 22
- Dell 20
- Unknown 16
- WSO2 1 critical 12
- PostgreSQL 11
- Control Web Panel 2 critical 8
- Apache 6
- Eclipse Foundation 6
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can
Also in SecurityWeek Cyber Security News The Register Security +3
-
Cops bust botnet of 1.3M infected Android TV boxes
A coalition of private-sector security firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries. Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption. “We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” the Google Threat Intelligence Group (GTIG) said in a Monday blog. Videostrong Technology is a hardware…
Also in SecurityWeek SecurityWeek Krebs On Security +3
-
Microsoft Reveals 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
Microsoft’s new research shows that attackers pick flaws that give them control of a system. About 78% of vulnerabilities exploited in real attacks let an attacker take over a system or raise their privileges. The finding comes from a data study published on November 2, 2026, by Microsoft Security Research. Software flaws keep piling up. From 1999 through September 2026, about 383,000 vulnerabilities were disclosed. Only about 2,000 of them, roughly 0.5%, were linked to real-world exploitation. Fewer than 1 in 200 flaws ever reach a real attack, so defenders gain a lot by knowing which ones…
Also in Dark Reading Bleeping Computer The Hacker News +3
-
Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs
Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws.
Also in Infosecurity Magazine Infosecurity Magazine CCCS Alerts & Advisories +1
-
MLEP in KICS for Networks 5.0: how machine learning helps track network behavior of OT devices
In an industrial network, malicious activity can be hard to tell apart from normal data exchange between devices. Malicious actors routinely rely on legitimate tools and the Living-off-the-Land technique, so a single network connection may show no known signs of an attack: the device uses a familiar protocol and transmits ordinary data. An anomaly can hide in subtle details: the data source, the time of access, or the volume of transferred data may be atypical for a particular device. However, to detect this kind of anomaly, you need to understand the roles of the devices at both ends of the…
Also in The Record Check Point Research The Register Security
-
Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes
Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now. Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04). Stonking (26.10) is…
-
ARES AI Red Team Platform Automates 66 Attack Modules for Active Directory and Cloud Security Testing
A new open-core project called ARES is giving red teams a way to run planned, controlled attack tests against Active Directory and cloud systems. A developer who goes by Mafifrizi released the tool on GitHub. It ships with 66 active modules, with 70 cataloged in total, covering more than 60 techniques mapped to MITRE ATT&CK . It is aimed at enterprise red teams, managed security providers (MSSPs), and security operations centers. Mafifrizi publishes the project as an open-core platform, which means the base tool is free to read and test while a sponsorship page supports ongoing work. The…
Also in Wiz Research The Hacker News
-
NCSC Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure
The UK’s National Cyber Security Center handled 80 nationally significant cyber incidents during its latest reporting year, warning that artificial intelligence is making attacks faster, cheaper and easier to carry out. Its 2026 Annual Review records 1,831 attack reports, with 337 incidents requiring support from its Incident Management Team. The review covers 1 September 2025 to 31 August 2026, marking the NCSC’s tenth year as part of GCHQ. Published on November 3, the NCSC Annual Review 2026 warns that AI is increasing pressure on organizations still struggling to fix known security…
Also in Infosecurity Magazine
-
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload…
Also in Bleeping Computer
-
PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
Also in The Hacker News The Hacker News
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-120442 | ape-volo-adminxianhc | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with th… Attack
Exploitation
|
|||||||||
| CVE-2026-77876 | Control Web PanelControl Web Panel | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isControl Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the f… Attack
Exploitation
|
|||||||||
| CVE-2026-102435 | Ultra Addons for Contact Form 7WordPress | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for … Attack
Exploitation
|
|||||||||
| CVE-2026-86596 | s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access SubscriptionsWordPress | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only … Attack
Exploitation
|
|||||||||
| CVE-2026-120534 | Advanced Custom Fields: Extended PROWordPress | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThe Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration … Attack
Exploitation
|
|||||||||
| CVE-2026-4052 | WSO2 API ManagerWSO2 | Critical | 9.8 | — | — | None linked | — | CVSS 9.8No fix linked | |
What it isThis issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtain… Attack
Exploitation
|
|||||||||
| CVE-2026-120446 | madong-admin-saasmadong-code | Critical | 9.4 | — | — | None linked | — | CVSS 9.4No fix linked | |
What it ismadong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can ca… Attack
Exploitation
|
|||||||||
| CVE-2026-105769 | kanikoMicrosoft | Critical | 9.3 | — | — | None linked | — | CVSS 9.3No fix linked | |
What it iskaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-creden… Attack
Exploitation
|
|||||||||
| CVE-2026-120213 | @fastify/http-proxy@fastify/http-proxy | Critical | 9.1 | — | — | None linked | — | CVSS 9.1No fix linked | |
What it is@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to … Attack
Exploitation
|
|||||||||
| CVE-2026-73696 | Control Web PanelControl Web Panel | Critical | 9.1 | — | — | None linked | — | CVSS 9.1No fix linked | |
What it isControl Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a miss… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.