{"date_iso":"2026-11-03","date_human":"Tuesday, November 3, 2026","generated_utc":"2026-11-03 12:57 UTC","read_minutes":5,"patch_tuesday":false,"top_stories":[{"title":"Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing","link":"https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html","reason":"Linux","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Cyber Security News","SecurityWeek","The Hacker News","The Register Security","Trail of Bits"],"coverage":7,"cve_ids":[],"summary":"Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases\u2026","source":"The Hacker News","date_rel":"1h ago","thumbnail":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdf8UfDHsjH9VaJGtYT5WgjtJ1G5YRMkjPWNeKn-hw05sM9ny0kW9L2eIc3UCiIQ7qmc_TmfrenS1WH8KiRBjln2hQS0X7DUlykxdHrzDgg4uoiHpiOf3fVTOnUuOt4618z3PN7hw1AfUch_y0Tot3ubTga5LEfyWnATkzegfQBSWxMbzNzJaGY18QqC8/s1600/linux-rce.jpg","description":"Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can","related":[{"title":"Critical Node-RED Flaw Exploited in Attacks","link":"https://www.securityweek.com/critical-node-red-flaw-exploited-in-attacks/","source":"SecurityWeek","date_rel":"46m ago"},{"title":"Hackers Hijacked Linux Hosting Server Security Tool cPGuard and Used It as a Backdoor","link":"https://cybersecuritynews.com/cpguard-supply-chain-attack/","source":"Cyber Security News","date_rel":"3h ago"},{"title":"Max-severity bug in widely used OT programming tool exploited to deliver Linux malware","link":"https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086","source":"The Register Security","date_rel":"14h ago"},{"title":"SUSE Linux security advisory (AV26-1113)","link":"https://cyber.gc.ca/en/alerts-advisories/suse-linux-security-advisory-av26-1113","source":"CCCS Alerts & Advisories","date_rel":"18h ago"},{"title":"Backporting security fixes at scale with Codex","link":"https://blog.trailofbits.com/2026/11/02/backporting-security-fixes-at-scale-with-codex/","source":"Trail of Bits","date_rel":"2 Nov"},{"title":"Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts","link":"https://thehackernews.com/2026/11/government-linux-servers-targeted-with.html","source":"The Hacker News","date_rel":"2 Nov"}]},{"title":"Cops bust botnet of 1.3M infected Android TV boxes","link":"https://www.theregister.com/cyber-crime/2026/11/02/cops-bust-botnet-of-13m-infected-android-tv-boxes/5307045","reason":"Android","category":"News","sources":["Bleeping Computer","CyberScoop","Krebs On Security","Malwarebytes Labs","SecurityWeek","The Hacker News","The Register Security"],"coverage":7,"cve_ids":[],"summary":"A coalition of private-sector security firms working with Japan\u2019s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than\u2026","source":"The Register Security","date_rel":"17h ago","thumbnail":"https://image.theregister.com/?imageId=247072&width=800","description":"A coalition of private-sector security firms working with Japan\u2019s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries. Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption. \u201cWe assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,\u201d the Google Threat Intelligence Group (GTIG) said in a Monday blog. Videostrong Technology is a hardware\u2026","related":[{"title":"Android\u2019s November 2026 Updates Patch Over 200 Vulnerabilities","link":"https://www.securityweek.com/androids-november-2026-updates-patch-over-200-vulnerabilities/","source":"SecurityWeek","date_rel":"34m ago"},{"title":"Google Dismantles XCPE Botnet of 1.3 Million Android Devices","link":"https://www.securityweek.com/google-dismantles-xcpe-botnet-of-1-3-million-android-devices/","source":"SecurityWeek","date_rel":"3h ago"},{"title":"Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies","link":"https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/","source":"Krebs On Security","date_rel":"10h ago"},{"title":"Google shuts down global botnet running on certified Android devices","link":"https://cyberscoop.com/google-disrupts-xcpe-botnet-videostrong-android-devices/","source":"CyberScoop","date_rel":"14h ago"},{"title":"Google disrupts million-device XCPE Android malware botnet, bans TV box maker","link":"https://www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/","source":"Bleeping Computer","date_rel":"18h ago"},{"title":"\u26a1 Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More","link":"https://thehackernews.com/2026/11/weekly-recap-critical-cves-linux-ddos.html","source":"The Hacker News","date_rel":"19h ago"}]},{"title":"Microsoft Reveals 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation","link":"https://cybersecuritynews.com/microsoft-reveals-78-of-exploited-vulnerabilities/","reason":"Microsoft","category":"News","sources":["Bleeping Computer","Cyber Security News","Dark Reading","The Hacker News","Zero Day Initiative"],"coverage":5,"cve_ids":[],"summary":"Microsoft\u2019s new research shows that attackers pick flaws that give them control of a system. About 78% of vulnerabilities exploited in real attacks let an attacker take over a system or raise their privileges. The\u2026","source":"Cyber Security News","date_rel":"24m ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/Microsoft-Reveals-78-of-Exploited-Vulnerabilities-Enable-System-Takeover-and-Privilege-Escalation.webp","description":"Microsoft\u2019s new research shows that attackers pick flaws that give them control of a system. About 78% of vulnerabilities exploited in real attacks let an attacker take over a system or raise their privileges. The finding comes from a data study published on November 2, 2026, by Microsoft Security Research. Software flaws keep piling up. From 1999 through September 2026, about 383,000 vulnerabilities were disclosed. Only about 2,000 of them, roughly 0.5%, were linked to real-world exploitation. Fewer than 1 in 200 flaws ever reach a real attack, so defenders gain a lot by knowing which ones\u2026","related":[{"title":"Microsoft's AI Risk Report Misses This Key Detail","link":"https://www.darkreading.com/cyberattacks-data-breaches/microsoft-ai-cyber-risk-report-miss","source":"Dark Reading","date_rel":"21h ago"},{"title":"Microsoft fixes Smart App Control broken by October Windows update","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-smart-app-control-broken-by-october-windows-update/","source":"Bleeping Computer","date_rel":"22h ago"},{"title":"Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data","link":"https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html","source":"The Hacker News","date_rel":"2 Nov"},{"title":"ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-850/","source":"Zero Day Initiative","date_rel":"2 Nov"},{"title":"ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-849/","source":"Zero Day Initiative","date_rel":"2 Nov"},{"title":"ZDI-26-848: Microsoft Qlib StaticDataLoader Deserialization of Untrusted Data Remote Code Execution Vulnerability","link":"http://www.zerodayinitiative.com/advisories/ZDI-26-848/","source":"Zero Day Initiative","date_rel":"2 Nov"}]},{"title":"Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs","link":"https://www.bleepingcomputer.com/news/google/google-adds-new-250-000-cloud-vrp-reward-for-root-in-cloud-bugs/","reason":"Google","category":"News","sources":["Bleeping Computer","CCCS Alerts & Advisories","Infosecurity Magazine","SecurityWeek"],"coverage":4,"cve_ids":[],"summary":"Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws.","source":"Bleeping Computer","date_rel":"50m ago","thumbnail":"","description":"","related":[{"title":"LLMJacking is Costing Some Businesses Up to $1m, Warns Google","link":"https://www.infosecurity-magazine.com/news/llmjacking-cost-business-1m-warns/","source":"Infosecurity Magazine","date_rel":"2h ago"},{"title":"Police and Tech Firms Team Up to Dismantle XCPE Botnet","link":"https://www.infosecurity-magazine.com/news/police-tech-firms-team-up-to/","source":"Infosecurity Magazine","date_rel":"3h ago"},{"title":"Google security advisory (AV26-1109)","link":"https://cyber.gc.ca/en/alerts-advisories/google-security-advisory-av26-1109","source":"CCCS Alerts & Advisories","date_rel":"22h ago"},{"title":"Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward","link":"https://www.securityweek.com/google-introduces-250000-root-in-cloud-bug-bounty-reward/","source":"SecurityWeek","date_rel":"23h ago"}]},{"title":"MLEP in KICS for Networks 5.0: how machine learning helps track network behavior of OT devices","link":"https://securelist.com/tr/machine-learning-event-processor-in-kics-for-networks/121794/","reason":"Exchange","category":"Threat Intel","sources":["Check Point Research","Kaspersky Securelist","The Record","The Register Security"],"coverage":4,"cve_ids":[],"summary":"In an industrial network, malicious activity can be hard to tell apart from normal data exchange between devices. Malicious actors routinely rely on legitimate tools and the Living-off-the-Land technique, so a single\u2026","source":"Kaspersky Securelist","date_rel":"2h ago","thumbnail":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/11/02125021/mlep_securelist-featured.jpg","description":"In an industrial network, malicious activity can be hard to tell apart from normal data exchange between devices. Malicious actors routinely rely on legitimate tools and the Living-off-the-Land technique, so a single network connection may show no known signs of an attack: the device uses a familiar protocol and transmits ordinary data. An anomaly can hide in subtle details: the data source, the time of access, or the volume of transferred data may be atypical for a particular device. However, to detect this kind of anomaly, you need to understand the roles of the devices at both ends of the\u2026","related":[{"title":"Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform","link":"https://therecord.media/mercado-bitcoin-brazil-cryptocurrency-heist","source":"The Record","date_rel":"15h ago"},{"title":"2nd November \u2013 Threat Intelligence Report","link":"https://research.checkpoint.com/2026/2nd-november-threat-intelligence-report/","source":"Check Point Research","date_rel":"20h ago"},{"title":"FBI pins $6.3B Binance crypto heist on North Korean hackers","link":"https://www.theregister.com/security/2026/11/02/fbi-pins-63b-binance-crypto-heist-on-north-korean-hackers/5306889","source":"The Register Security","date_rel":"2 Nov"}]},{"title":"Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes","link":"https://cybersecuritynews.com/linux-kernel-rce-flaw-ubuntu-fixes/","reason":"CVE-2026-98432","category":"News","sources":["Cyber Security News","Fortinet PSIRT","SANS Internet Storm Center"],"coverage":3,"cve_ids":["CVE-2026-98432"],"summary":"Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or\u2026","source":"Cyber Security News","date_rel":"3h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/Linux-Kernel-RCE-Flaw-Ubuntu-Fixes.webp","description":"Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now. Canonical\u2019s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04). Stonking (26.10) is\u2026","related":[{"title":"Mutipath TCP: Use and Detection, (Mon, Nov 2nd)","link":"https://isc.sans.edu/diary/rss/33482","source":"SANS Internet Storm Center","date_rel":"22h ago"},{"title":"Linux kernel RCE CVE-2026-98432","link":"https://fortiguard.fortinet.com/psirt/FG-IR-26-188","source":"Fortinet PSIRT","date_rel":"2 Nov"}]},{"title":"ARES AI Red Team Platform Automates 66 Attack Modules for Active Directory and Cloud Security Testing","link":"https://cybersecuritynews.com/ares-ai-red-team-platform/","reason":"Teams","category":"News","sources":["Cyber Security News","The Hacker News","Wiz Research"],"coverage":3,"cve_ids":[],"summary":"A new open-core project called ARES is giving red teams a way to run planned, controlled attack tests against Active Directory and cloud systems. A developer who goes by Mafifrizi released the tool on GitHub. It ships\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/ARES-AI-Red-Team-Platform.webp","description":"A new open-core project called ARES is giving red teams a way to run planned, controlled attack tests against Active Directory and cloud systems. A developer who goes by Mafifrizi released the tool on GitHub. It ships with 66 active modules, with 70 cataloged in total, covering more than 60 techniques mapped to MITRE ATT&CK . It is aimed at enterprise red teams, managed security providers (MSSPs), and security operations centers. Mafifrizi publishes the project as an open-core platform, which means the base tool is free to read and test while a sponsorship page supports ongoing work. The\u2026","related":[{"title":"From Reactive to Proactive: Empowering SOC Teams with the Wiz Red and Blue Agents","link":"https://www.wiz.io/blog/soc-alerts-red-and-blue-agents","source":"Wiz Research","date_rel":"23h ago"},{"title":"Is Your SOC Ready for AI Agents? A Maturity Check Before You Deploy","link":"https://thehackernews.com/2026/11/is-your-soc-ready-for-ai-agents.html","source":"The Hacker News","date_rel":"2 Nov"}]},{"title":"NCSC Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure","link":"https://cybersecuritynews.com/ai-could-accelerate-ransomware/","reason":"Infrastructure Ransomware Warns","category":"News","sources":["Cyber Security News","Infosecurity Magazine"],"coverage":2,"cve_ids":[],"summary":"The UK\u2019s National Cyber Security Center handled 80 nationally significant cyber incidents during its latest reporting year, warning that artificial intelligence is making attacks faster, cheaper and easier to carry out\u2026","source":"Cyber Security News","date_rel":"2h ago","thumbnail":"https://cybersecuritynews.com/wp-content/uploads/2026/11/AI-Could-Accelerate-Ransomware.webp","description":"The UK\u2019s National Cyber Security Center handled 80 nationally significant cyber incidents during its latest reporting year, warning that artificial intelligence is making attacks faster, cheaper and easier to carry out. Its 2026 Annual Review records 1,831 attack reports, with 337 incidents requiring support from its Incident Management Team. The review covers 1 September 2025 to 31 August 2026, marking the NCSC\u2019s tenth year as part of GCHQ. Published on November 3, the NCSC Annual Review 2026 warns that AI is increasing pressure on organizations still struggling to fix known security\u2026","related":[{"title":"NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure","link":"https://www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/","source":"Infosecurity Magazine","date_rel":"1h ago"}]},{"title":"Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)","link":"https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527","reason":"Ivanti","category":"Research","sources":["Bleeping Computer","Rapid7 Blog"],"coverage":2,"cve_ids":["CVE-2026-111357","CVE-2026-118527"],"summary":"Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing\u2026","source":"Rapid7 Blog","date_rel":"2 Nov","thumbnail":"https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt65a432ba319f4043/6846abddaf18306debe6cf4d/ETR.webp","description":"Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload\u2026","related":[{"title":"Ivanti patches two more Connect Secure zero-days chained in attacks","link":"https://www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/","source":"Bleeping Computer","date_rel":"2 Nov"}]},{"title":"PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia","link":"https://www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia","reason":"Windows","category":"News","sources":["Dark Reading","The Hacker News"],"coverage":2,"cve_ids":[],"summary":"Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.","source":"Dark Reading","date_rel":"22h ago","thumbnail":"https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt5084e1dd5e7db648/6ae882291b7efb363cec70fb/rat-David_Chapman-Alamy.jpg?width=720&quality=80&disable=upscale","description":"","related":[{"title":"New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value","link":"https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html","source":"The Hacker News","date_rel":"2 Nov"},{"title":"NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection","link":"https://thehackernews.com/2026/11/netamloader-malware-targets-government.html","source":"The Hacker News","date_rel":"1 Nov"}]}],"worth_reading":[],"kev_watch":[],"vuln_watch":[{"id":"CVE-2026-120442","vendor":"xianhc","product":"ape-volo-admin","severity":"CRITICAL","score":9.8,"description":"ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with th\u2026","cwe":"CWE-1394","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10","https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172","https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120442"},{"id":"CVE-2026-77876","vendor":"Control Web Panel","product":"Control Web Panel","severity":"CRITICAL","score":9.8,"description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the f\u2026","cwe":"CWE-78","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-77876"},{"id":"CVE-2026-102435","vendor":"WordPress","product":"Ultra Addons for Contact Form 7","severity":"CRITICAL","score":9.8,"description":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for \u2026","cwe":"CWE-502","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php","https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7","https://www.wordfence.com/threat-intel/vulnerabilities/id/187777a4-3438-489c-ad3b-7e16753189d6?source=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-102435"},{"id":"CVE-2026-86596","vendor":"WordPress","product":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","severity":"CRITICAL","score":9.8,"description":"The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only \u2026","cwe":"CWE-94","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-subscr-or-wa-w-level.inc.php#L514","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L104","https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L131"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-86596"},{"id":"CVE-2026-120534","vendor":"WordPress","product":"Advanced Custom Fields: Extended PRO","severity":"CRITICAL","score":9.8,"description":"The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration \u2026","cwe":"CWE-434","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://www.acf-extended.com/changelog","https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a7a925-2b9e-43bc-b649-c7ec518e063c?source=cve"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120534"},{"id":"CVE-2026-4052","vendor":"WSO2","product":"WSO2 API Manager","severity":"CRITICAL","score":9.8,"description":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtain\u2026","cwe":"CWE-862","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","fix":false,"fix_url":"","refs":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-4052"},{"id":"CVE-2026-120446","vendor":"madong-code","product":"madong-admin-saas","severity":"CRITICAL","score":9.4,"description":"madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can ca\u2026","cwe":"CWE-306","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","fix":false,"fix_url":"","refs":["https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/controller/tenant/AccountController.php#L26","https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/config/middleware.php","https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120446"},{"id":"CVE-2026-105769","vendor":"Microsoft","product":"kaniko","severity":"CRITICAL","score":9.3,"description":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-creden\u2026","cwe":"CWE-346","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://github.com/chainguard-forks/kaniko/pull/495","https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20","https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-105769"},{"id":"CVE-2026-120213","vendor":"@fastify/http-proxy","product":"@fastify/http-proxy","severity":"CRITICAL","score":9.1,"description":"@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to \u2026","cwe":"CWE-22","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-120213"},{"id":"CVE-2026-73696","vendor":"Control Web Panel","product":"Control Web Panel","severity":"CRITICAL","score":9.1,"description":"Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a miss\u2026","cwe":"CWE-698","kev":false,"kev_action":"","kev_due":"","kev_added":"","epss":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","fix":false,"fix_url":"","refs":["https://control-webpanel.com/changelog","https://www.vulncheck.com/advisories/control-web-panel-cwp-execution-after-redirect-in-cwpuserindex"],"url":"https://cve.blackmesa.ca/?q=CVE-2026-73696"}],"vendor_spikes":[{"vendor":"Google","count":141,"critical_count":0},{"vendor":"WordPress","count":27,"critical_count":4},{"vendor":"Linux","count":22,"critical_count":0},{"vendor":"Dell","count":20,"critical_count":0},{"vendor":"Unknown","count":16,"critical_count":0},{"vendor":"WSO2","count":12,"critical_count":1},{"vendor":"PostgreSQL","count":11,"critical_count":0},{"vendor":"Control Web Panel","count":8,"critical_count":2},{"vendor":"Apache","count":6,"critical_count":0},{"vendor":"Eclipse Foundation","count":6,"critical_count":0}],"epss_risers":[],"developing_map":{},"trending_count":11,"new_cve_count":406,"has_news_data":true,"has_cve_data":true,"news_for_cve":{"CVE-2026-98432":{"anchor":"#dev-6","rank":6,"coverage":3},"CVE-2026-111357":{"anchor":"#dev-9","rank":9,"coverage":2},"CVE-2026-118527":{"anchor":"#dev-9","rank":9,"coverage":2}}}