CVEs published November 1, 2026
100 CVEs were published on November 1, 2026: 23 critical, 11 high. 3 early warnings were posted.
- Published
- 100
- Critical
- 23
- High
- 11
- Medium
- 37
- Low
- 6
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 49
- Early warnings
- 3
Most affected products
- Gitea
- 20
- Apache Software Foundation Apache Wicket
- 19
- WAVLINK WN553X1-B
- 6
- ag-ui-protocol ag-ui
- 5
- FFmpeg
- 5
- Oray Pugongying X5 Pro
- 3
- WAVLINK WN536AX6-A
- 3
- beam-cloud Beta9 worker
- 2
- cgohlke imagecodecs
- 2
- Google-Auth
- 2
Early warnings 3
- SZB-b401b3c6fdSynology NAS users reportedly targeted again by C3RB3R ransomwareSynology · NAS devices
- SZB-2a829245c5Alpine Linux reports attempted GitLab exploit and possible compromiseAlpine Linux · GitLab server (development infrastructure)
- SZB-0a64a5d1f9Drupal warns of critical Commerce Core access bypass exploited in the wildDrupal · Drupal Commerce core
Critical 23
- CVE-2026-120277WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injectionWAVLINK WN536AX6-A
- CVE-2026-120276WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injectionWAVLINK WN536AX6-A
- CVE-2026-120240WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injectionWAVLINK WN553X1-B
- CVE-2026-120239WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injectionWAVLINK WN553X1-B
- CVE-2026-120238WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injectionWAVLINK WN553X1-B
- CVE-2026-62048WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerabilityLiquid Web / StellarWP BookIt
- CVE-2026-120338Prefab UI Pyodide sandbox escape to host RCEPrefectHQ prefab-ui
- CVE-2026-120232Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruptionHorizon DataSys Reboot Restore Standard
- CVE-2026-120231WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injectionWAVLINK WN553X1-B
- CVE-2026-120230WAVLINK WN701AE ioos Web Backend del_vlan_group os command injectionWAVLINK WN701AE
- CVE-2026-120229WAVLINK WN553X1-B ioos sub_416B50 os command injectionWAVLINK WN553X1-B
- CVE-2026-120228WAVLINK WN553X1-B ioos Service sub_416D88 os command injectionWAVLINK WN553X1-B
- CVE-2026-120308Beta9 host filesystem exposure via volume path traversalbeam-cloud Beta9 gateway · beam-cloud Beta9 worker
- CVE-2026-120307Beta9 container escape via unvalidated sandbox file pathsbeam-cloud Beta9 worker
- CVE-2026-120306Beta9 build sandbox escape via chroot-only isolationbeam-cloud Beta9 worker
- CVE-2026-120227WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injectionWAVLINK WN701AE
- CVE-2026-120225Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversalOray Pugongying X5 Pro
- CVE-2026-120224Oray Pugongying X5 Pro API Authorization run_async_task improper authorizationOray Pugongying X5 Pro
- CVE-2026-120198WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injectionWAVLINK WL-WN530BE1-A
- CVE-2026-120197WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injectionWAVLINK WL-WN530HG4B
- CVE-2026-120196WAVLINK WN579X3-D wapi.cgi port_forward os command injectionWAVLINK WN579X3-D
- CVE-2026-120195WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injectionWAVLINK WL-WN579A3-A
- CVE-2026-120189D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflowD-Link DIR-505
High 11
- CVE-2026-111089Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupApache Software Foundation Apache Wicket
- CVE-2026-95863Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupApache Software Foundation Apache Wicket
- CVE-2026-84231Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagApache Software Foundation Apache Wicket
- CVE-2026-84170Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceApache Software Foundation Apache Wicket
- CVE-2026-83594Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesApache Software Foundation Apache Wicket
- CVE-2026-83559Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalApache Software Foundation Apache Wicket
- CVE-2026-83539Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataApache Software Foundation Apache Wicket
- CVE-2026-82956Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameApache Software Foundation Apache Wicket
- CVE-2026-82840Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationApache Software Foundation Apache Wicket
- CVE-2026-120241Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflowRuijie RG-ES205GC · Ruijie RG-ES206GC-P +3
- CVE-2026-66570WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityNickboss WordPress File Upload
Medium, low and unrated 66
- CVE-2026-120278WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authenticationWAVLINK WN536AX6-A
- CVE-2026-120275Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injectionShanghai Xi Yu Ji Zhi Technology Minimax Code
- CVE-2026-87718Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegatesApache Software Foundation Apache Wicket
- CVE-2026-84177Apache Wicket: A component's markup is served as a package resource when its class name contains an underscoreApache Software Foundation Apache Wicket
- CVE-2026-84172Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderApache Software Foundation Apache Wicket
- CVE-2026-82898Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inApache Software Foundation Apache Wicket
- CVE-2026-82705Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componentApache Software Foundation Apache Wicket
- CVE-2026-82704Apache Wicket: A listener is invoked on a page instance the request itself created and never configuredApache Software Foundation Apache Wicket
- CVE-2026-82559Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationApache Software Foundation Apache Wicket
- CVE-2026-82558Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokeApache Software Foundation Apache Wicket
- CVE-2026-82557Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionApache Software Foundation Apache Wicket
- CVE-2026-82115Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourceApache Software Foundation Apache Wicket
- CVE-2026-120274beecue FastBee Groovy Script Executor script code injectionbeecue FastBee
- CVE-2026-120242Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scriptingRuijie RG-ES205GC · Ruijie RG-ES206GC-P +3
- CVE-2026-120237ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumptionag-ui-protocol ag-ui
- CVE-2026-120236ag-ui-protocol ag-ui Transport Decoder input validationag-ui-protocol ag-ui
- CVE-2026-74760Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login…Google-Auth
- CVE-2026-74759Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account…Google-Auth
- CVE-2026-120235ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumptionag-ui-protocol ag-ui
- CVE-2026-119480WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-120234ag-ui-protocol ag-ui HTTP Transport e.text resource consumptionag-ui-protocol ag-ui
- CVE-2026-120233ag-ui-protocol ag-ui HttpAgent http.ts information disclosureag-ui-protocol ag-ui
- CVE-2026-117680jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and notlud jsv
- CVE-2026-120226Hangzhou Xiongmai Technology P2PAPI.dll P2P SDK P2PAPI_Connect buffer overflowHangzhou Xiongmai Technology P2PAPI.dll
- CVE-2026-13575HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHIhttp-session
- CVE-2026-120223Oray Pugongying X5 Pro Session ID session.lua session_get random valuesOray Pugongying X5 Pro
- CVE-2026-119627Gitea limited-visibility profile disclosure with public-only tokensGitea
- CVE-2026-119625Gitea user and organization feed token scope bypassGitea
- CVE-2026-119533Gitea private pull request disclosure on project boardsGitea
- CVE-2026-119441Gitea public-only token bypass on bulk organization repository deletionGitea
- CVE-2026-118504Gitea issue changes on archived repositories through the APIGitea
- CVE-2026-118395Gitea public-only token bypass in repository and organization creationGitea
- CVE-2026-118394Gitea OAuth2 userinfo private group disclosure to public-only tokensGitea
- CVE-2026-117685Gitea public-only package token access to private OCI blobsGitea
- CVE-2026-117677Gitea Helm chart upload decompression denial of serviceGitea
- CVE-2026-117649Gitea private issue disclosure through issue dependency timeline eventsGitea
- CVE-2026-117646Gitea private repository listing to public-only tokens on profilesGitea
- CVE-2026-117635Gitea admin API public-only token scope bypassGitea
- CVE-2026-116474Gitea Actions job token spoofing of instance-signed commitsGitea
- CVE-2026-116296Gitea archived repository release, milestone and label modificationGitea
- CVE-2026-116289Gitea public-only token bypass through Actions runner registrationGitea
- CVE-2026-114199Gitea contribution heatmap private activity disclosure to public-only tokensGitea
- CVE-2026-113429Gitea stored XSS through legacy Actions artifact Content-EncodingGitea
- CVE-2026-112887Gitea Actions task token private repository enumerationGitea
- CVE-2026-120263Gitea OAuth2 account auto-linking takeover through the sign-up formGitea
- CVE-2026-118386Gitea Actions fork workflow trust through pull request review commitGitea
- CVE-2026-120218Typemill SvgSanitizer.php saveImage cross site scriptingTypemill
- CVE-2026-120217Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redosDelgan loguru
- CVE-2026-118168MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address DisclosureMapPress
- CVE-2026-113482Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode AttributeMedia Library Assistant
- CVE-2026-113481Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fieldsMedia Library Assistant
- CVE-2026-107343Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender SpoofingKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-107342Kali Forms < 2.4.30 - Subscriber+ User Email Address DisclosureKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-120192Presenton Desktop Authentication Middleware app_data information disclosurePresenton
- CVE-2026-120191Presenton API missing authenticationPresenton
- CVE-2026-120252imagecodecs 2023.1.23 through 2026.10.10 Stack Buffer Overflow via jpegsof3_decode()cgohlke imagecodecs
- CVE-2026-120251imagecodecs 2026.3.6 through 2026.10.10 Infinite Loop via ccittfax4_decode()cgohlke imagecodecs
- CVE-2026-120250OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connectionsmarketcalls OpenAlgo
- CVE-2026-120249Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination RoutesThelia Back-office Default Twig Template
- CVE-2026-120248Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner UploadsThelia
- CVE-2026-120247FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory DisclosureFFmpeg
- CVE-2026-120246FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM DecoderFFmpeg
- CVE-2026-120245FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster DecoderFFmpeg
- CVE-2026-120244FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX DecoderFFmpeg
- CVE-2026-120243FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf PaletteFFmpeg
- CVE-2026-120190PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scriptingPostyBirb Plus