# CVEs published 2026-11-01

100 CVEs were published on November 1, 2026: 23 critical, 11 high. 3 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-b401b3c6fd](https://cve.now/SZB-b401b3c6fd): Synology NAS users reportedly targeted again by C3RB3R ransomware
- [SZB-2a829245c5](https://cve.now/SZB-2a829245c5): Alpine Linux reports attempted GitLab exploit and possible compromise
- [SZB-0a64a5d1f9](https://cve.now/SZB-0a64a5d1f9): Drupal warns of critical Commerce Core access bypass exploited in the wild

## CVEs

- [CVE-2026-120278](https://cve.now/CVE-2026-120278.md): WAVLINK WN536AX6-A VPN Client List ioos sub\_41a7c0 missing authentication (CVSS 6.9, WAVLINK WN536AX6-A)
- [CVE-2026-120277](https://cve.now/CVE-2026-120277.md): WAVLINK WN536AX6-A WireGuard CLI Group ioos sub\_41a1d8 os command injection (CVSS 10.0, WAVLINK WN536AX6-A)
- [CVE-2026-120276](https://cve.now/CVE-2026-120276.md): WAVLINK WN536AX6-A Web Management ioos sub\_416760 os command injection (CVSS 10.0, WAVLINK WN536AX6-A)
- [CVE-2026-120275](https://cve.now/CVE-2026-120275.md): Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection (CVSS 5.1, Shanghai Xi Yu Ji Zhi Technology Minimax Code)
- [CVE-2026-111089](https://cve.now/CVE-2026-111089.md): Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup (CVSS 7.6, Apache Software Foundation Apache Wicket)
- [CVE-2026-95863](https://cve.now/CVE-2026-95863.md): Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup (CVSS 7.6, Apache Software Foundation Apache Wicket)
- [CVE-2026-87718](https://cve.now/CVE-2026-87718.md): Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates (CVSS 2.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-84231](https://cve.now/CVE-2026-84231.md): Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag (CVSS 7.4, Apache Software Foundation Apache Wicket)
- [CVE-2026-84177](https://cve.now/CVE-2026-84177.md): Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore (CVSS 6.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-84172](https://cve.now/CVE-2026-84172.md): Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader (CVSS 6.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-84170](https://cve.now/CVE-2026-84170.md): Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource (CVSS 8.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-83594](https://cve.now/CVE-2026-83594.md): Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names (CVSS 8.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-83559](https://cve.now/CVE-2026-83559.md): Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal (CVSS 7.4, Apache Software Foundation Apache Wicket)
- [CVE-2026-83539](https://cve.now/CVE-2026-83539.md): Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data (CVSS 7.4, Apache Software Foundation Apache Wicket)
- [CVE-2026-82956](https://cve.now/CVE-2026-82956.md): Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name (CVSS 7.6, Apache Software Foundation Apache Wicket)
- [CVE-2026-82898](https://cve.now/CVE-2026-82898.md): Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in (CVSS 2.1, Apache Software Foundation Apache Wicket)
- [CVE-2026-82840](https://cve.now/CVE-2026-82840.md): Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication (CVSS 7.2, Apache Software Foundation Apache Wicket)
- [CVE-2026-82705](https://cve.now/CVE-2026-82705.md): Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component (CVSS 6.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-82704](https://cve.now/CVE-2026-82704.md): Apache Wicket: A listener is invoked on a page instance the request itself created and never configured (CVSS 6.9, Apache Software Foundation Apache Wicket)
- [CVE-2026-82559](https://cve.now/CVE-2026-82559.md): Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation (CVSS 2.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-82558](https://cve.now/CVE-2026-82558.md): Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke (CVSS 2.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-82557](https://cve.now/CVE-2026-82557.md): Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission (CVSS 6.9, Apache Software Foundation Apache Wicket)
- [CVE-2026-82115](https://cve.now/CVE-2026-82115.md): Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource (CVSS 6.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-120274](https://cve.now/CVE-2026-120274.md): beecue FastBee Groovy Script Executor script code injection (CVSS 5.1, beecue FastBee)
- [CVE-2026-120242](https://cve.now/CVE-2026-120242.md): Ruijie RG-ES205GC Cloud Management set\_cloud\_serverUrl.cgi cross site scripting (CVSS 4.8, Ruijie RG-ES205GC · Ruijie RG-ES206GC-P +3)
- [CVE-2026-120241](https://cve.now/CVE-2026-120241.md): Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow (CVSS 8.7, Ruijie RG-ES205GC · Ruijie RG-ES206GC-P +3)
- [CVE-2026-120240](https://cve.now/CVE-2026-120240.md): WAVLINK WN553X1-B WireGuard CLI Group ioos sub\_41A748 os command injection (CVSS 9.4, WAVLINK WN553X1-B)
- [CVE-2026-120239](https://cve.now/CVE-2026-120239.md): WAVLINK WN553X1-B WireGuard CLI ioos sub\_419DA8 os command injection (CVSS 9.4, WAVLINK WN553X1-B)
- [CVE-2026-120238](https://cve.now/CVE-2026-120238.md): WAVLINK WN553X1-B ovpn\_file ioos sub\_4162A8 os command injection (CVSS 9.4, WAVLINK WN553X1-B)
- [CVE-2026-120237](https://cve.now/CVE-2026-120237.md): ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-120236](https://cve.now/CVE-2026-120236.md): ag-ui-protocol ag-ui Transport Decoder input validation (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-74760](https://cve.now/CVE-2026-74760.md): Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login… (no CVSS, Google-Auth)
- [CVE-2026-74759](https://cve.now/CVE-2026-74759.md): Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential\_source URLs in AWS external account… (no CVSS, Google-Auth)
- [CVE-2026-120235](https://cve.now/CVE-2026-120235.md): ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-66570](https://cve.now/CVE-2026-66570.md): WordPress WordPress File Upload plugin \<= 5.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nickboss WordPress File Upload)
- [CVE-2026-119480](https://cve.now/CVE-2026-119480.md): WordPress JetFormBuilder plugin \<= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability (CVSS 6.5, Crocoblock JetFormBuilder)
- [CVE-2026-62048](https://cve.now/CVE-2026-62048.md): WordPress BookIt plugin \<= 2.6.0.6 - SQL Injection vulnerability (CVSS 9.3, Liquid Web / StellarWP BookIt)
- [CVE-2026-120234](https://cve.now/CVE-2026-120234.md): ag-ui-protocol ag-ui HTTP Transport e.text resource consumption (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-120338](https://cve.now/CVE-2026-120338.md): Prefab UI Pyodide sandbox escape to host RCE (CVSS 10.0, PrefectHQ prefab-ui)
- [CVE-2026-120233](https://cve.now/CVE-2026-120233.md): ag-ui-protocol ag-ui HttpAgent http.ts information disclosure (CVSS 6.9, ag-ui-protocol ag-ui)
- [CVE-2026-120232](https://cve.now/CVE-2026-120232.md): Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub\_23908 memory corruption (CVSS 9.3, Horizon DataSys Reboot Restore Standard)
- [CVE-2026-120231](https://cve.now/CVE-2026-120231.md): WAVLINK WN553X1-B OpenVPN CLI ioos sub\_416568 os command injection (CVSS 9.4, WAVLINK WN553X1-B)
- [CVE-2026-120230](https://cve.now/CVE-2026-120230.md): WAVLINK WN701AE ioos Web Backend del\_vlan\_group os command injection (CVSS 9.4, WAVLINK WN701AE)
- [CVE-2026-120229](https://cve.now/CVE-2026-120229.md): WAVLINK WN553X1-B ioos sub\_416B50 os command injection (CVSS 9.4, WAVLINK WN553X1-B)
- [CVE-2026-120228](https://cve.now/CVE-2026-120228.md): WAVLINK WN553X1-B ioos Service sub\_416D88 os command injection (CVSS 9.4, WAVLINK WN553X1-B)
- [CVE-2026-117680](https://cve.now/CVE-2026-117680.md): jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not (CVSS 2.1, lud jsv)
- [CVE-2026-120308](https://cve.now/CVE-2026-120308.md): Beta9 host filesystem exposure via volume path traversal (CVSS 9.9, beam-cloud Beta9 gateway · beam-cloud Beta9 worker)
- [CVE-2026-120307](https://cve.now/CVE-2026-120307.md): Beta9 container escape via unvalidated sandbox file paths (CVSS 9.9, beam-cloud Beta9 worker)
- [CVE-2026-120306](https://cve.now/CVE-2026-120306.md): Beta9 build sandbox escape via chroot-only isolation (CVSS 9.9, beam-cloud Beta9 worker)
- [CVE-2026-120227](https://cve.now/CVE-2026-120227.md): WAVLINK WN701AE ioos Web Backend static\_route\_setting.sh del\_staticrule os command injection (CVSS 9.4, WAVLINK WN701AE)
- [CVE-2026-120226](https://cve.now/CVE-2026-120226.md): Hangzhou Xiongmai Technology P2PAPI.dll P2P SDK P2PAPI\_Connect buffer overflow (CVSS 4.8, Hangzhou Xiongmai Technology P2PAPI.dll)
- [CVE-2026-13575](https://cve.now/CVE-2026-13575.md): HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI (no CVSS, http-session)
- [CVE-2026-120225](https://cve.now/CVE-2026-120225.md): Oray Pugongying X5 Pro openwrt\_release config\_restore\_ex path traversal (CVSS 9.4, Oray Pugongying X5 Pro)
- [CVE-2026-120224](https://cve.now/CVE-2026-120224.md): Oray Pugongying X5 Pro API Authorization run\_async\_task improper authorization (CVSS 9.4, Oray Pugongying X5 Pro)
- [CVE-2026-120223](https://cve.now/CVE-2026-120223.md): Oray Pugongying X5 Pro Session ID session.lua session\_get random values (CVSS 2.3, Oray Pugongying X5 Pro)
- [CVE-2026-119627](https://cve.now/CVE-2026-119627.md): Gitea limited-visibility profile disclosure with public-only tokens (no CVSS, Gitea)
- [CVE-2026-119625](https://cve.now/CVE-2026-119625.md): Gitea user and organization feed token scope bypass (no CVSS, Gitea)
- [CVE-2026-119533](https://cve.now/CVE-2026-119533.md): Gitea private pull request disclosure on project boards (no CVSS, Gitea)
- [CVE-2026-119441](https://cve.now/CVE-2026-119441.md): Gitea public-only token bypass on bulk organization repository deletion (no CVSS, Gitea)
- [CVE-2026-118504](https://cve.now/CVE-2026-118504.md): Gitea issue changes on archived repositories through the API (no CVSS, Gitea)
- [CVE-2026-118395](https://cve.now/CVE-2026-118395.md): Gitea public-only token bypass in repository and organization creation (no CVSS, Gitea)
- [CVE-2026-118394](https://cve.now/CVE-2026-118394.md): Gitea OAuth2 userinfo private group disclosure to public-only tokens (no CVSS, Gitea)
- [CVE-2026-117685](https://cve.now/CVE-2026-117685.md): Gitea public-only package token access to private OCI blobs (no CVSS, Gitea)
- [CVE-2026-117677](https://cve.now/CVE-2026-117677.md): Gitea Helm chart upload decompression denial of service (no CVSS, Gitea)
- [CVE-2026-117649](https://cve.now/CVE-2026-117649.md): Gitea private issue disclosure through issue dependency timeline events (no CVSS, Gitea)
- [CVE-2026-117646](https://cve.now/CVE-2026-117646.md): Gitea private repository listing to public-only tokens on profiles (no CVSS, Gitea)
- [CVE-2026-117635](https://cve.now/CVE-2026-117635.md): Gitea admin API public-only token scope bypass (no CVSS, Gitea)
- [CVE-2026-116474](https://cve.now/CVE-2026-116474.md): Gitea Actions job token spoofing of instance-signed commits (no CVSS, Gitea)
- [CVE-2026-116296](https://cve.now/CVE-2026-116296.md): Gitea archived repository release, milestone and label modification (no CVSS, Gitea)
- [CVE-2026-116289](https://cve.now/CVE-2026-116289.md): Gitea public-only token bypass through Actions runner registration (no CVSS, Gitea)
- [CVE-2026-114199](https://cve.now/CVE-2026-114199.md): Gitea contribution heatmap private activity disclosure to public-only tokens (no CVSS, Gitea)
- [CVE-2026-113429](https://cve.now/CVE-2026-113429.md): Gitea stored XSS through legacy Actions artifact Content-Encoding (no CVSS, Gitea)
- [CVE-2026-112887](https://cve.now/CVE-2026-112887.md): Gitea Actions task token private repository enumeration (no CVSS, Gitea)
- [CVE-2026-120263](https://cve.now/CVE-2026-120263.md): Gitea OAuth2 account auto-linking takeover through the sign-up form (no CVSS, Gitea)
- [CVE-2026-118386](https://cve.now/CVE-2026-118386.md): Gitea Actions fork workflow trust through pull request review commit (no CVSS, Gitea)
- [CVE-2026-120218](https://cve.now/CVE-2026-120218.md): Typemill SvgSanitizer.php saveImage cross site scripting (CVSS 5.1, Typemill)
- [CVE-2026-120217](https://cve.now/CVE-2026-120217.md): Delgan loguru ANSI Color-Markup \_colorizer.py AnsiParser.feed redos (CVSS 5.3, Delgan loguru)
- [CVE-2026-118168](https://cve.now/CVE-2026-118168.md): MapPress Maps for WordPress \< 2.97.15 - Unauthenticated Email Address Disclosure (CVSS 5.3, MapPress)
- [CVE-2026-113482](https://cve.now/CVE-2026-113482.md): Media Library Assistant \< 3.44 - Contributor+ Stored XSS via mla\_item\_parameter Shortcode Attribute (CVSS 6.8, Media Library Assistant)
- [CVE-2026-113481](https://cve.now/CVE-2026-113481.md): Media Library Assistant \< 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields (CVSS 4.3, Media Library Assistant)
- [CVE-2026-107343](https://cve.now/CVE-2026-107343.md): Kali Forms \< 2.4.30 - Subscriber+ Email Sending and Sender Spoofing (CVSS 4.3, Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-107342](https://cve.now/CVE-2026-107342.md): Kali Forms \< 2.4.30 - Subscriber+ User Email Address Disclosure (CVSS 4.3, Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-120198](https://cve.now/CVE-2026-120198.md): WAVLINK WL-WN530BE1-A protocol.csp con\_check\_read\_finish command injection (CVSS 10.0, WAVLINK WL-WN530BE1-A)
- [CVE-2026-120197](https://cve.now/CVE-2026-120197.md): WAVLINK WL-WN530HG4B wapi.cgi port\_forward os command injection (CVSS 9.4, WAVLINK WL-WN530HG4B)
- [CVE-2026-120196](https://cve.now/CVE-2026-120196.md): WAVLINK WN579X3-D wapi.cgi port\_forward os command injection (CVSS 9.4, WAVLINK WN579X3-D)
- [CVE-2026-120195](https://cve.now/CVE-2026-120195.md): WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set\_wzdgwMesh os command injection (CVSS 10.0, WAVLINK WL-WN579A3-A)
- [CVE-2026-120192](https://cve.now/CVE-2026-120192.md): Presenton Desktop Authentication Middleware app\_data information disclosure (CVSS 6.9, Presenton)
- [CVE-2026-120191](https://cve.now/CVE-2026-120191.md): Presenton API missing authentication (CVSS 6.9, Presenton)
- [CVE-2026-120252](https://cve.now/CVE-2026-120252.md): imagecodecs 2023.1.23 through 2026.10.10 Stack Buffer Overflow via jpegsof3\_decode() (CVSS 6.8, cgohlke imagecodecs)
- [CVE-2026-120251](https://cve.now/CVE-2026-120251.md): imagecodecs 2026.3.6 through 2026.10.10 Infinite Loop via ccittfax4\_decode() (CVSS 6.8, cgohlke imagecodecs)
- [CVE-2026-120250](https://cve.now/CVE-2026-120250.md): OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections (CVSS 6.0, marketcalls OpenAlgo)
- [CVE-2026-120249](https://cve.now/CVE-2026-120249.md): Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes (CVSS 6.9, Thelia Back-office Default Twig Template)
- [CVE-2026-120248](https://cve.now/CVE-2026-120248.md): Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads (CVSS 4.6, Thelia)
- [CVE-2026-120247](https://cve.now/CVE-2026-120247.md): FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure (CVSS 6.8, FFmpeg)
- [CVE-2026-120246](https://cve.now/CVE-2026-120246.md): FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-120245](https://cve.now/CVE-2026-120245.md): FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-120244](https://cve.now/CVE-2026-120244.md): FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-120243](https://cve.now/CVE-2026-120243.md): FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette (CVSS 6.8, FFmpeg)
- [CVE-2026-120190](https://cve.now/CVE-2026-120190.md): PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting (CVSS 5.1, PostyBirb Plus)
- [CVE-2026-120189](https://cve.now/CVE-2026-120189.md): D-Link DIR-505 TFTP Upload Filename tftpd mp\_upload\_file stack-based overflow (CVSS 10.0, D-Link DIR-505)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.