Watch FloorNov 1, 7:00 PM to Nov 2, 7:00 PM ET
Daily brief, Monday, November 2, 2026
3 breaking, 2 with new public exploit code, 30 new critical CVEs, 51 ransomware posts.
Breaking
Linux (2 CVEs)
- 106 posts from 15 independent sources in 48 h
- Linux kernel: very widely used in large enterprises
- remote code execution / auth bypass
- public exploit code
- emergency / unpatched
- official advisory
CVEs: CVE-2026-98432, CVE-2026-9843
PHP2Shell · PHP
- 10 posts from 8 independent sources in 48 h
- PHP: very widely used in large enterprises
- remote code execution / auth bypass
- exploited in the wild (CISA KEV)
- public exploit code
CVEs: CVE-2026-46300
Ivanti Connect Secure: Privilege escalation (2 CVEs)
- 7 posts from 6 independent sources in 48 h
- rising: 5 posts in the last 24 h
- Ivanti: very widely used in large enterprises
- remote code execution / auth bypass
- exploited in the wild (CISA KEV)
CVEs: CVE-2026-111357, CVE-2026-118527
Newly exploited in the wild
No CVEs added to CISA's known-exploited list.
New public exploit code
- 9.5CVE-2026-116366 ClickHouse ClickHouseNuclei templateDetectionAn attacker can execute arbitrary code on the ClickHouse Server without authentication.
- 4.3CVE-2026-96652 Plex Media ServerNuclei templateKEVDetectionKnown since Oct 20, 2026An attacker with any X-Plex-Token value can force Plex Media Server to send POST requests to an arbitrary destination via the 'protocol' parameter (SSRF).
New critical CVEs
- 9.8CVE-2026-86596 Clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptionsexploit codeAttackers can execute arbitrary code via the 'item_name' parameter in the s2Member plugin for WordPress.
- 9.8CVE-2026-58868 Google Androidexploit codeRemote code execution in Google Android via a heap out-of-bounds write in FrameDecoder.cpp, requiring no extra privileges or user interaction.
- 9.4CVE-2026-120446 Madong-Code madong-admin-saasexploit codeDetectionUnauthenticated remote attackers reach tenant management APIs in madong-admin-saas through 5.1.4 (account, bind-plan, sync-data) due to missing auth.
- 9.8CVE-2026-120442 Xianhc ape-volo-adminexploit codeDetectionAn attacker can gain full administrator access without authentication.
- 9.8CVE-2026-58876 Google AndroidAn attacker gets remote code execution on Android with no authentication or user interaction needed.
- 9.8CVE-2026-58936 Google AndroidAn attacker gets remote code execution on Android with no authentication or user interaction needed.
- 9.8CVE-2026-58968 Google AndroidAn attacker gets remote escalation of privilege on Android with no authentication or user interaction needed.
- 10.0CVE-2026-120276 WAVLINK WN536AX6-AAttacker runs OS commands on WAVLINK WN536AX6-A V260507_2.0.0 via command injection in the group_name argument of the web management interface.
- 10.0CVE-2026-120277 WAVLINKAttacker can inject OS commands via the group_name argument in the WireGuard CLI group handler of WAVLINK WN536AX6-A V260507_2.0.0, running commands on the device.
- 10.0CVE-2026-120345 WAVLINKA remote attacker can inject OS commands via the data argument of the DNS Resolution Handler in WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965.
- 10.0CVE-2026-120279 WAVLINK WN536AX6-ARemote attacker can inject OS commands through the file_id argument in WAVLINK WN536AX6-A V260507's /protocol.csp, gaining command execution on the device.
- 10.0CVE-2026-120280 WAVLINK WN536AX6-AAn attacker can inject OS commands via the group_id and group_name arguments in the WireGuard handler of WAVLINK WN536AX6-A V260507 firmware, initiated remotely.
- 10.0CVE-2026-120344 WAVLINK WN551X3-AA remote attacker can run OS commands on WAVLINK WN551X3-A firmware M51X3_V251020 by injecting input into the group_name argument of the WireGuard CLI Group Handler.
- 9.9CVE-2026-120282 WAVLINK WN536AX6-ARemote attacker can inject OS commands via the mac argument of host_black in /protocol.csp on WAVLINK WN536AX6-A V260507, gaining command execution.
- 9.3CVE-2026-116606 Barracuda Networks Barracuda Email Security Gateway (ESG)Unauthenticated remote attacker bypasses auth in Barracuda Email Security Gateway before 9.4.0.030 and imports a crafted backup, modifying global configuration.
- 9.1CVE-2026-120213 @Fastify/Http-Proxy @fastify/http-proxyPath traversal in @fastify/http-proxy 9.0.0-11.6.5 lets clients reach upstream paths outside the pinned prefix via URL-decoded route parameters when parameterized prefix and rewritePrefix are used.
- 9.9CVE-2026-120322 Termix-SSH TermixTermix up to 2.9.2 has a path traversal via the destPath argument of /plugin-api/file-manager/transferToHost, letting remote attackers reach files outside intended directories.
- 9.8CVE-2026-102435 Themefic Ultra Addons for Contact Form 7The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated atta
- 10.0CVE-2026-120283 LinksysRemote attacker overflows a stack buffer in Linksys E8450 1.2.00.360516 via a crafted hidden_timezone argument to portal.cgi, where strcpy is used unsafely.
- 10.0CVE-2026-120281 WavlinkRemote attacker can trigger a stack-based buffer overflow in the OpenVPN Handler of Wavlink WN536AX6-A V260507 via the openvpn_ip argument in /protocol.csp.
10 more critical CVEs in this window: see them on the dashboard.
Ransomware
51 victims posted to leak sites. Most active: the gentlemen (24), n0n (5), orova (4), akira (3), ransomhouse (2).
Financial services hit: Isapre Consalud (qilin), Company #117 (n0n).
New data breaches
No new breaches published.
Watch Floor collects CVE records, CISA KEV, exploit indexes, official advisories, security news and chatter. Ransomware posts are criminal groups' claims, not confirmed by the victims. Leak-site data: RansomLook, CC BY 4.0; sectors grouped and countries mapped by Watch Floor. Breaking stories as RSS or JSON. watchfloor.fyi
About · Sources · Privacy · Terms · Accessibility · Contact · Support Watch Floor · Powered by MikeGPT