Watch FloorNov 2, 7:00 PM to Nov 3, 7:00 PM ET
Daily brief, Tuesday, November 3, 2026
2 breaking, 3 emerging, 1 newly exploited, 8 with new public exploit code, 59 new critical CVEs, 27 ransomware posts, 1 new breaches.
Breaking
PHP2Shell · PHP
- 13 posts from 8 independent sources in 48 h
- rising: 10 posts in the last 24 h
- PHP: very widely used in large enterprises
- remote code execution / auth bypass
- exploited in the wild (CISA KEV)
- public exploit code
CVEs: CVE-2026-109618
Linux
- 55 posts from 18 independent sources in 48 h
- Linux kernel: very widely used in large enterprises
- remote code execution / auth bypass
- emergency / unpatched
- official advisory
CVEs: CVE-2026-98432
Emerging
Critical bugs in widely used enterprise tech, not spreading widely yet.
GitLab: Memory corruption
- 6 posts from 4 independent sources in 48 h
- GitLab / GitHub: very widely used in large enterprises
- remote code execution / auth bypass
- exploited in the wild (CISA KEV)
- public exploit code
- emergency / unpatched
CVEs: CVE-2026-97229
CVE-2026-58115: Auth bypass / access control
- 5 posts from 5 independent sources in 48 h
- rising: 5 posts in the last 24 h
- Linux kernel: very widely used in large enterprises
- auth bypass / access control
- reports of exploitation in the wild
CVEs: CVE-2026-58115
Ivanti Connect Secure: Privilege escalation (2 CVEs)
- 6 posts from 6 independent sources in 48 h
- Ivanti: very widely used in large enterprises
- exploited in the wild (CISA KEV)
CVEs: CVE-2026-111357, CVE-2026-118527
Newly exploited in the wild
New public exploit code
- 7.5CVE-2026-116690 Mlflow mlflowNuclei templateDetection### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless l
- 10.0CVE-2026-97229 GitLab GitLabNuclei templateKEVDetectionCVE published Oct 13, 2026An attacker can execute arbitrary code on the GitLab server without authentication.
- 9.3CVE-2026-102764 BeyondTrust Remote SupportNuclei templateKEVDetectionKnown since Oct 16, 2026A remote attacker bypasses authentication by spoofing and performs file operations on BeyondTrust Remote Support appliances.
- 9.9CVE-2026-7873 IBM Langflow OSSNuclei templateDetectionCVE published Jun 30, 2026Product not on watchlist.
- 9.8CVE-2026-75128 Chatchat-Space Langchain-ChatchatNuclei templateDetectionCVE published Oct 20, 2026Attackers can execute arbitrary OS commands without authentication on Langchain-Chatchat.
- 9.8CVE-2026-25555 Metasploit moduleDetectionCVE published Jun 8, 2026OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middle
- 9.3CVE-2026-112866 WPFactory Product Filter by WBWNuclei templateDetectionCVE published Oct 24, 2026An attacker performs Blind SQL Injection on WPFactory Product Filter by WBW.
- 9.1CVE-2024-5450 Unknown Bug LibraryMetasploit moduleCVE published Jul 13, 2024Product not on watchlist. Public PoC seen.
4 older CVEs (published more than 7 days earlier) with new exploit code, below the bar (CVSS under 9, not widely used enterprise tech): CVE-2026-25856 (8.8), CVE-2026-12970 (7.1), CVE-2026-39908 (6.5), CVE-2026-53468 (4.6).
New critical CVEs
- 9.8CVE-2026-44267 npm @enspirit/eloexploit codeAn attacker executes arbitrary Node.js or browser code via unfiltered `.constructor` member access in Elo JavaScript emitter.
- 9.8CVE-2026-44266 npm @enspirit/eloAn attacker executes arbitrary code via unescaped `#{...}` interpolation in Elo Ruby backend string literals.
- 9.6CVE-2026-121156 Google ChromeRemote attacker executes arbitrary code outside the sandbox in Google Chrome before 157.0.8103.38 via a crafted HTML page, exploiting a Dawn buffer overflow.
- 9.6CVE-2026-121229 Google ChromeMemory corruption in ANGLE in Google Chrome on Android before 157.0.8103.38 lets a remote attacker run arbitrary code outside the sandbox via a crafted HTML page.
- 9.6CVE-2026-121246 Google ChromeUse-after-free in WebGL in Chrome for Android before 157.0.8103.38 lets a remote attacker run arbitrary code outside the sandbox via a crafted HTML page.
- 9.6CVE-2026-121035 Google ChromeA use-after-free in Prerender in Google Chrome before 157.0.8103.38 lets a remote attacker run arbitrary code outside the sandbox via a crafted HTML page.
- 9.6CVE-2026-121247 Google ChromeRemote attacker gets arbitrary code execution outside the sandbox in Google Chrome for Android before 157.0.8103.38 via a crafted HTML page.
- 9.6CVE-2026-121126 Google ChromeUse after free in Chrome before 157.0.8103.38 lets a remote attacker execute arbitrary code outside the sandbox via a crafted HTML page.
- 9.6CVE-2026-121074 Google ChromeMemory corruption in Google Chrome GPU on Android before 157.0.8103.38 lets a remote attacker run arbitrary code outside the sandbox via a crafted HTML page.
- 9.6CVE-2026-121071 Google Chrome+2 more CVEs in the same releaseRemote attacker runs code outside the sandbox in Chrome before 157.0.8103.38 via a crafted HTML page, requiring social engineering and user interaction.
- 9.6CVE-2026-121185 Google ChromeRemote code execution outside the Chrome sandbox via a crafted HTML page, requiring social engineering to lure the user, in Google Chrome before 157.0.8103.38.
- 9.6CVE-2026-121030 Google ChromeA remote attacker using social engineering can execute arbitrary code outside the sandbox in Google Chrome via incorrect authorization in DevTools, using a crafted HTML page.
- 9.6CVE-2026-121034 Google ChromeA remote attacker using social engineering can execute arbitrary code outside the sandbox in Google Chrome on Windows via a use-after-free in Views.
- 9.6CVE-2026-121037 Google ChromeA remote attacker can execute arbitrary code outside the sandbox in Google Chrome on Windows via an out-of-bounds write in ANGLE, using a crafted HTML page.
- 9.6CVE-2026-121073 Google ChromeA use-after-free in Chrome's Network component before 157.0.8103.38 lets a remote attacker run arbitrary code outside the sandbox via crafted network traffic.
- 9.6CVE-2026-121076 Google ChromeUse-after-free in Chrome WebXR before 157.0.8103.38 lets a remote attacker run code outside the sandbox via a crafted HTML page after social engineering.
- 9.6CVE-2026-121077 Google Chrome+1 more CVEs in the same releaseUse after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 9.6CVE-2026-121086 Google ChromeBuffer overflow in Skia in Google Chrome before 157.0.8103.38 lets a remote attacker run arbitrary code outside the sandbox via a crafted HTML page.
- 9.6CVE-2026-121089 Google ChromeRemote attacker can execute arbitrary code outside the sandbox via a crafted HTML page exploiting a use-after-free in WebGPU in Chrome before 157.0.8103.38.
- 9.6CVE-2026-121114 Google ChromeRemote attacker executes arbitrary code outside the sandbox in Google Chrome before 157.0.8103.38 via a crafted HTML page, exploiting a TabStrip use-after-free.
36 more critical CVEs in this window: see them on the dashboard.
Ransomware
27 victims posted to leak sites. Most active: n0n (10), booba team (4), akira (3), whitearmor (1), the gentlemen (1).
New data breaches
- Harvard harvard.edu850,537 accounts
Watch Floor collects CVE records, CISA KEV, exploit indexes, official advisories, security news and chatter. Ransomware posts are criminal groups' claims, not confirmed by the victims. Leak-site data: RansomLook, CC BY 4.0; sectors grouped and countries mapped by Watch Floor. Breaking stories as RSS or JSON. watchfloor.fyi
About · Sources · Privacy · Terms · Accessibility · Contact · Support Watch Floor · Powered by MikeGPT