Watch FloorNov 4, 7:00 PM to Nov 5, 7:00 PM ET
Daily brief, Thursday, November 5, 2026
5 breaking, 2 emerging, 1 with new public exploit code, 37 new critical CVEs, 22 ransomware posts.
Breaking
Linux
- 27 posts from 17 independent sources in 48 h
- Linux kernel: very widely used in large enterprises
- remote code execution / auth bypass
- reports of exploitation in the wild
- Cloudflare Zero Wire: needs attention
CVEs: CVE-2026-98432
WordPress Foundation WordPress: Code / command injection
- 17 posts from 15 independent sources in 48 h
- Office: widely used in large enterprises
- code / command injection
- exploited in the wild (CISA KEV)
- public exploit code
- official advisory
CVEs: CVE-2026-119977
CVE-2026-58115: Auth bypass / access control
- 11 posts from 11 independent sources in 48 h
- Linux kernel: very widely used in large enterprises
- auth bypass / access control
- reports of exploitation in the wild
- official advisory
CVEs: CVE-2026-58115
Debian
- 10 posts from 9 independent sources in 48 h
- rising: 10 posts in the last 24 h
- Linux kernel: very widely used in large enterprises
- remote code execution / auth bypass
- named threat actor activity
- official advisory
CVEs: CVE-2026-109518
Apple safari: Auth bypass / access control
- 7 posts from 6 independent sources in 48 h
- rising: 7 posts in the last 24 h
- macOS / iOS: very widely used in large enterprises
- auth bypass / access control
- exploited in the wild (CISA KEV)
CVEs: CVE-2024-27834
Emerging
Critical bugs in widely used enterprise tech, not spreading widely yet.
Ivanti Connect Secure
- 5 posts from 4 independent sources in 48 h
- Ivanti: very widely used in large enterprises
- exploited in the wild (CISA KEV)
CVEs: CVE-2026-118527
SonicWall GMS: Information disclosure (2 CVEs)
- 5 posts from 5 independent sources in 48 h
- SonicWall: widely used in large enterprises
- remote code execution / auth bypass
CVEs: CVE-2026-109593, CVE-2026-109594
Newly exploited in the wild
No CVEs added to CISA's known-exploited list.
New public exploit code
New critical CVEs
- 9.8CVE-2026-116779 FreeSWITCH FreeSWITCHexploit code+2 more CVEs in the same releaseFreeSWITCH before 1.11.3 has a command injection flaw where an attacker can inject commands through the To user of an inbound SIP MESSAGE.
- 10.0CVE-2026-73117 Apache Apache JuneauApache Juneau REST server passes unchecked header and redirect values, enabling HTTP response splitting via CRLF injection when apps use user input.
- 10.0CVE-2026-121489 Apache Apache JuneauApache Juneau's DirectoryResource lets an attacker read, upload or delete files outside its root directory when those settings are enabled.
- 10.0CVE-2026-96677 Apache Apache JuneauApache Juneau HTML document serialization fails to HTML-encode variable substitutions in page chrome fields, allowing cross-site scripting in generated pages.
- 10.0CVE-2026-73099 Apache Apache JuneauApache Juneau REST server CSRF: a cross-site link forges endpoint requests with an attacker-chosen body via the default-enabled 'content' query parameter.
- 10.0CVE-2026-73100 Apache Apache JuneauApache Juneau's default REST logger logs unredacted Authorization and Cookie headers for server-error requests, exposing them to any client able to trigger one.
- 10.0CVE-2026-73101 Apache Apache JuneauAttackers can read internal exception classes and messages from Apache Juneau REST server error responses, via the Thrown header and error bodies.
- 10.0CVE-2026-73098 Apache Apache JuneauApache Juneau initializes any classpath class named in input parsed into a java.lang.Class property, letting an attacker run its static initializers.
- 10.0CVE-2026-73116 Apache Apache JuneauApache Juneau RestClient keeps credential headers when following redirects to another host, port, or HTTP, exposing those credentials to the redirect target server.
- 9.9CVE-2026-122313 Kyverno KyvernoNamespace-scoped tenants of Kyverno 1.17.0 before 1.19.2 can modify resources in other namespaces via unchecked NamespacedMutatingPolicy target CEL expressions.
- 9.9CVE-2026-122303 Kyverno kyvernoAn authorization bypass in Kyverno 1.17.0 before 1.19.2 lets namespace tenants overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing target expressions.
- 9.9CVE-2026-122304 Kyverno kyvernoNamespace admins in Kyverno 1.17.0 before 1.19.2 can escape namespace confinement through the cleanup controller, bypassing authorization checks.
- 9.9CVE-2026-122310 Kyverno kyvernoKyverno 1.19.1 before 1.19.2 lets a namespace-scoped user who can create a Policy hide ../ path segments behind # or ? to reach cluster-scoped API endpoints.
- 9.9CVE-2026-122311 Kyverno kyvernoKyverno 1.16.0-1.19.1 path traversal lets a tenant allowed to create NamespacedValidatingPolicy read and write cluster resources outside its namespace.
- 9.9CVE-2026-71550 SuiteCRM SuiteCRM+1 more CVEs in the same releasePath traversal in SuiteCRM's workflow controller aow_action value lets attackers include files outside the intended path via require_once() in versions before 7.15.2 and 8.10.2.
- 9.9CVE-2026-111489 TPC Software MatchpointA static credential embedded in TPC Software's MatchPoint mobile app returns an 'autorizado' token granting unauthenticated access to API services.
- 9.9CVE-2026-111490 TPC Software MatchpointAttacker accesses personal, banking, and financial data of other users in TPC Software Matchpoint API by manipulating the actingasuser header.
- 9.8CVE-2026-122302 Kyverno kyvernoAn attacker can create resources beyond their RBAC permissions using Kyverno.
- 9.8CVE-2026-100109 Unknown Security For WooCommerceUnauthenticated attackers can create administrator accounts in the Security For WooCommerce WordPress plugin 1.0.10-1.0.16 by setting the new user's role.
- 9.8CVE-2026-82907 Apache Apache OFBizUnauthenticated remote attacker who captures a live externalLoginKey replays it for a reusable session as that user in Apache OFBiz 24.09 before 24.09.08.
14 more critical CVEs in this window: see them on the dashboard.
Ransomware
22 victims posted to leak sites. Most active: n0n (7), akira (4), qilin (2), leakeddata (2), redact (1).
Financial services hit: Insurance Audit Services (qilin), Delta Dental of Missouri (n0n).
New data breaches
No new breaches published.
Watch Floor collects CVE records, CISA KEV, exploit indexes, official advisories, security news and chatter. Ransomware posts are criminal groups' claims, not confirmed by the victims. Leak-site data: RansomLook, CC BY 4.0; sectors grouped and countries mapped by Watch Floor. Breaking stories as RSS or JSON. watchfloor.fyi
About · Sources · Privacy · Terms · Accessibility · Contact · Support Watch Floor · Powered by MikeGPT