Daily brief, Friday, November 6, 2026

Breaking

Emerging

Critical bugs in widely used enterprise tech, not spreading widely yet.

Newly exploited in the wild

No CVEs added to CISA's known-exploited list.

New public exploit code

• 9.8CVE-2026-120442 Xianhc ape-volo-adminNuclei templateDetectionUnauthenticated attackers forge admin JWTs with a hardcoded signing key in appsettings.json, gaining full admin access to ape-volo-admin before 3.6.1.
• 7.2CVE-2026-116548 E4jvikwp VikRentCar Car Rental Management SystemNuclei templateDetectionThe VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it p
• 5.3CVE-2026-119495 WebberZone Better SearchNuclei templateDetectionMissing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.
• 5.3CVE-2026-118523 Unknown EventPrimeNuclei templateDetectionThe EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
• 5.3CVE-2026-115574 Zulip zulipNuclei templateDetectionZulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custom_profile_fields=true t
• 4.3CVE-2026-120597 Welcart e-Commerce PluginNuclei templateDetectionA vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site
• 9.8CVE-2026-76519 Cisco Secure Email GatewayMetasploit moduleKEVKnown since Oct 14, 2026Cisco Secure Email Gateway path traversal lets an unauthenticated remote attacker write arbitrary files on the underlying operating system.
• 9.8CVE-2026-76461 Cisco Secure Email GatewayMetasploit moduleKEVKnown since Sep 14, 2026An unauthenticated remote attacker can run arbitrary commands as root on the underlying OS of Cisco Secure Email Gateway (AsyncOS) via SQL injection.

2 older CVEs (published more than 7 days earlier) with new exploit code, below the bar (CVSS under 9, not widely used enterprise tech): CVE-2026-12583 (8.1), CVE-2026-22777 (7.5).

New critical CVEs

• 10.0CVE-2026-109469 Microsoft Entra Device RegistrationAuthorization bypass via a user-controlled key in Microsoft Entra Device Registration lets an unauthorized attacker over a network elevate privileges.
• 9.9CVE-2026-122193 AWS trusted-remote-executionAuthenticated user with Rex-RO or Rex-RW SSM document access runs arbitrary commands as root via OS command injection in Trusted Remote Execution (REX).
• 9.9ISSUE-GHSAjpf886f3wp38 go github.com/canonical/lxdA crafted container image lets an attacker read and write arbitrary files on the host running Canonical LXD (github.com/canonical/lxd) through a templates/ symlink.
• 9.9ISSUE-GHSA9j25mm2h2f76 go github.com/canonical/lxdAn attacker gets arbitrary file write on the host through a symlinked exec-output directory in a crafted image in the LXD (github.com/canonical/lxd) container manager.
• 9.9ISSUE-GHSApjffc2wcf6jm go github.com/canonical/lxdA malicious image server sending a crafted Incus-Image-Hash header can cause an arbitrary file write in the LXD client, leading to arbitrary command execution as root on the server.
• 9.9ISSUE-GHSAfmc8p6q775cc go github.com/canonical/lxdArgument injection via the user-supplied backup compression algorithm in LXD (github.com/canonical/lxd) gives an attacker arbitrary file write on the host and arbitrary code execution.
• 9.9ISSUE-GHSAvghh5rfxxhq8 go github.com/canonical/lxdA crafted image with a rootfs/ symlink gives an attacker arbitrary file read and write on the host in github.com/canonical/lxd.
• 9.9ISSUE-GHSA47w96r3f938g go github.com/canonical/lxdLXD instance snapshots bypass restricted.containers.lowlevel=block, letting an attacker run arbitrary commands on the server via raw.lxc/raw.qemu.
• 9.8CVE-2026-119923 PostgreSQL PostgreSQLRemote attackers can run arbitrary OS commands as the database process user via a heap overflow in the TDS prelogin parser of Babelfish for PostgreSQL.
• 9.1CVE-2026-114630 Elextensions ELEX WordPress HelpDesk & Customer Ticketing SystemUnauthenticated attackers can delete arbitrary files via factory_reset in the ELEX WordPress HelpDesk & Customer Ticketing System plugin through 3.3.8.
• 9.0CVE-2026-63774 Subnet Solutions PowerSYSTEM Center 2024An authenticated user of PowerSYSTEM Center's report designer can execute unauthorized SQL commands via insufficient input validation (SQL injection).
• 9.0CVE-2026-63017 Subnet Solutions PowerSYSTEM Center 2020An authenticated low-privileged user of Subnet Solutions PowerSYSTEM Center 2020 can access resources restricted to administrators due to incorrect authorization.
• 10.0CVE-2026-118423 Unknown WP Libre FormUnauthenticated attackers can upload and execute PHP files via form submissions in WP Libre Form WordPress plugin 1.5.0.1, gaining remote code execution.
• 10.0CVE-2026-71495 Open-Wanderer wandererUnauthenticated attacker can make Wanderer before 0.20.0 fetch arbitrary URLs and return the responses (SSRF) when PUBLIC_PRIVATE_INSTANCE is not true.
• 9.8CVE-2026-110955 Unknown WurdeyUnauthenticated attackers can log in as any administrator with only the username, bypassing signature checks in the Wurdey WordPress plugin through 1.0.0.
• 9.8CVE-2026-113584 Unknown placesterUnauthenticated attackers can overwrite any user's email, including administrators', to take over accounts in the placester WordPress plugin through 1.4.3.
• 9.8CVE-2026-113615 Unknown GS JWT Authentication for WP REST APIUnauthenticated SQL injection in the GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 lets attackers obtain an administrator session.
• 9.8CVE-2026-115230 Unknown WHIZZUnauthenticated attackers can set any WordPress user's password, including administrators, taking over accounts in the WHIZZ plugin through 1.1.8.
• 9.8CVE-2026-116533 Unknown Static SnapshotUnauthenticated attackers can run arbitrary OS commands on the host via Static Snapshot WordPress plugin through 0.2.1 by injecting shell metacharacters.
• 9.8CVE-2026-119516 Mamunur Rashid Radius Booking — Booking Calendar for Appointments & ServicesDeserialization of untrusted data in Radius Booking – Booking Calendar for Appointments & Services, versions through 1.0.20, allows object injection by an attacker.

20 more critical CVEs in this window: see them on the dashboard.

Ransomware

23 victims posted to leak sites. Most active: n0n (8), leakeddata (3), genesis (2), akira (2), vexy (1).

New data breaches

No new breaches published.