12 October 2026 – 19 October 2026
This week's critical CVEs
The week in three lists: vulnerabilities CISA has confirmed are being exploited, every CVE the NVD rated CRITICAL (CVSS v3 ≥ 9.0) over the last seven days, and the analyses we published. Start with the first: an exploited flaw outranks a higher CVSS score.
- KEV additions
- 9
- CRITICAL CVEs
- 20
- analyses
- 22
Added to CISA KEV this week
Last 60 daysFortinet Multiple Products Path Traversal Vulnerability
Fortinet · Multiple Products
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
CISA due date
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust · Remote Support
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
CISA due date
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian · Multiple Products
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
CISA due date
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks · PAN-OS
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
CISA due date
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay · AhsayCBS
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
CISA due date
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay · AhsayCBS
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
CISA due date
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco · Secure Email Gateway
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
CISA due date
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti · Connect Secure
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
CISA due date
Microsoft Windows Command Injection Vulnerability
Microsoft · Windows
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
CISA due date
CRITICAL CVEs published
Critical and high, 14 days- CVE-2026-1118629.8CVSS 3.1
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
- CVE-2026-1122929.8CVSS 3.1
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
- CVE-2026-1119989.8CVSS 3.1
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
- CVE-2026-1117049.8CVSS 3.1
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
- CVE-2026-1116939.8CVSS 3.1
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
- CVE-2026-1116439.8CVSS 3.1
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
- CVE-2026-1112819.8CVSS 3.1
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
- CVE-2026-1110948.1CVSS 3.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
- CVE-2026-11095710.0CVSS 3.1
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
- CVE-2026-890737.5CVSS 3.1
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-890688.1CVSS 3.1
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-1106409.8CVSS 3.1
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
- CVE-2026-1106369.8CVSS 3.1
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
- CVE-2026-1106359.8CVSS 3.1
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
- CVE-2020-372829.8CVSS 3.1
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.
- CVE-2026-821109.6CVSS 3.1
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
- CVE-2026-821019.6CVSS 3.1
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
- CVE-2026-196228.8CVSS 3.1
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
- CVE-2026-1095669.8CVSS 3.1
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
Source: NIST NVD, CVSS v3 severity. CVEs still awaiting NVD analysis with no v3 score do not appear here. Why?
Our analyses this week
BlogVanus and phpMyFAQ: a Hard-Coded Admin Token and Passkeys Anyone Can Register (CVE-2026-111998, CVE-2026-111911)
CVE-2026-111998 and CVE-2026-111911 (9.8): a hard-coded admin token in Vanus and a WebAuthn authentication bypass in phpMyFAQ. What to check and do now.
WordPress: LearnPress (9.8) and LatePoint (9.1), Two Plugins Exploitable Without an Account — CVE-2026-104736 and CVE-2026-110653
CVE-2026-104736 LearnPress (9.8, PHP object injection) and CVE-2026-110653 LatePoint (9.1, OTP bypass): affected versions, exposure and what to do.
Hard-Coded Secrets and Unauthenticated APIs: 4 CVEs at 9.8 in LangChat, DataBuff, Simple Admin Core and Misaka Danmu
CVE-2026-111704, 111693, 111690 and 111643 (9.8): default credentials, a public JWT secret and open APIs in four self-hosted open source projects.
WordPress: 6 Unauthenticated 9.8 Plugin Flaws (My Calendar, MailOptin, Mang Board, ELEX HelpDesk…)
Six WordPress plugins rated 9.8, exploitable without an account: My Calendar, MailOptin, Mang Board, ELEX HelpDesk, Theme My Login and Sunshine Photo Cart.
IoT: Wavlink WL-WN530BE2-A (10.0), Jooan JA-A12 Cameras and End-of-Life Lantronix XPress-DR
CVE-2026-110957 (10.0) on Wavlink, CVE-2026-111281 on Jooan cameras, CVE-2026-109439 on end-of-life Lantronix XPress-DR: patch, isolate or replace them.
CVE-2025-61624 Fortinet: a MEDIUM Flaw in CISA KEV — FortiOS, FortiProxy, FortiPAM, FortiSwitchManager
CVE-2025-61624 (6.5): path traversal in FortiOS, FortiProxy, FortiPAM and FortiSwitchManager, published in April, in CISA KEV in October. Versions and fixes.
BMC Helix Network Management CVE-2026-111283: Authentication Bypass With SAML SSO, Fixed in 26.3.01
CVE-2026-111283 (9.0): with SAML SSO configured, BMC Helix Network Management on-prem accepts the local admin account with any password. Fixed in 26.3.01.
CVE-2026-102764 BeyondTrust Remote Support: Authentication Bypass in CISA KEV One Day After Publication
CVE-2026-102764 BeyondTrust Remote Support (9.8): exploited authentication bypass, added to CISA KEV the next day. Versions 26.2.3 and earlier affected.
Atlassian Data Center CVE-2026-21589 in CISA KEV: Unauthenticated File Read Across 8 Products
CVE-2026-21589 (7.5) added to CISA KEV: unauthenticated file read on Jira, Confluence, Bitbucket, Bamboo and Crowd Data Center. Deadline October 18.
Archon, JuggleIM, Agora Project: Three Self-Hosted Tools at 9.8, an AI Agent API Open to Anyone
CVE-2026-111322, 111329, 63146 (9.8): Archon exposes an AI agent without auth, JuggleIM recreates its default admin, Agora Project is fixed in 26.10.0.
Palo Alto PAN-OS CVE-2026-0322 in CISA KEV: Root RCE via the Management Interface
CVE-2026-0322 (7.2): root RCE on PAN-OS through the management interface for an authenticated attacker. Added to CISA KEV on Oct 14, due Oct 17. What to do.
npm and PyPI: 6 Packages With 9.8 Shell Command Injection (office-converter, webp-converter, pypdftk…)
Six npm and PyPI packages (office-converter, webp-converter, pypdftk, doc-recog, whisper-node, transcribe2texts) hand file paths to a shell. All rated 9.8.
Juniper Junos OS: CVE-2026-101950 (SVR on SRX) and CVE-2026-102178 (BGP flowspec), Two 9.8 Flaws
Junos OS: heap overflow in SVR on SRX (CVE-2026-101950) and stack overflow in BGP flowspec (CVE-2026-102178), both 9.8. JSA bulletins and interim measures.
Cisco Secure Email Gateway CVE-2026-76519 in CISA KEV: One Email Is Enough for Root
CVE-2026-76519 (9.8): a crafted attachment is enough to write files and run root commands on Cisco Secure Email Gateway via AMP. In CISA KEV, due October 17.
AhsayCBS CVE-2026-105133 and 105134 in CISA KEV: an Exploit Chain on the Backup Server
AhsayCBS: auth bypass CVE-2026-105133 and command injection CVE-2026-105134, chainable, added to CISA KEV. Upgrade to 10.3.4 and lock down the console.
Windows Shell CVE-2026-96951 in CISA KEV: Security Feature Bypass, Due October 16
CVE-2026-96951: command injection in Windows Shell, exploited per CISA, due October 16. No NVD score yet: how to prioritise it and what to watch on endpoints.
Wazuh CVE-2026-74040: One Compromised Worker Takes the Master and Every Agent, Fixed in 4.14.8
CVE-2026-74040 (9.1): a compromised Wazuh cluster worker overwrites protected master files, leading to root RCE on the manager and every agent. Fixed in 4.14.8.
Ivanti Connect Secure CVE-2026-104935 in CISA KEV: Unauthenticated Command Execution
CVE-2026-104935: authentication bypass in Ivanti Connect Secure, exploited, CISA due date October 16. No NVD score yet: what to check on your VPN appliances.
IBM DataStage and WebSphere Liberty: CVE-2026-82110, 82101 and 93895, Three Critical Flaws in Two Days
IBM: two 9.6 path traversals in DataStage on Cloud Pak for Data 5.4.0.0 (RCE and DoS) and a 9.1 gRPC access-control bypass in WebSphere Liberty. What to patch.
Adobe Commerce and AEM: CVE-2026-100133 and 106629, Two Stored XSS Rated 9.3
CVE-2026-100133 (Adobe Commerce) and CVE-2026-106629 (Experience Manager): two stored XSS flaws rated 9.3 with changed scope. Why so high, and what to do.
Netcore NR268 and Wavlink WL-WN530BE1-A Routers: CVE-2026-108929 and CVE-2026-109108 (9.9)
Two 9.9 router CVEs: DDNS argument injection on Netcore NR268, VPN upload command injection on Wavlink. No NVD fix yet: isolate the devices, plan replacement.
Rapyd Admin CVE-2026-109566 and Grav Login OAuth CVE-2026-109321: Predictable Credentials
Rapyd Admin (fixed in 9.20.0) re-creates a default super-admin, Grav Login OAuth (fixed in 1.4.3) derives its passwords. Two critical CVEs worth handling.