{"@context":{"@vocab":"https://schema.org/","dcterms":"http://purl.org/dc/terms/","prov":"http://www.w3.org/ns/prov#"},"@type":"ItemList","@id":"https://api.morvs.ai/api/v1/nvd/recent","_source":{"data_provider":"AI Analytics","brand_name":"MORVS","brand_url":"https://morvs.ai/","data_provider_url":"https://api.morvs.ai","license":"https://creativecommons.org/publicdomain/zero/1.0/","dcterms:license":"https://creativecommons.org/publicdomain/zero/1.0/","generated_at":"2026-11-02T23:50:54.508Z","primary_source":"https://nvd.nist.gov/"},"filter":{"severity":"CRITICAL","min_score":null,"q":null},"count":50,"items":[{"cve_id":"CVE-2026-120213","published":"2026-11-02T11:17:31.137","last_modified":"2026-11-02T11:17:31.137","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substi","cwes_json":"[\"CWE-22\",\"CWE-436\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120213"},{"cve_id":"CVE-2026-120345","published":"2026-11-02T06:17:43.410","last_modified":"2026-11-02T06:17:43.410","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate ","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120345"},{"cve_id":"CVE-2025-11969","published":"2026-11-02T06:17:42.087","last_modified":"2026-11-02T06:17:42.087","vuln_status":"Received","cvss_base_score":9.4,"cvss_severity":"CRITICAL","description_excerpt":"The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could en","cwes_json":"[\"CWE-285\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11969"},{"cve_id":"CVE-2026-120344","published":"2026-11-02T05:18:25.450","last_modified":"2026-11-02T05:18:25.450","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be perform","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120344"},{"cve_id":"CVE-2026-120322","published":"2026-11-02T02:18:47.550","last_modified":"2026-11-02T02:18:47.550","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is","cwes_json":"[\"CWE-22\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120322"},{"cve_id":"CVE-2026-120283","published":"2026-11-02T01:17:27.500","last_modified":"2026-11-02T01:17:27.500","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacte","cwes_json":"[\"CWE-119\",\"CWE-121\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120283"},{"cve_id":"CVE-2026-120282","published":"2026-11-02T01:17:27.293","last_modified":"2026-11-02T01:17:27.293","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed ","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120282"},{"cve_id":"CVE-2026-120281","published":"2026-11-02T01:17:27.070","last_modified":"2026-11-02T01:17:27.070","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The explo","cwes_json":"[\"CWE-119\",\"CWE-121\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120281"},{"cve_id":"CVE-2026-120280","published":"2026-11-02T01:17:26.873","last_modified":"2026-11-02T01:17:26.873","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may ","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120280"},{"cve_id":"CVE-2026-120279","published":"2026-11-02T01:17:26.677","last_modified":"2026-11-02T01:17:26.677","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely.","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120279"},{"cve_id":"CVE-2026-120277","published":"2026-11-02T00:18:10.810","last_modified":"2026-11-02T00:18:10.810","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possibl","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120277"},{"cve_id":"CVE-2026-120276","published":"2026-11-02T00:18:09.897","last_modified":"2026-11-02T00:18:09.897","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to init","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120276"},{"cve_id":"CVE-2026-120240","published":"2026-11-01T19:16:57.950","last_modified":"2026-11-01T19:16:57.950","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The att","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120240"},{"cve_id":"CVE-2026-120239","published":"2026-11-01T18:17:13.920","last_modified":"2026-11-01T18:17:13.920","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120239"},{"cve_id":"CVE-2026-120238","published":"2026-11-01T18:17:13.720","last_modified":"2026-11-01T18:17:13.720","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The explo","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120238"},{"cve_id":"CVE-2026-62048","published":"2026-11-01T16:18:15.170","last_modified":"2026-11-01T18:18:11.907","vuln_status":"Received","cvss_base_score":9.3,"cvss_severity":"CRITICAL","description_excerpt":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.","cwes_json":"[\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62048"},{"cve_id":"CVE-2026-120338","published":"2026-11-01T16:18:14.970","last_modified":"2026-11-01T16:18:14.970","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno w","cwes_json":"[\"CWE-94\",\"CWE-269\",\"CWE-693\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120338"},{"cve_id":"CVE-2026-120231","published":"2026-11-01T15:17:23.053","last_modified":"2026-11-01T15:17:23.053","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the att","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120231"},{"cve_id":"CVE-2026-120230","published":"2026-11-01T15:17:22.830","last_modified":"2026-11-01T15:17:22.830","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public an","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120230"},{"cve_id":"CVE-2026-120229","published":"2026-11-01T14:18:53.123","last_modified":"2026-11-01T14:18:53.123","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disc","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120229"},{"cve_id":"CVE-2026-120228","published":"2026-11-01T14:18:52.883","last_modified":"2026-11-01T14:18:52.883","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be execu","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120228"},{"cve_id":"CVE-2026-120308","published":"2026-11-01T13:18:01.670","last_modified":"2026-11-01T13:18:01.670","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume","cwes_json":"[\"CWE-22\",\"CWE-668\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120308"},{"cve_id":"CVE-2026-120307","published":"2026-11-01T13:18:01.497","last_modified":"2026-11-01T13:18:01.497","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is ","cwes_json":"[\"CWE-22\",\"CWE-23\",\"CWE-59\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120307"},{"cve_id":"CVE-2026-120306","published":"2026-11-01T13:18:01.300","last_modified":"2026-11-01T13:18:01.300","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It ","cwes_json":"[\"CWE-269\",\"CWE-653\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120306"},{"cve_id":"CVE-2026-120227","published":"2026-11-01T13:18:00.643","last_modified":"2026-11-01T13:18:00.643","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation ","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120227"},{"cve_id":"CVE-2026-120225","published":"2026-11-01T11:18:57.843","last_modified":"2026-11-01T11:18:57.843","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely","cwes_json":"[\"CWE-22\",\"CWE-23\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120225"},{"cve_id":"CVE-2026-120224","published":"2026-11-01T11:18:57.437","last_modified":"2026-11-01T11:18:57.437","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been re","cwes_json":"[\"CWE-266\",\"CWE-285\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120224"},{"cve_id":"CVE-2026-120198","published":"2026-11-01T05:18:57.620","last_modified":"2026-11-01T05:18:57.620","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit ha","cwes_json":"[\"CWE-74\",\"CWE-77\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120198"},{"cve_id":"CVE-2026-120197","published":"2026-11-01T04:18:47.147","last_modified":"2026-11-01T04:18:47.147","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and ma","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120197"},{"cve_id":"CVE-2026-120196","published":"2026-11-01T04:18:46.943","last_modified":"2026-11-01T04:18:46.943","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be us","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120196"},{"cve_id":"CVE-2026-120195","published":"2026-11-01T04:18:46.687","last_modified":"2026-11-01T04:18:46.687","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. ","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120195"},{"cve_id":"CVE-2026-120189","published":"2026-11-01T01:17:16.877","last_modified":"2026-11-01T01:17:16.877","vuln_status":"Received","cvss_base_score":10,"cvss_severity":"CRITICAL","description_excerpt":"A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried","cwes_json":"[\"CWE-119\",\"CWE-121\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120189"},{"cve_id":"CVE-2026-118636","published":"2026-10-31T21:16:53.203","last_modified":"2026-10-31T21:16:53.203","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"**UNSUPPORTED WHEN ASSIGNED** \n\nJavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an\napplication that puts it in front of an untrusted peer is open to gadget-chain RCE.\n\nAs the 3.0.0 branch is inacti","cwes_json":"[\"CWE-502\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118636"},{"cve_id":"CVE-2026-120209","published":"2026-10-31T18:17:09.263","last_modified":"2026-10-31T18:17:09.263","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticate","cwes_json":"[\"CWE-321\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120209"},{"cve_id":"CVE-2026-120201","published":"2026-10-31T18:17:07.890","last_modified":"2026-10-31T18:17:08.023","vuln_status":"Deferred","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condit","cwes_json":"[\"CWE-943\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120201"},{"cve_id":"CVE-2026-118235","published":"2026-10-31T09:16:33.620","last_modified":"2026-10-31T09:16:33.620","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and","cwes_json":"[\"CWE-434\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118235"},{"cve_id":"CVE-2026-103882","published":"2026-10-31T09:16:32.510","last_modified":"2026-10-31T09:16:32.510","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This ma","cwes_json":"[\"CWE-22\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103882"},{"cve_id":"CVE-2026-119096","published":"2026-10-31T08:16:49.043","last_modified":"2026-10-31T08:16:49.043","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verificatio","cwes_json":"[\"CWE-287\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119096"},{"cve_id":"CVE-2026-116512","published":"2026-10-31T08:16:48.603","last_modified":"2026-10-31T08:16:48.603","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter va","cwes_json":"[\"CWE-434\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116512"},{"cve_id":"CVE-2026-89270","published":"2026-10-31T07:16:37.707","last_modified":"2026-10-31T07:16:37.707","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. ","cwes_json":"[\"CWE-862\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89270"},{"cve_id":"CVE-2026-116557","published":"2026-10-31T07:16:35.857","last_modified":"2026-10-31T07:16:35.857","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenti","cwes_json":"[\"CWE-862\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116557"},{"cve_id":"CVE-2026-109220","published":"2026-10-31T07:16:34.367","last_modified":"2026-10-31T07:16:34.367","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note check","cwes_json":"[\"CWE-502\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109220"},{"cve_id":"CVE-2026-63377","published":"2026-10-30T23:17:14.267","last_modified":"2026-10-30T23:17:14.267","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first administrator account ","cwes_json":"[\"CWE-306\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63377"},{"cve_id":"CVE-2026-62863","published":"2026-10-30T21:17:14.547","last_modified":"2026-10-30T21:17:14.547","vuln_status":"Received","cvss_base_score":9.6,"cvss_severity":"CRITICAL","description_excerpt":"MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A malicious web page can op","cwes_json":"[\"CWE-306\",\"CWE-942\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62863"},{"cve_id":"CVE-2026-62853","published":"2026-10-30T21:17:14.267","last_modified":"2026-10-30T21:17:14.267","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled","cwes_json":"[\"CWE-78\",\"CWE-94\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62853"},{"cve_id":"CVE-2026-62849","published":"2026-10-30T21:17:14.120","last_modified":"2026-10-30T23:17:13.043","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remo","cwes_json":"[\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62849"},{"cve_id":"CVE-2026-78403","published":"2026-10-30T20:17:17.843","last_modified":"2026-10-30T20:17:17.843","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"Stack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSenti","cwes_json":"[\"CWE-121\",\"CWE-862\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78403"},{"cve_id":"CVE-2026-61620","published":"2026-10-30T20:17:10.967","last_modified":"2026-10-30T23:17:11.647","vuln_status":"Received","cvss_base_score":9.8,"cvss_severity":"CRITICAL","description_excerpt":"HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchang","cwes_json":"[\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61620"},{"cve_id":"CVE-2026-55598","published":"2026-10-30T20:17:10.063","last_modified":"2026-10-30T20:17:10.063","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episode","cwes_json":"[\"CWE-918\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55598"},{"cve_id":"CVE-2026-116241","published":"2026-10-30T20:17:03.813","last_modified":"2026-10-30T20:17:03.813","vuln_status":"Received","cvss_base_score":9.9,"cvss_severity":"CRITICAL","description_excerpt":"pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \\copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quot","cwes_json":"[\"CWE-78\",\"CWE-115\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116241"}]}