2 items: 1 new KEV entry, 1 priority story since 12:00 CST · 5 today
01
Apply vendor mitigations for WordPress Core (CVE-2026-119977, KEV due Nov 6). CISA lists this high-severity race condition vulnerability and calls for following its security-update and forensics-triage guidance. See 1.1 →
02
Change passwords, reset 2FA and remove passkeys for mSecure. A November 3 email urges customers to protect their stored confidential information following suspicious activity. See story →
1.ACISA KEV
1 since 12:00 CST
1.1
WordPress Core
New since 12:00 CSTZero-dayTotal impactHigh
CVE-2026-119977
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but
CVE-2026-120534The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field functionCriticalMidday →
@enspirit/elo · npmElo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member accessCriticalMidday →
Show 1 more item from earlier todayShow fewer
CVE-2026-107441An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP requestHighMidday →
§ 02
CISA KEV
5 entries still inside CISA's remediation window · 1 new since 12:00 CST
WordPress CoreCVE-2026-119977New since 12:00 CSTcontains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade windowAct now 1.1 →Due Nov 63d leftNov 3Nov 6DetailsHide2
Oct 31CVE publishedNVD · CVSS 8.1 · High
Nov 3Added to KEVDue in 3 days · ransomware use unknown
Google BrotliCVE-2026-111497contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed streamLatestNov 3 · Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch upDue Nov 107d leftOct 27Nov 10DetailsHide13
Adobe Commerce and MagentoCVE-2026-48356contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or sessionDue Nov 107d leftOct 27Nov 10DetailsHide3
Jul 14CVE publishedNVD · CVSS 9.3 · Critical
Oct 27Added to KEVDue in 14 days · ransomware use unknown
Broadcom VMware ESXCVE-2026-41709contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being loggedLatestOct 29 · Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewallsDue Nov 118d leftOct 28Nov 11DetailsHide5
Jul 30CVE publishedNVD · CVSS 2.7 · Low
Oct 28Added to KEVDue in 14 days · ransomware use unknown
Ivanti Connect SecureCVE-2026-118527contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on diskLatestNov 2 · CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)Due Nov 1310d leftOct 30Nov 13DetailsHide7
Large language model hijacking attacks, also known as LLMjacking, are generating large fraudulent cloud charges, with some organizations losing more than $100,000 per day. [...]
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. [...]
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but
Bison BagBison Bag is a flexible packaging specialist that offers custom printing and design for a varie ty of packaging solutions including pouches,…
Retail & E-Commerce—akira
08:23 CST
SK Global SoftwareSK Global Software is a Microsoft Dynamics ISV offering specialized Add-in Solutions for the Mi crosoft Dynamics 365 / Dynamics AX ERP platf…
TechnologyKRakira
08:22 CST
Pelham PlasticsPelham Plastics is a custom plastic engineering company that specializes in high-quality inject ion molds and custom equipment. They focus o…
