Upgrade Advanced Custom Fields: Extended PRO to 0.9.2.7 (CVE-2026-120534). This critical WordPress plugin flaw allows limited code injection and was exploited before a fix. See 1.1 →
02
Apply vendor remediations or mitigations to Zyxel GS1900 switches (CVE-2026-107441). This high-severity out-of-bounds write flaw was exploited before a fix; discontinue use if remediation or mitigations are unavailable. See 1.2 →
03
Upgrade @enspirit/elo to 1.0.1 for the JavaScript sandbox escape. The critical JavaScript emitter flaw allows arbitrary Node.js or browser code execution through unfiltered `.constructor` access. See 1.3 →
04
Upgrade @enspirit/elo to 1.0.1 for the Ruby backend vulnerability. The critical Ruby backend flaw allows remote code execution through unescaped interpolation in emitted string literals. See 1.4 →
1.ACISA KEV
0 this edition
No new KEV additions since 06:00 CST.
Earlier additions still inside their remediation window are in previous editions.
Zero-days not yet in KEV
2 vendor-confirmed
1.1
ACF Extended Advanced Custom Fields: Extended PRO
New since 06:00 CSTZero-dayCritical
CVE-2026-120534
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request
4 entries still inside CISA's remediation window · 0 new since 06:00 CST
Google BrotliCVE-2026-111497contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed streamLatestNov 3 · Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch upDue Nov 107d leftOct 27Nov 10DetailsHide13
Adobe Commerce and MagentoCVE-2026-48356contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or sessionDue Nov 107d leftOct 27Nov 10DetailsHide3
Jul 14CVE publishedNVD · CVSS 9.3 · Critical
Oct 27Added to KEVDue in 14 days · ransomware use unknown
Broadcom VMware ESXCVE-2026-41709contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being loggedLatestOct 29 · Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewallsDue Nov 118d leftOct 28Nov 11DetailsHide5
Jul 30CVE publishedNVD · CVSS 2.7 · Low
Oct 28Added to KEVDue in 14 days · ransomware use unknown
Ivanti Connect SecureCVE-2026-118527contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on diskLatestNov 2 · CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)Due Nov 1310d leftOct 30Nov 13DetailsHide7
Evidence suggests a model may have generated and revised commands during the ransom gang's breach, though researchers stopped short of claiming full automation.
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions
Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students. The post Frontline Education Data Breach Impacts Over 1.3 Million appeared first on SecurityWeek.
The median vulnerability on enterprise network appliances stays unpatched for more than a year, Microsoft’s own telemetry shows, even as the most damaging software flaws are being weaponized within days of disclosure. Microsoft Security Research reported the findings Monday in an analysis of roughly 383,000 CVEs disclosed from 1999 through September 2026. It shows that the median time to patch a…
The most severe is a critical flaw in Framework leading to remote code execution without user interaction. The post Android’s November 2026 Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.
Multiple attacks from the same IP address attempted to deploy various payloads, including a Linux bot and webshells. The post Critical Node-RED Flaw Exploited in Attacks appeared first on SecurityWeek.
European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. [...]
@enspirit/elo · npmElo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
