What you need to know today.
Critical vulnerabilities disclosed across multiple vendors, including command injection flaws and unauthorized access risks.
A critical OS command injection vulnerability in Tenda AC19 firmware (CVE-2026-113744) allows attackers to execute arbitrary commands by manipulating the formSetFirewallCfg function. This impacts the httpd Web Management Service and poses a significant risk to network security.
IBM DataStage on Cloud Pak for Data (5.4.0.0) is affected by a critical vulnerability (CVE-2026-81212) that permits unauthenticated users to write to shared Redis instances under any tenant's key. This compromises the platform's credential-encryption boundary, enabling anonymous attackers to potentially gain unauthorized access and control.
OpenStack Manila before version 23.0.1 has a critical flaw (CVE-2026-71195) where multiple API operations on public shares fail to verify share ownership. This allows unauthorized users to perform actions on shares they do not own, potentially leading to data exposure or manipulation.
Best Practice Software Bp Premier versions prior to 1.14.1.1128 contain a critical hardcoded administrative password for Microsoft SQL Server (CVE-2026-114119). This shared password, which cannot be changed without breaking the application, exposes all installations to attackers with network access.
D-Link DHP-W610AV firmware 1.02EUb03 has a critical vulnerability in its HNAP Login component (CVE-2026-113736). Manipulation of the Password argument in the login_prepare_hnap function within /etc/defnodes/defaultvalue.xml can lead to unauthorized access.
IBM App Connect Enterprise (versions 13.0.1.0 through 13.0.8.2) is susceptible to a critical information disclosure vulnerability (CVE-2026-92559) due to binding to an unrestricted IP address, potentially allowing remote attackers to obtain sensitive data.
Multiple critical vulnerabilities have been identified in Oracle Enterprise Manager for Oracle Database (versions 13.5 and 24.1) and Oracle Trusted Answer Search (version 26.1), and Oracle Siebel CRM Cloud Applications (versions 17.0-26.9). These flaws, including CVE-2026-101529, CVE-2026-101528, CVE-2026-101503, CVE-2026-101501, and CVE-2026-101446, are easily exploitable by low-privileged attackers with network access via Oracle Net, potentially leading to system compromise.
Kiro Crew's WhatsApp group channel has a critical missing authorization flaw (CVE-2026-112380). A member of an operator-configured WhatsApp group can control other agent sessions and execute arbitrary commands on the host, posing a severe security risk.
Wavlink WL-WN530BE1-A firmware (up to M30BE1_V251117) contains a critical OS command injection vulnerability (CVE-2026-113802) in the ioos binary. The sub_23B54 function passes an unsanitized file_id parameter, allowing attackers to inject and execute commands.
aaPanel versions up to 8.25.0 have a critical OS command injection vulnerability in the File Manager component (CVE-2026-113506). The ExecShell function in class/public/common.py is susceptible to manipulation of arguments like sfile, dfile, access, and user, leading to command execution.
Eclipse ioFog Controller versions 3.8.0 through 3.9.1 suffer from a critical vulnerability where operator WebSocket upgrades on exec and log routes do not verify the bearer JWT (CVE-2026-113620). This allows attackers to use self-minted tokens to bypass authorization and gain elevated privileges.
DrayTek Vigor2960 firmware (1.5.1.6 Revision 8218) has multiple critical vulnerabilities. CVE-2026-113391 in the uploadlangs function of /cgi-bin/mainfunction.cgi allows command injection. CVE-2026-113390 in the sub_182B0 function and CVE-2026-113389 in the set_table function of the same file are also susceptible to manipulation, leading to command execution and unauthorized access.
Red Hat's Kubernetes, when using Console custom resources, has a critical vulnerability (CVE-2026-105312). A tenant with create permissions can specify an arbitrary container image, which the operator deploys into a pod with a ServiceAccount bound via ClusterRoleBinding, potentially leading to privilege escalation and system compromise.
Letta versions up to 0.16.8 contain a critical security misconfiguration (CVE-2026-77936). The default compose.yaml does not enable secure server settings, leaving API routes unauthenticated and exposing a superuser PostgreSQL port with default credentials, allowing remote attackers to gain unauthorized access.