What you need to know today.
Critical vulnerabilities disclosed today affect Tenda routers, Microsoft Entra, WordPress plugins, Wavlink devices, IBM API Connect, and Totolink routers, with many allowing remote code execution.
A critical heap-based buffer overflow vulnerability in Tenda AC19 routers (model 16.03.10.07) could allow unauthenticated attackers to execute arbitrary code by manipulating the deviceId argument in the /goform/saveParentControlInfo file. This flaw, identified as CVE-2026-123966, poses a significant risk to users of this specific router model.
Microsoft Entra Device Registration is affected by an authorization bypass vulnerability (CVE-2026-109469) that allows unauthorized network access to elevate privileges. This could enable attackers to gain higher levels of control within a compromised environment.
The WP Libre Form WordPress plugin (version 1.5.0.1) suffers from a critical file upload vulnerability (CVE-2026-118423). Unauthenticated attackers can upload and execute PHP files, leading to remote code execution on the affected WordPress sites.
Several Wavlink devices are impacted by critical vulnerabilities. The WAVLINK WN536AX6-A (V260507) has a stack-based buffer overflow in its OpenVPN Handler (/protocol.csp, CVE-2026-120281) and a vulnerability in its WireGuard CLI (/bin/ioos, CVE-2026-120277). Additionally, the WAVLINK WN701AE (260105) has an OS command injection flaw in its ioos Web Backend component (CVE-2026-120230), allowing remote command execution.
Multiple critical vulnerabilities have been disclosed in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. These include OS command injection (CVE-2026-17408, CVE-2026-17402, CVE-2026-17359, CVE-2026-17342), insufficient validation of uploaded content (CVE-2026-17399), LDAP injection leading to unauthorized administrative access (CVE-2026-17392), use of hard-coded credentials for administrative control (CVE-2026-17360), arbitrary file writes via path traversal (CVE-2026-17354), and path traversal leading to remote code execution (CVE-2026-17340). These flaws collectively present a severe risk to the security of API Connect deployments.
Totolink CA300-PoE devices (version 6.2c.884) are affected by several critical buffer overflow vulnerabilities. These flaws exist in the cgi-bin/cstecgi.cgi script, impacting functions such as setWiFiBasicConfig (CVE-2026-123961), setWanConfig (CVE-2026-123960), setLanConfig (CVE-2026-123958), and setIpQosRules (CVE-2026-123957), all of which can be exploited remotely.