VulncastBriefing archive

Weekly Brief - 2026-11-02

· 3485 vulnerabilities · 11 min listen

▶ Listen to this briefing

CVE-2026-65145

critical · CVSS 10 · NVIDIA NeMo Agent Toolkit

NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

  • Authentication Bypass
  • Remote Code Execution
  • software library
  • ai framework

CVE-2026-82119

critical · CVSS 9.8 · Hitachi HiRDB

OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.

  • Os Command Injection
  • database server

CVE-2026-110186

critical · CVSS 9.8 · IBM Langflow OSS

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

  • Remote Code Execution
  • web application
  • python
  • automation tools

CVE-2026-90868

critical · CVSS 9.9 · Progress Software WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

  • Command Injection
  • file transfer protocol
  • server software

CVE-2026-76031

high · CVSS 8.8 · Google Chrome

Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  • Use After Free
  • Remote Code Execution
  • web browser

CVE-2026-91913

high · CVSS 8.8 · Dell OpenManage Enterprise

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

  • OS Command Injection
  • web application

CVE-2026-118147

high · CVSS 7.4 · Microsoft Visual Studio

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

  • Spoofing
  • integrated development environment

CVE-2026-118636

critical · CVSS 9.8 · Apache Software Foundation MINA

**UNSUPPORTED WHEN ASSIGNED**  JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.

  • Remote Code Execution
  • java
  • library

CVE-2026-120201

critical · CVSS 9.8 · Jpom

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

  • Authentication Bypass
  • Remote Code Execution
  • web application
  • java

CVE-2026-120209

critical · CVSS 9.8 · AJ-Report

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

  • Remote Code Execution
  • Broken Access Control
  • Authentication Bypass
  • web application
  • java