⚠️ Daily CVE Roundup November 1, 2026 Here are the notable CVEs disclosed or updated today: 🔴 Critical & High Severity CVE-2026-120197 (WAVLINK WL-WN530HG4B) CVSS 9.9 (Critical). An OS command injection vulnerability exists in the port_forward function of /cgi-bin/wapi.cgi within WAVLINK WL-WN530HG4B firmware version M_V260724. Manipulation of the Name argument allows remote attackers to execute arbitrary commands. The exploit has been publicly disclosed and may be actively used. The vendor was contacted regarding this disclosure. CVE-2026-118527 (Ivanti Connect Secure) Critical. A predictable numbers or identifiers vulnerability allows remote authenticated attackers to upload files with attacker-controlled content to a known location on disk. This flaw is part of an exploit chain documented by Volexity, alongside CVE-2026-111357 and CVE-2026-104935, which together enable unauthenticated root-level access. Threat actor UTA0576 has been observed exploiting this chain to target Active Directory credentials and BitLocker recovery keys. Fixed in Ivanti Connect Secure 25.1.1.3 and 22.8R2.6. The CISA KEV remediation deadline for federal agencies is November 13. 🟡 Medium & Notable CVE-2026-118341 (Chromium / Microsoft Edge) Critical severity. A use-after-free vulnerability in Chromium's Modularization component. Microsoft Edge (Chromium-based) ingests Chromium and addresses this flaw. Users should update Chrome and Edge to the latest versions. CVE-2026-97229 (GitLab CE/EE) CVSS 10.0 (Critical). An integer overflow or wraparound vulnerability allows unauthenticated remote code execution via crafted CI/CD regex configurations. Affected versions include GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The CISA KEV federal remediation deadline is November 1, 2026. 📢 Join our Telegram channel for daily CVE updates and cybersecurity news: https://t.me/bugbountyusa #CVE #CyberSecurity #VulnerabilityManagement #InfoSec #PatchManagement #ThreatIntelligence #SecurityAdvisory #BugBounty #DailyCVE #CyberNews