Daily CVE highlight, 1 November 2026: 3 new critical CVEs worth reading

The bottom line

These are remote flaws in small network devices, and the records say exploits are public. The two WAVLINK flaws are command injection; the D-Link flaw is a stack-based buffer overflow. The sorting question: do you run one of these exact models or firmware versions?

140 CVE records were published in the last 30 hours. 23 scored 8.5 or higher. 3 are below, chosen by a fixed rule: highest score first, then fewest conditions in the wording, one product each. None is on CISA's exploited list, so a score here is the record's author describing the worst case. Read the condition before you act on the number.

Free analysis report · 7 pagesDaily CVE highlight, 1 November 2026: 3 new critical CVEs worth readingThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

D-Link DIR-505, CVE-2026-120189

Act only if you run a DIR-505 on 1.10B02: cut outside access to it this week. No source we have names a fixed version, so ask D-Link what is available.

Score 10 (CVSS 4.0), published by VulDB on 1 November 2026. Weakness: CWE-121, CWE-119.

The record says the TFTP upload filename handler in D-Link DIR-505 1.10B02 has a stack-based buffer overflow that can be reached remotely. The record states no limiting condition.

• Our full note on CVE-2026-120189 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

WAVLINK WL-WN579A3-A, CVE-2026-120195

Act only if you run a WL-WN579A3-A: this week, check whether its admin pages can be reached from outside and close that. No fixed firmware is named, so ask your supplier.

Score 10 (CVSS 4.0), published by VulDB on 1 November 2026. Weakness: CWE-78, CWE-77.

The record says the wlan_ssid value in the setup wizard lets an attacker run operating system commands on a WAVLINK WL-WN579A3-A, remotely. The record states no limiting condition.

• Our full note on CVE-2026-120195 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

WAVLINK WL-WN530BE1-A, CVE-2026-120198

Act only if you run a WL-WN530BE1-A on V251117: this week, cut outside access to its web interface. No fixed firmware is named in our sources, so ask your supplier.

Score 10 (CVSS 4.0), published by VulDB on 1 November 2026. Weakness: CWE-77, CWE-74.

The record says the group_name or IP-FROM argument lets an attacker run commands on a WAVLINK WL-WN530BE1-A on V251117, remotely. The record states no limiting condition.

• Our full note on CVE-2026-120198 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

Fifteen minutes this morning

• List the products above you run. If none, you are done.
• For each one you run, read the version from the product and compare it to the fixed version in the table.
• If it is in range, follow the note: reduce exposure first, then update.
• Book the update, and write down who owns it and by when.

What we do not know yet

• These are new records. A record can change in the first days: scores, versions and wording are as at 1 November 2026. Nothing here has been tested.
• Exploitation is not recorded for any of them. That is not the same as none.
• The bottom line and the sentence under each product are our interpretation of the records and the vendors' pages, not a statement by the vendors.

• Today's mission →The vulnerabilities CISA says are already being exploited, in deadline order.
• The day's threat watch →What to do today, in order.