Daily CVE highlight, 2 November 2026: 3 new critical CVEs worth reading

The bottom line

All three entries score 10 and are exploitable from the network with no recorded authentication barrier. Two are network routers for which no vendor patch exists; one is a Python sandbox library with a fix. The question is whether any of these products run in your environment.

206 CVE records were published in the last 30 hours. 36 scored 8.5 or higher. 3 are below, chosen by a fixed rule: highest score first, then fewest conditions in the wording, one product each. None is on CISA's exploited list, so a score here is the record's author describing the worst case. Read the condition before you act on the number.

Free analysis report · 6 pagesDaily CVE highlight, 2 November 2026: 3 new critical CVEs worth readingThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

WAVLINK WN536AX6-A, CVE-2026-120276

No patch is recorded. Any WAVLINK WN536AX6-A on firmware V260507_2.0.0 should have the web management interface removed from untrusted networks immediately as the first step.

Score 10 (CVSS 4.0), published by VulDB on 1 November 2026. Weakness: CWE-78, CWE-77.

A word search of the record found none of the usual conditions (privileges, a logged-in user, a non-default setting, local network, physical access, a click). That is a search, not a reading, so read the record yourself before you rule it out.

• Our full note on CVE-2026-120276 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

Linksys E8450, CVE-2026-120283

No patch is recorded and the vendor did not respond to disclosure. Any Linksys E8450 on firmware 1.2.00.360516 should have the management interface blocked from external access immediately.

Score 10 (CVSS 4.0), published by VulDB on 2 November 2026. Weakness: CWE-121, CWE-119.

A stack-based buffer overflow in the Linksys E8450 portal.cgi handler lets a remote attacker potentially run code by sending a crafted hidden_timezone value. The vendor did not respond to disclosure. The limiting condition is network access to the endpoint.

• Our full note on CVE-2026-120283 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

PrefectHQ prefab-ui, CVE-2026-120338

Upgrade to prefab-ui 0.21.0 or later; the record names this as the first unaffected version. Relevant only if this library is in use with the GenerativeUI sandbox reachable.

Score 10 (CVSS 3.1), published by JFROG on 1 November 2026. Weakness: CWE-693, CWE-94, CWE-269.

Caller-supplied Python in the prefab-ui GenerativeUI sandbox can read and write files as the server OS user and persist via the virtualenv. The record gives FastMCP's GenerativeUI as the usual path. The limiting condition is that endpoint being reachable.

• Our full note on CVE-2026-120338 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

Fifteen minutes this morning

• List the products above you run. If none, you are done.
• For each one you run, read the version from the product and compare it to the fixed version in the table.
• If it is in range, follow the note: reduce exposure first, then update.
• Book the update, and write down who owns it and by when.

What we do not know yet

• These are new records. A record can change in the first days: scores, versions and wording are as at 2 November 2026. Nothing here has been tested.
• Exploitation is not recorded for any of them. That is not the same as none.
• The bottom line and the sentence under each product are our interpretation of the records and the vendors' pages, not a statement by the vendors.

• Today's mission →The vulnerabilities CISA says are already being exploited, in deadline order.
• The day's threat watch →What to do today, in order.