Daily CVE highlight, 4 November 2026: 3 new critical CVEs worth reading

The bottom line

All three records cover Qihoo 360 devices — two camera lines and a home router — each scoring 10, with no vendor patch and a working exploit already public. The question that sorts them: does your network include any Qihoo 360 cameras or the M5 router?

890 CVE records were published in the last 30 hours. 108 scored 8.5 or higher. 3 are below, chosen by a fixed rule: highest score first, then fewest conditions in the wording, one product each. None is on CISA's exploited list, so a score here is the record's author describing the worst case. Read the condition before you act on the number.

Free analysis report · 8 pagesDaily CVE highlight, 4 November 2026: 3 new critical CVEs worth readingThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Qihoo 360 D621-2, CVE-2026-121606

No fix exists; the analysis confirms firmware 6.4.9 remains vulnerable. Anyone running a D621-2, D603-2, D600-2, D619, D606-6, or D706 camera should isolate it from untrusted network segments now.

Score 10 (CVSS 4.0), published by VulDB on 4 November 2026. Weakness: CWE-347, CWE-345.

The firmware signature check on these cameras accepts an empty signature as valid. The record says a network-reachable attacker can push unsigned firmware and gain persistent code execution on the device. The record states no limiting condition beyond network access.

• Our full note on CVE-2026-121606 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

Qihoo 360 D603-2, CVE-2026-121607

No fix exists; the analysis confirms firmware 6.4.9 carries the same vulnerable code. Owners of D603-2, D600-2, D606-6, or D706 cameras should isolate the device from untrusted network segments now.

Score 10 (CVSS 4.0), published by VulDB on 4 November 2026. Weakness: CWE-78, CWE-77.

An unvalidated host field in the camera's speed-test handler lets an attacker inject shell commands. The record says the management process runs as root, giving the attacker full device control. The record states no limiting condition beyond network access.

• Our full note on CVE-2026-121607 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

Qihoo 360 Whole Home Router M5, CVE-2026-121609

No fixed version is stated in the sources. If any M5 on firmware 4.0.17.1566 has not completed initial setup, isolate it from the local network immediately; otherwise confirm that setup is complete.

Score 10 (CVSS 4.0), published by VulDB on 4 November 2026. Weakness: CWE-798, CWE-259.

The router's boot script sets the root password to a fixed value and opens telnet on port 23 if initial setup is not yet complete. The record says any device on the same local network can then log in as root. Exposure depends on whether initial setup has been completed.

• Our full note on CVE-2026-121609 →The vendor's advisory, who is exposed, what to do in order, a message to send your IT provider, and the analysis report.

Fifteen minutes this morning

• List the products above you run. If none, you are done.
• For each one you run, read the version from the product and compare it to the fixed version in the table.
• If it is in range, follow the note: reduce exposure first, then update.
• Book the update, and write down who owns it and by when.

Check your own project

If you build software, you can compare what a project declares with these CVEs from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE ids leave your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2026-121606,CVE-2026-121607,CVE-2026-121609

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Check the servers you run

The same ids can be checked against a host. Run this on the machine itself, not on the laptop that deploys to it: it reads installed packages (dpkg, rpm or apk), snaps, the names of running container images and the kernel version, compares them on the spot, and only the CVE ids leave the machine; the inventory stays on it, in ~/.lattice-scan. Naming the CVEs needs no key. Do it on each server after a deployment, and again when a new entry lands.

lattice-scan --cve CVE-2026-121606 --cve CVE-2026-121607 --cve CVE-2026-121609

A match is a candidate for a person to confirm, not a finding. A distribution can fix a CVE under an unchanged version number, so a match is a candidate; on Debian-family hosts the report also shows whether the package's own changelog names the CVE. It reads the names of the running images, not what is inside them; for what an image declares, use the project check on its Dockerfile.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

• Which way into Lattice fits your job →The command line, the Claude skill or the MCP server: what each needs, what works without a key and how to read the result.
• Lattice, the MCP server →The public graph the command reads, for AI agents over MCP.
• Install and connect →The signed apt repository, the fingerprint, and the connection commands for each client.

What we do not know yet

• These are new records. A record can change in the first days: scores, versions and wording are as at 4 November 2026. Nothing here has been tested.
• Exploitation is not recorded for any of them. That is not the same as none.
• The bottom line and the sentence under each product are our interpretation of the records and the vendors' pages, not a statement by the vendors.

• Today's mission →The vulnerabilities CISA says are already being exploited, in deadline order.
• The day's threat watch →What to do today, in order.