Daily briefing · November 1, 2026
Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI Sandboxes
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
The verdict for November 1 is CALM: no vulnerability reached weaponized-exploit status, none is under active exploitation (KEV), and none was seen by VulnCheck ahead of CISA. Even so, 28 of the 163 new CVEs were critical, and the top of the list is dominated by remotely exploitable command injection and buffer overflow bugs in network devices, mostly WAVLINK routers, with public proofs of concept. This calls for monitoring and prompt exposure review rather than emergency response.
Today’s brief
- Calm day: 0 weaponized exploits, 0 in active exploitation, 0 seen by VulnCheck before CISA.
- 163 new CVEs, 28 of them critical; the top 10 all have CVSS 9.9 or 10.0.
- Seven WAVLINK flaws and one Linksys flaw allow remote command injection or buffer overflow on edge devices; most have public PoCs.
- Prefab UI and Beta9 expose sandbox and isolation failures in AI and multi-tenant environments.
Critical highlights
1
Command injection in the WAVLINK WL-WN530BE1-A /protocol.csp endpoint, remotely reachable and with a public PoC. A router compromised this way gives an attacker a foothold at the network perimeter.
2
OS command injection via the wlan_ssid argument in the WL-WN579A3-A setup wizard, remotely exploitable and with a public PoC. Devices with exposed management interfaces are the most at risk.
3
Stack-based buffer overflow in the Linksys E8450 portal.cgi via the hidden_timezone argument, remotely exploitable. The vendor did not respond to disclosure, so a patch may be slow to arrive and mitigation depends on limiting exposure.
4
Stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A, with a public PoC. It can lead to a remote crash or code execution on a device that often serves as a VPN gateway.
5
OS command injection in the WireGuard handler of the WN536AX6-A, remotely exploitable with a public PoC. It adds to a cluster of flaws in the same product and endpoint.
6
Command injection through the file_id argument in the openvpn_cli handler of the WN536AX6-A, with a public PoC. The repeated pattern suggests weak input validation across the firmware.
7
Command injection in the WireGuard CLI group handler (/bin/ioos) of the WN536AX6-A, remotely exploitable with a public PoC. It reinforces the case for restricting management access to the device.
8
Command injection in the web management interface of the WN536AX6-A via the group_name argument, with a public PoC. Any exposed administration panel is a potential entry point.
9
The Prefab UI Generative UI sandbox (versions 0.14.0 to 0.20.2) starts Deno with unrestricted read, write and network permissions, which undermines its isolation for untrusted or LLM-generated code. Anyone running this feature should treat the sandbox as ineffective.
10
In Beta9, a tenant can manipulate the volume identifier to escape the workspace path and reach the worker's filesystem, because ownership is never validated. In multi-tenant environments this threatens isolation between customers.
Ransomware today
Punta Shopping (Retail & E-Commerce, Brazil) was recently listed as a victim by the emperador group. Over the past 30 days the most active groups were N0n (6 victims, all in Brazil), followed by thegentlemen, emperador and qilin (4 each, all in Brazil), and akira and Eclipse (2 each, all in Brazil).
Punta Shopping BRemperador · Retail & E-Commerce
N0n 6thegentlemen 4emperador 4qilin 4akira 2Eclipse 2
Active groups & APTs
Several ransomware groups with a Brazilian focus remain active in leak sites: lockbit5 (54 Brazilian victims), lockbit3 (39), thegentlemen (39), ransomhub, of Russian origin (35), Akira (24) and arcusmedia (23). The volume shows that Brazil is a persistent target for these operations.
Brazil focus
Recent Brazilian victims span several sectors: Punta Shopping and Animart Pet Stores (retail), bio3g.com (healthcare), P&B Textiles, GTL Concreto e Logística and Prafesta (manufacturing), Universidade de Passo Fundo (education) and Suhai Segurança Pessoal (professional services). The groups involved are emperador, qilin, thegentlemen and N0n, with qilin and emperador each linked to multiple cases.
Punta Shoppingemperador · Retail & E-Commerce
bio3g.comqilin · Healthcare
Animart Pet Storesqilin · Retail & E-Commerce
P&B Textilesqilin · Manufacturing
GTL Concreto e Logística LTDAemperador · Manufacturing
Universidade de Passo Fundothegentlemen · Education
Prafesta Ind. e Com. de Embalagens LtdaN0n · Manufacturing
Suhai Segurana Pessoalthegentlemen · Professional Services
Today’s recommendation: Identify WAVLINK and Linksys devices in your environment, remove their management interfaces from the internet and apply vendor updates as soon as they exist. Review the permissions of AI sandboxes (Prefab UI) and the volume isolation of multi-tenant platforms (Beta9).
Even on a calm day, flaws like these show how quickly an exposed device or misconfigured environment becomes an entry point, so regularly validating your own attack surface is the way to know whether this affects you.Don’t wait to become a statistic: validate today, at no cost, whether any of these vectors reach your systems.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →