IT security 2026-11-01

Level Tense — 72/100 — 2026-11-01

Tense day: 29 stories ranked, 2 of the top 10 reported as actively exploited, 1 flaw newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Active exploitation reported for Ivanti Connect Secure privilege escalation flaw (71/100).

1. Active exploitation reported for Ivanti Connect Secure privilege escalation flaw — 71/100 (CVE-2026-111357)
2. Northflank breach leads to unauthorized use of customers' AI API keys — 70/100
3. Public Android SMS exploit can crash unpatched phones or disrupt cellular service — 65/100 (CVE-2026-58882)
4. Malicious ChatGPT Link Allows Attacker Code Execution — 60/100
5. VOLTA infostealer uses LLMs for victim prioritization — 55/100
6. Jpom Authentication Bypass and Command Execution — 50/100 (CVE-2026-120201)
7. Unauthenticated RCE in AJ-Report via hard-coded JWT secret — 50/100 (CVE-2026-120209)
8. Public exploit disclosed for WAVLINK initial setup command injection — 48/100 (CVE-2026-120195)
9. Public exploit disclosed for D-Link DIR-505 TFTP stack buffer overflow — 46/100 (CVE-2026-120189)
10. Chainalysis confirms intrusion into internal tools and exposure of customer identity data — 46/100