November 2026

Rules and advisories published in November 2026.

Rules

• CVE-2026-118066: LatePoint WordPress plugin account takeover (Sigma). Web-server log detection with ready-to-use queries for Splunk, Microsoft Sentinel and Elastic. Rule card
• CVE-2026-123966: Tenda AC19 router heap overflow (Suricata). Network detection of the oversized deviceId parameter. Rule card
• CVE-2026-71495: Wanderer trail app SSRF (Suricata). Detects download requests aimed at internal or cloud-metadata addresses. Rule card
• CVE-2026-123957 and CVE-2026-123958: TOTOLINK CA300-PoE buffer overflows (Suricata). Oversized ipStart, DNS and language settings. Rule card, rule card
• CVE-2026-124057 and CVE-2026-124058: TOTOLINK CA300-PoE Wi-Fi key overflows (Suricata). Oversized Key1Str1 and ApCliKeyStr values. Rule card, rule card

Advisories

• CVE-2026-19868: SonicWall SSL-VPN SAML/MFA bypass (actively exploited, CISA KEV). Advisory
• CVE-2026-122041: Checkout Field Editor for WooCommerce (Pro) arbitrary media deletion. Advisory
• CVE-2026-123614: imgproxy heap overflow from a malformed ICO image. Advisory

The full, current list is in the README index.

All rules are licensed under the Detection Rule License 1.1. Status: experimental (validated against test samples; lab testing pending).