UpHeron
All posts

Critical vulnerabilities

15 critical vulnerabilities in 9 WordPress plugins and 5 servers and applications

15 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: Arbitrary file upload in WordPress plugins, Memory corruption in servers and applications, PHP object injection in WordPress plugins and more.

  • 15 critical

Arbitrary file upload in WordPress plugins

1 vulnerability

  1. 10.0ZombifyUp to 1.7.7CVE-2026-94503

Memory corruption in servers and applications

1 vulnerability

  1. 9.8Linux kernelRDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB accessFixed in 6.18.54, 7.2.8CVE-2026-98365

PHP object injection in WordPress plugins

1 vulnerability

  1. 9.8The Events CalendarUp to 6.17.4CVE-2026-95606

Remote code execution in servers and applications

3 vulnerabilities

  1. 9.5NetScaler ADC and GatewayMemory overflow vulnerability leading to Remote Code Execution or Denial of ServiceFixed in 14.1-73.46, 14.1-73.46 FIPSCVE-2026-107406
  2. 9.4Movable TypeA code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script…Up to 9.2.1CVE-2026-96408
  3. 9.4Veeam Backup & ReplicationThis vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.Fixed in 12.3.2.4934CVE-2025-64393

SQL injection in WordPress plugins

7 vulnerabilities

  1. 9.3TravelerUp to 3.2.9CVE-2026-93947
  2. 9.3EduAdmin BookingFixed in 6.0.0CVE-2026-96809
  3. 9.3Ajax Search ProUp to 4.29.1CVE-2026-96331
  4. 9.3JNews - Pay WriterUp to 12.0.1CVE-2026-96328
  5. 9.3tagDiv Opt-In BuilderUp to 1.7.6CVE-2026-96330
Show 2 more
  1. 9.3WPLMSFixed in 1.9.9.8.2CVE-2026-96327
  2. 9.3WP Data AccessUp to 5.5.82CVE-2026-95605

Cross-site scripting in servers and applications

1 vulnerability

  1. 9.3ContaoContao: Cross-site scripting in the comments bundleFixed in 5.3.50, 5.7.12CVE-2026-107845

Other vulnerabilities in servers and applications

1 vulnerability

  1. 9.8Linux kernelRDMA/siw: Bound fragmented header copies by the remaining lengthFixed in 6.18.54, 7.2.8CVE-2026-98323

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.