UpHeron
All posts

Critical vulnerabilities

17 critical vulnerabilities in 9 servers and applications

17 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: Apache Traffic Server (7), Remote code execution in servers and applications, Privilege escalation in servers and applications and more.

  • 17 critical

Apache Traffic Server

7 vulnerabilities · Servers and applications

  1. 10.0Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentialsUp to 10.2.0CVE-2026-111812
  2. 10.0Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcementUp to 10.2.0CVE-2026-111815
  3. 10.0Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the originUp to 10.2.0CVE-2026-111814
  4. 10.0Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationUp to 10.2.0CVE-2026-111813
  5. 9.3Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smugglingUp to 10.2.0CVE-2026-111809
Show 2 more
  1. 9.3Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-outUp to 10.2.0CVE-2026-111816
  2. 9.0Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authenticationUp to 10.2.0CVE-2026-111811

Remote code execution in servers and applications

2 vulnerabilities

  1. 9.4aaPanelaaPanel File Manager common.py ExecShell os command injectionUp to 8.25.0CVE-2026-113506
  2. 9.3Apache CouchDBApache CouchDB: Admin credentials leading to code execution as operating system userFixed in 3.5.3CVE-2026-86471

Privilege escalation in servers and applications

1 vulnerability

  1. 9.4FroxlorFroxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic CronFixed in 2.3.15CVE-2026-113678

Broken access control in servers and applications

1 vulnerability

  1. 9.3Craft CMSCraft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via MutationsFixed in 5.11.0CVE-2026-112776

Authentication bypass in servers and applications

1 vulnerability

  1. 9.1MikroTik RouterOSMikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication BypassUp to 7.24.5CVE-2026-89035

Other vulnerabilities in servers and applications

5 vulnerabilities

  1. 9.8Oracle WebLogic ServerVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0,…Up to 15.1.1.0.0CVE-2026-91323
  2. 9.8Oracle WebLogic ServerVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0,…Up to 15.1.1.0.0CVE-2026-83399
  3. 9.8Xenx86/AMD: ineffectual Zenbleed workaroundCVE-2026-79608
  4. 9.3GravPage editor can call arbitrary static methods through a renamed field in a Flex formFixed in 2.2.2CVE-2026-112780
  5. 9.1Oracle WebLogic ServerVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0,…Up to 15.1.1.0.0CVE-2026-87302

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.