Critical vulnerabilities
2 critical vulnerabilities in Sonatype Nexus Repository and the WPO365 LOGIN WordPress plugin
2 vulnerabilities rated critical (CVSS 9.0 or higher) found on 4 November 2026: Broken access control in WordPress plugins.
- 2 critical
Broken access control in WPO365 LOGIN · WordPress plugins
CVE-2026-122220
WPO365 LOGIN before 45.2 SAML Replay Protection Bypass
- Severity
- Critical 9.1
- Published
- 4 Nov 2026
- Fixed in
- 45.2
| Software | Affected versions |
|---|---|
| Wpo365 Login (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-122220
Sonatype Nexus Repository · Servers and applications
CVE-2026-113373
Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
- Severity
- Critical 9.1
- Published
- 4 Nov 2026
- Fixed in
- 3.98.0
| Software | Affected versions |
|---|---|
| Sonatype Nexus RepositoryServers and applications |
|
| Sonatype Nexus RepositoryServers and applications |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-113373
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.