UpHeron
All posts

Critical vulnerabilities

29 critical vulnerabilities in 17 servers and applications and the Printcart Integration WordPress plugin

29 vulnerabilities rated critical (CVSS 9.0 or higher) found on 3 November 2026: Magento / Adobe Commerce (5), Remote code execution in servers and applications, Argo CD (4) and more.

  • 29 critical

Magento / Adobe Commerce

5 vulnerabilities · Servers and applications

  1. 10.0Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sepCVE-2026-103849
  2. 9.8Adobe Commerce | Incorrect Authorization (CWE-863)Up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sepCVE-2026-92909
  3. 9.3Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sepCVE-2026-91013
  4. 9.3Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sepCVE-2026-100133
  5. 9.1Adobe Commerce | Improper Input Validation (CWE-20)Up to 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sepCVE-2026-92464

Remote code execution in servers and applications

5 vulnerabilities

  1. 9.9MauticRemote Code Execution in Campaign ImportFixed in 7.2.2CVE-2026-115188
  2. 9.9Frappe FrameworkRemote code execution via path traversalFixed in 15.121.0, 16.34.0GHSA-9pp9-wgp9-3p3j
  3. 9.9Adobe Experience ManagerAdobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)Up to 6.5.25CVE-2026-103848
  4. 9.8GiteaGitea Org-mode file disclosure and code executionFixed in 1.27.1CVE-2026-59774
  5. 9.1Dolibarr ERP CRMRemote Code Execution through incomplete sandbox in dol_eval_standard() (computed extrafields)Fixed in 23.0.3GHSA-5cfw-655w-vqp8

Argo CD

4 vulnerabilities · Servers and applications

  1. 9.9AppProject restrictions bypassed by PreDelete/PostDelete resource hooksFixed in 3.5.4, 3.6.0-rc2CVE-2026-77459
  2. 9.9A Jsonnet import can read files from the repo-serverFixed in 2.0.0CVE-2026-113672
  3. 9.9A Kustomize Helm config home can run commands in the repo-serverCVE-2026-113709
  4. 9.9A Kustomize remote ref can run commands in the repo-serverCVE-2026-113708

Remote code execution in WordPress plugins

1 vulnerability

  1. 9.8Printcart IntegrationUnauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_urlUp to 2.9.1CVE-2026-93388

SQL injection in servers and applications

2 vulnerabilities

  1. 9.4YesWikiUnauthenticated SQL injection through attacker-controlled Bazar field names in public entry-listing APIsFixed in 4.7.0GHSA-hgxv-w4r8-8877
  2. 9.1YesWikiUnauthenticated SQL injection in YesWiki Bazar entries search API via unescaped backtick in query field nameFixed in 4.7.0, 5.0.0-alpha4GHSA-ccp2-6q93-hggh

Broken access control in servers and applications

1 vulnerability

  1. 9.4PortainerNon-admin bind-mount restriction bypass via Docker local-driver volumes and automatic Git redeploy (incomplete fix of CVE-2026-44849 and CVE-2026-44850)Fixed in 2.45.2GHSA-jmr9-98g4-2phv

Path traversal in servers and applications

1 vulnerability

  1. 9.3Adobe ColdFusionColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Up to 2025.0.13CVE-2026-90530

Authentication bypass in servers and applications

1 vulnerability

  1. 9.2LaravelToken-based API guard Auth BypassFixed in 12.68.0, 13.29.0CVE-2026-114509

Memory corruption in servers and applications

1 vulnerability

  1. 9.2EnvoyOut-of-Bounds Write in Brotli DecompressorUp to 1.39.2GHSA-3wvj-j6qm-62mr

Other vulnerabilities in servers and applications

8 vulnerabilities

  1. 10.0LiteLLMUnauthenticated file read leaks master key on Enterprise proxyFixed in 1.105.6, 1.106.5GHSA-w4c7-34wj-hqm8
  2. 9.4PortainerNon-administrator inherits host bind mounts via Compose volumes_from in stack deploymentFixed in 2.45.3GHSA-j3mf-q9qf-5qf8
  3. 9.4PortainerArbitrary host file read by standard user via Compose configs/secretsFixed in 2.45.2GHSA-9gxj-xvxm-77rj
  4. 9.3Linux kernelipv4: validate checksum_start before completing checksumFixed in 6.18.57, 7.2.11CVE-2026-99999
  5. 9.3Microsoft Exchange ServerMicrosoft Exchange Server SpoofingFixed in 15.02.1748.055, 15.02.2562.056CVE-2026-70279
Show 3 more
  1. CriticalGravAnonymous visitors can read any server file through a public form uploadFixed in 1.7.53.7, 2.2.18GHSA-m2mr-hhjj-p3v2
  2. CriticalMastodonInsufficient ActivityPub identifier verificationFixed in 4.7.4, 5.0.0-alpha.2GHSA-288h-6j8h-6x5j
  3. CriticalFrappe FrameworkPossibility of Server Side Template InjectionFixed in 15.111.0, 16.21.0CVE-2026-119144

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.