Daily summary
Vulnerabilities of 2 November 2026: 81 new, 8 critical
81 vulnerabilities added on 2 November 2026, 8 critical and 41 high: Remote code execution in servers and applications, PHP object injection in WordPress plugins, Remote code execution in WordPress plugins and more.
- 8 critical
- 41 high
- 12 medium
- 4 low
- 16 unrated
Remote code execution in servers and applications
3 vulnerabilities
- 9.8MLflowMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
- 8.7Craft CMSLow privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
- 8.7Craft CMSControl panel only API response emulation replaces "securityKey" and reaches server RCE
PHP object injection in WordPress plugins
1 vulnerability
Remote code execution in WordPress plugins
1 vulnerability
Control Web Panel
10 vulnerabilities · Servers and applications · most fixed in 1.16
- 9.3Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
- 9.3Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
- 9.3Control Web Panel (CWP) < 1.16 Path Traversal LFI via module Parameter
- 8.7Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
- 8.6Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token
Show 5 more
- 8.6Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
- 8.6Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API
- 8.6Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access
- 8.5Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API
- 6.9Control Web Panel (CWP) < 1.30 Blind SQL Injection via user Parameter
Rancher
4 vulnerabilities · Servers and applications · most fixed in 2.11.19, 2.12.15, 2.15.3
- 9.1Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy
- 9.1Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller
- 7.6Rancher meta proxy allowlist bypass leading to server-side request forgery
- 7.2Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules
Microsoft SQL Server
15 vulnerabilities · Servers and applications · most fixed in 16.0.1210.3, 16.0.4305.5, 17.0.1145.4
- 8.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- 8.8Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
- 8.5Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- 8.5Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- 8.5Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
Show 10 more
- 8.0Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
- 7.5Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
- 7.0Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.
- 7.0Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
- 7.0Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
- 7.0Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
- 6.7Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
- 6.7Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
- 6.6Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- 6.4Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
Broken access control in servers and applications
2 vulnerabilities
Denial of service in servers and applications
2 vulnerabilities
- 8.7Expatlibexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity…
- 5.3RoundcubeRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss…
Memory corruption in servers and applications
2 vulnerabilities
Linux kernel
26 vulnerabilities · Servers and applications · most fixed in 6.12.115, 6.18.60, 7.2.14
- 7.8Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
- 7.8tracing: Hold trace_types_lock when resetting last boot data from readers
- 7.8tracing: Hold trace_types_lock when updating modules in persistent instances
- 7.8tracing: Save the event file instead of the compatible histogram
- 7.8tracing: Reject incomplete event filter expressions
Show 21 more
- 7.8tracing/histograms: Verify event_call identity when updating synth_event refcount
- 7.8io_uring/waitid: own the request before clearing ->head
- 7.8io_uring/waitid: prevent cancel reference wrap
- 7.0keys: Protect the type name while describing a key
- 7.0coredump: hold RCU while releasing parked threads
- –ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
- –ntfs: fix race between fallocate and mmap reads
- –mm/damon/core: error damos_commit_quota_goal() for zero target_value
- –tracing: Unregister field variable histograms when the command fails
- –tracing/syscalls: Use copy_from_user for the faultable syscall buffer
- –io_uring/wait: don't spin on a stuck overflow list
- –io_uring/cmd: don't leave list poison in ->hash_node
- –io_uring/io-wq: don't lose the signal that ends work
- –keys: Avoid the owner account dereference in named keyring lookup
- –keys: Check the authorization payload in process keyring searches
- –keys: make keyring indexes independent of kernel addresses
- –keys/trusted_keys: return immediately after TPM unseal failure
- –keys: Protect the read method check against type removal
- –ftrace: Initialize modname and offset in print_rec()
- –asymmetric_keys: reject trust keys without IDs
- –fork: release the files of a failed fork after sched_cancel_fork()
Other vulnerabilities in servers and applications
13 vulnerabilities
- 8.8cPanel & WHMImproper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.
- 8.8MLflowMLflow 3.17.1 and prior Path Traversal via Trace ID API
- 8.7cPanel & WHMImproper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
- 8.3phpBBImproper sanitization in the registration module allows reflected Cross-Site Scripting.
- 7.5GiteaGitea SSH certificate principal impersonation of other users
Show 8 more
- 6.9AVideoWWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
- 6.3NuxtNuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam
- 5.3n8nn8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
- 5.3n8nn8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data
- 3.8MattermostTeam admin can escalate a team member's permissions via the team member roles endpoint
- 3.7RoundcubeRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image…
- 3.5MattermostImproper post type validation on scheduled post endpoints
- 2.3Parse ServerParse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
Other vulnerabilities in WordPress plugins
2 vulnerabilities
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.