Daily summary
Vulnerabilities of 4 November 2026: 100 new, 5 critical, 1 newly exploited
100 vulnerabilities added on 4 November 2026, 5 critical and 37 high: Ruby on Rails (21), Privilege escalation in WordPress plugins, Sonatype Nexus Repository (7) and more. 1 vulnerability newly listed as exploited by CISA.
- 5 critical
- 37 high
- 44 medium
- 10 low
- 4 unrated
- 1 newly exploited
Newly listed as exploited
Added to CISA's Known Exploited Vulnerabilities catalog: attackers use it.
Ruby on Rails
21 vulnerabilities · Servers and applications · most fixed in 8.0.5.2, 8.1.4.1
- 9.8Possible arbitrary file write and read in Active Storage image analysis
- 8.8Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
- 7.5Possible Strong Parameters bypass in Parameters#each_key in Action Pack
- 7.5Possible DoS vulnerability in Active Support safe_constantize
- 7.4Possible IP spoofing in Action Dispatch RemoteIp
Show 16 more
- 6.8Possible sensitive session information leak in Active Storage proxy mode
- 6.1Possible XSS vulnerability in Action View highlight helper
- 6.1Possible XSS vulnerability in Action View strip_tags
- 6.1Possible XSS vulnerability in Action View text helpers
- 5.9Possible DoS vulnerability in Action Controller Live streaming
- 5.3Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
- 5.3Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
- 4.8Possible cache poisoning in Action Pack content negotiation
- 4.7Possible XSS vulnerability in Action View tag helpers
- 4.7Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
- 4.7Possible XSS vulnerability in Active Support MessagePack serializer
- 4.3Possible DoS vulnerability in Active Storage filename handling
- 4.2Possible restoration of destroyed sessions in Action Dispatch CacheStore
- 3.7Possible signature replay in Action Mailbox Mailgun ingress
- 3.7Possible local file disclosure in Active Storage video previews and analysis
- 3.1Missing SameSite attribute on session cookies from Action Pack session stores
Privilege escalation in WordPress plugins
4 vulnerabilities
Sonatype Nexus Repository
7 vulnerabilities · Servers and applications · most fixed in 3.98.0
- 9.1Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
- 8.6Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation
- 7.7Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
- 7.1Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
- 7.1Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
Broken access control in WordPress plugins
6 vulnerabilities
Symfony
22 vulnerabilities · Servers and applications · most fixed in 6.4.50, 7.4.23, 8.1.11
- 8.7Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
- 7.7X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for…
- HighThe Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
- HighDataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
- HighFilesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory
Show 17 more
- 6.3Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass
- 6.3HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075
- 6.3Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
- 5.3HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761
- 5.3HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761
- MediumObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
- MediumThe "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
- MediumScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
- MediumInline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
- MediumIncomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters
- MediumGenerated URLs Can Point to a Host Chosen by the Client
- LowHtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066
- LowHtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
- LowXXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
- LowProgrammatic Logins Skip the checkPostAuth() Method of User Checkers
- LowNoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342
- LowPath Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name
MLflow
6 vulnerabilities · Servers and applications
- 8.2MLflow get-artifacts Server-Side Request Forgery Information Disclosure
- 7.8MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
- 7.8MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
- 6.3MLflow Tracking Server Missing Authorization Privilege Escalation
- 5.4MLflow Tracking Server Issues Missing Authorization Privilege Escalation
- 5.4MLflow Tracking Server Jobs Missing Authorization Information Disclosure
Cross-site scripting in WordPress plugins
11 vulnerabilities
Caddy
5 vulnerabilities · Servers and applications · most fixed in 2.11.8
- HighHost and :authority values with dot segments or slashes escape a {host}-based root
- 5.9php_fastcgi authorization bypass via dot-segments in the request path
- Mediumfile_server exposes private keys when the data directory falls back to ./caddy
- Mediumrewrite re-decodes {http.matchers.file.remainder}, bypassing path-based deny rules
- Mediumfile matcher resolves /file/./ to a regular file, bypassing suffix path rules
Apache ActiveMQ
5 vulnerabilities · Servers and applications · most fixed in 5.19.12, 6.3.3
- 6.5Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
- –Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
- –Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
- –Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
- –Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Servers and applications
8 vulnerabilities
- 8.2Parse ServerObject update with a dot notation key can terminate the server process when the class has a beforeSave trigger
- 7.1SPIPSPIP before 4.4.29 Authenticated SQL Injection via where Parameter
- 7.0TraefikTraefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
- 6.0Parse ServerParse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key
- 5.9GNU C LibraryBIG-HKSCS decoding hang on crafted input
Other vulnerabilities in WordPress plugins
5 vulnerabilities
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.