UpHeron
All posts

Daily summary

Vulnerabilities of 6 November 2026: 73 new, 5 critical, 1 newly exploited

73 vulnerabilities added on 6 November 2026, 5 critical and 29 high: Privilege escalation in WordPress plugins, PHP object injection in WordPress plugins, Craft CMS (4) and more. 1 vulnerability newly listed as exploited by CISA.

  • 5 critical
  • 29 high
  • 33 medium
  • 3 low
  • 3 unrated
  • 1 newly exploited

Newly listed as exploited

Added to CISA's Known Exploited Vulnerabilities catalog: attackers use it.

  1. 7.5SonicWall SonicOSAn authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass…ExploitedUp to 8.2.2-8015 and older versionsCVE-2026-19868

Privilege escalation in WordPress plugins

4 vulnerabilities

  1. 9.8BuddyFormsUnauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' ParameterUp to 2.10.5CVE-2026-107622
  2. 9.8OAuth Single Sign On – SSO (OAuth Client)Up to 7.1.3CVE-2026-120844
  3. 8.8Advanced Members for ACFAuthenticated (Subscriber+) Privilege Escalation via Account Change-Password FormUp to 1.3.0CVE-2026-116624
  4. 7.6Pubjet | پاب‌جتAuthenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX ActionUp to 5.4.8CVE-2026-103479

PHP object injection in WordPress plugins

1 vulnerability

  1. 9.8Radius BookingUp to 1.0.20CVE-2026-119516

Craft CMS

4 vulnerabilities · Servers and applications · most fixed in 4.18.9, 5.11.2

  1. 9.3Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search EndpointFixed in 4.18.9, 5.11.2CVE-2026-123488
  2. 8.8Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load SelectFixed in 4.18.9, 5.11.2CVE-2026-123491
  3. 8.7Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox BypassFixed in 5.11.2CVE-2026-123490
  4. 7.1Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev CriteriaFixed in 4.18.9, 5.11.2CVE-2026-123489

Arbitrary file access in WordPress plugins

1 vulnerability

  1. 9.1ELEX WordPress HelpDesk & Customer Ticketing SystemUnauthenticated Arbitrary File Deletion via 'ticket_attachment_path' ParameterUp to 3.3.8CVE-2026-114630

SonicWall SonicOS

6 vulnerabilities · Servers and applications

  1. 8.8A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote…Up to 8.2.2-8015 and older versionsCVE-2026-107154
  2. 8.8A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable…Up to 8.2.2-8015 and older versionsCVE-2026-107155
  3. 7.5A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote…Up to 8.2.2-8015 and older versionsCVE-2026-82308
  4. 5.9A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions…Up to 8.2.2-8015 and older versionsCVE-2026-77709
  5. 5.9A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions…Up to 8.2.2-8015 and older versionsCVE-2026-77708
  6. 5.1A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker…Up to 8.2.2-8015 and older versionsCVE-2026-19703

Symfony

7 vulnerabilities · Servers and applications · most fixed in 5.4.56, 6.4.50, 7.4.23

  1. 8.7Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a ProcessFixed in 7.4.23, 8.1.11CVE-2026-123792
  2. 8.2ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path ReferencesFixed in 7.4.23, 8.1.11CVE-2026-121971
  3. 8.2DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server FileFixed in 7.4.23, 8.1.11CVE-2026-121623
  4. 6.9ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested ObjectsFixed in 7.4.23, 8.1.11CVE-2026-122053
  5. 2.3XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = trueFixed in 7.4.23, 8.1.11CVE-2026-123824
Show 2 more
  1. 2.3Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main RequestFixed in 7.4.23, 8.1.11CVE-2026-123339
  2. 2.3Programmatic Logins Skip the checkPostAuth() Method of User CheckersFixed in 7.4.23, 8.1.11CVE-2026-123746

Broken access control in servers and applications

3 vulnerabilities

  1. 8.5GrafanaDashboard snapshot permission bypassFixed in 12.4.4CVE-2026-33379
  2. HighFrappe FrameworkIDOR via an SMS Settings' APIFixed in 16.30.0GHSA-r8gf-89pc-pmv3
  3. MediumOpenProjectCross-project authorization bypass allows TimeEntries to expose unauthorized Meeting detailsFixed in 17.9.5GHSA-37p6-x463-m62x

Remote code execution in WordPress plugins

3 vulnerabilities

  1. 7.5WPSyncSheets For Contact Form 7Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()Up to 1.8.0CVE-2026-104010
  2. 7.2Product Feed Manager for WooCommerceAuthenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' ParameterUp to 8.0.26CVE-2026-87964
  3. 5.4AMP for WPAuthenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical InfoUp to 1.1.18CVE-2026-103908

Cross-site scripting in WordPress plugins

20 vulnerabilities

  1. 7.2MDTFUnauthenticated Stored Cross-Site Scripting via 'vars' ParameterUp to 1.4.1CVE-2026-110776
  2. 7.2GraphinaUnauthenticated Stored Cross-Site Scripting via Tree Chart Widget SettingsUp to 3.1.13CVE-2026-110291
  3. 7.1Elementor Website BuilderUp to 4.3.5CVE-2026-109883
  4. 7.1Elementor Website BuilderUp to 4.3.5CVE-2026-109884
  5. 7.1Pie RegisterUp to 3.8.4.15CVE-2026-119488
Show 15 more
  1. 7.1WCFM MembershipUp to 2.12.0CVE-2026-39744
  2. 6.5Smush Image Compression and OptimizationUp to 4.3.5CVE-2026-120845
  3. 6.5ForminatorUp to 1.58.3CVE-2026-115952
  4. 6.5Redux FrameworkUp to 4.5.16CVE-2026-119472
  5. 6.4All-in-One Video GalleryAuthenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' FieldUp to 5.0.0CVE-2026-116545
  6. 6.4WP Customer AreaAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterUp to 8.4.0CVE-2026-116551
  7. 6.4Wp ParsidateAuthenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block AttributeUp to 6.4CVE-2026-97642
  8. 6.4WP User ManagerAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User MetaUp to 2.10.2CVE-2026-120550
  9. 6.4Permalink Manager LiteAuthenticated (Author+) Stored Cross-Site Scripting via Post SlugUp to 2.6.1CVE-2026-122222
  10. 6.4Posts Table with Search & SortAuthenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode AttributeUp to 1.4.14CVE-2026-118189
  11. 6.4UsersWPAuthenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode AttributeUp to 1.2.80CVE-2026-120671
  12. 5.4BuddyFormsUnauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type ConfusionUp to 2.10.5CVE-2026-107658
  13. 5.4RSS Aggregator by FeedzyUnauthenticated Stored Cross-Site Scripting via Feed Item TitleUp to 5.2.13CVE-2026-120035
  14. 5.4Smart Cookie KitUnauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise RestorationUp to 2.3.2CVE-2026-119178
  15. 4.9AAA Autoload OptimizerAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' HookUp to 1.7.0CVE-2026-119211

Broken access control in WordPress plugins

10 vulnerabilities

  1. 7.1Upsell Order Bump Offer for WooCommerceUp to 3.1.6CVE-2026-115431
  2. 6.5Everest FormsInsecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC EndpointUp to 3.6.2CVE-2026-89101
  3. 6.5EventinMissing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' ParameterUp to 4.1.29CVE-2026-109994
  4. 6.5TravellyMissing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit ScreenUp to 2.3.11CVE-2026-121794
  5. 5.4PolylangUp to 3.9CVE-2026-122670
Show 5 more
  1. 5.3MC4WPUp to 4.14.1CVE-2026-27356
  2. 5.3Redirection for Contact Form 7Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' ParameterUp to 3.2.14CVE-2026-120659
  3. 4.3PublishPress RevisionsUp to 4.2.0CVE-2026-120851
  4. 4.3Royal Elementor AddonsUp to 1.7.1068CVE-2026-119519
  5. 4.3VOD InfomaniakMissing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX ActionUp to 1.5.15CVE-2026-115831

Other vulnerabilities in servers and applications

9 vulnerabilities

  1. 8.7Parse ServerParse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation RegexFixed in 8.6.115, 9.10.7-alpha.1CVE-2026-123487
  2. 8.2PythonRegression in FIPS enforcement of hash algorithms affecting only Python 3.14.10Fixed in 3.14.11CVE-2026-119170
  3. 7.7Frappe FrameworkAuthenticated Arbitrary File Read via File Attachment HandlingFixed in 15.120.1, 16.33.1GHSA-r8px-9662-x39c
  4. 7.2DifyDify < 1.15.0 SSRF Protection Bypass via Remote-Files EndpointsFixed in 1.15.0CVE-2026-58141
  5. 6.0AVideoWWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.phpUp to 29.4.0CVE-2026-123486
Show 4 more
  1. 4.3OpenProjectAPI users with view_time_entries can read meeting details they cannot access via the meetings APIFixed in 17.9.5GHSA-79f3-cmvj-x75q
  2. –Linux kernelxen-netback: defer xenvif_mcast_addr_list_free()Fixed in 6.18.62, 7.3.3CVE-2026-100081
  3. –Linux kernelxen-blkback: Avoid UAF when reading I/O statisticsFixed in 6.18.62, 7.3.3CVE-2026-100082
  4. –Linux kernelxen-netback: Fix UAF when reading statistics dataFixed in 6.18.62, 7.3.3CVE-2026-100080

Other vulnerabilities in WordPress plugins

4 vulnerabilities

  1. 8.1Live2DWebCanvasUnauthenticated Arbitrary File Upload via 'modelApi' ParameterUp to 2.2.1CVE-2026-92895
  2. 7.5FloristPressSensitive Data ExposureUp to 7.8.4CVE-2026-119499
  3. 4.9YaySMTPAuthenticated (Administrator+) SQL Injection via 'params[searchKey]' ParameterUp to 2.7.8CVE-2026-109977
  4. 4.3myCredContent InjectionUp to 4.0.2CVE-2026-123471

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.