UpHeron
All posts

Daily summary

Vulnerabilities of 8 November 2026: 33 new, 6 critical

33 vulnerabilities added on 8 November 2026, 6 critical and 11 high: Hestia Control Panel (8), Privilege escalation in WordPress plugins, Craft CMS (6) and more.

  • 6 critical
  • 11 high
  • 14 medium
  • 1 low
  • 1 unrated

Hestia Control Panel

8 vulnerabilities · Servers and applications · most fixed in 1.10.5

  1. 9.9RCE and Privilege Escalation to Root via Proxy ExtensionsFixed in 1.10.5GHSA-q3m6-6pq7-2vgr
  2. CriticalRemote code execution via v-change-web-domain-ftp-path allows Privilege Escalation to rootFixed in 1.10.5GHSA-jhgf-cvhh-vr4x
  3. CriticalAuthenticated Root Remote Command Execution via v-delete-user-ssh-keyFixed in 1.10.5GHSA-54r9-vp89-25w2
  4. CriticalRCE and Privilege Escalation to Root via Custom Document RootFixed in 1.0.6GHSA-whvg-4fmh-9rxg
  5. 8.5Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in hestiacpFixed in 1.10.5GHSA-274c-fvrr-f3qc
Show 3 more
  1. 8.1Web domain restore runs privileged file operations on user-controlled paths (v-restore-user, *-restic)Fixed in 1.10.5GHSA-5jrh-4c42-g53q
  2. 7.2Protected root administrator read-only bypass through access-key creationFixed in 1.10.5GHSA-g8gq-6cmg-6qj8
  3. 6.1Reflected XSS via unescaped array keys in debug_panel.php (incomplete fix of #5550)Up to 1.10.5GHSA-4h7f-52rq-75mj

Privilege escalation in WordPress plugins

1 vulnerability

  1. 9.6Melapress Role EditorUp to 1.3.0CVE-2026-109900

Craft CMS

6 vulnerabilities · Servers and applications · most fixed in 5.11.2

  1. 9.3Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/nextFixed in 5.11.2CVE-2026-124427
  2. 8.7Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public RegistrationFixed in 5.11.2CVE-2026-124429
  3. 8.7Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing OracleFixed in 5.11.2CVE-2026-124430
  4. 7.1Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svgFixed in 5.11.2CVE-2026-124428
  5. 6.9Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized FieldFixed in 5.11.2CVE-2026-124426
  6. 5.3Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset ReplacementFixed in 5.11.2CVE-2026-124431

Broken access control in WordPress plugins

3 vulnerabilities

  1. 7.1Melapress Role EditorUp to 1.3.0CVE-2026-109899
  2. 6.5AnyWhere ElementorUp to 1.3.0CVE-2026-114186
  3. 6.5FluentFormUp to 6.2.16CVE-2026-120858

IBM WebSphere Liberty

5 vulnerabilities · Servers and applications

  1. 6.5IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesUp to 26.0.0.10CVE-2026-108284
  2. 4.3IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesUp to 26.0.0.10CVE-2026-78636
  3. 4.3IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesUp to 26.0.0.10CVE-2026-11547
  4. 4.3IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesUp to 26.0.0.10CVE-2026-10844
  5. 4.3IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesUp to 26.0.0.10CVE-2026-103320

Cross-site scripting in WordPress plugins

3 vulnerabilities

  1. 6.5WCFM – Frontend Manager for WooCommerceUp to 6.8.1CVE-2026-61987
  2. 6.5AnyWhere ElementorUp to 1.3.0CVE-2026-114188
  3. –Advanced Custom FieldsAdvanced Custom Fields (ACF®): Cross-site ScriptingFixed in 6.8.11CVE-2026-110813

Other vulnerabilities in WordPress plugins

1 vulnerability

  1. 8.5AnyWhere ElementorSQL InjectionUp to 1.3.0CVE-2026-114189

Servers and applications

6 vulnerabilities

  1. 8.1LangflowLangflow OSS is affected by multipleUp to 1.12.2CVE-2026-97677
  2. 7.1GravGrav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media ActionsFixed in 1.3.2CVE-2026-124434
  3. 7.1AVideoWWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.phpUp to 29.7.0CVE-2026-124424
  4. 5.3Frappe FrameworkFrappe before 16.35.0 Broken Access Control in File List/Report QueriesFixed in 15.121.1, 16.35.0CVE-2026-124443
  5. 4.8WebminWebmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgiUp to 2.670CVE-2026-124552
  6. 2.3Parse ServerParse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save ResponseFixed in 8.6.116, 9.10.7-alpha.2CVE-2026-124425

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.