UpHeron
All posts

Daily summary

Vulnerabilities of 11 November 2026: 162 new, 11 critical

162 vulnerabilities added on 11 November 2026, 11 critical and 50 high: Remote code execution in WordPress plugins, Contao (13), Fortinet FortiOS (7) and more.

  • 11 critical
  • 50 high
  • 91 medium
  • 10 low

Remote code execution in WordPress plugins

1 vulnerability

  1. 10.0STAGGSUp to 3.3.0CVE-2026-78287

Contao

13 vulnerabilities · Servers and applications · most fixed in 5.3.54

  1. 9.8Insufficient scope validation for passkey authenticationFixed in 5.7.17GHSA-5mw8-wv8h-h6hx
  2. 9.0Stored cross-site scripting in the file manager via crafted filenamesFixed in 5.3.54GHSA-xh3r-77ch-frm3
  3. 9.0Cross-site scripting in the figure insert tagFixed in 5.3.54GHSA-pc2r-hvrc-f4v6
  4. 7.1Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-MultipleFixed in 5.7.17, 6.0.6CVE-2026-126662
  5. 7.1Filemount access-control bypass in DC_Folder::editAllFixed in 5.3.54GHSA-9jfh-v443-w3fj
Show 8 more
  1. 6.5Contao crawler leaks confidental headersFixed in 5.3.54GHSA-26h3-f97j-vj85
  2. 5.4HTML sanitizer is vulnerable to DOM clobberingFixed in 5.3.54GHSA-58r4-2p86-jp4x
  3. 5.3Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert TagFixed in 5.7.17, 6.0.6CVE-2026-126663
  4. 5.3Insert tag injection in the breadcrumb module on 404 pagesFixed in 5.3.54GHSA-6m74-9w88-r3fh
  5. 4.3Path traversal via decode-after-check in the image insert tagFixed in 5.3.54GHSA-r7cf-mfp4-r23h
  6. 4.3Server-side request forgery via unvalidated feed URL in the legacy RSS reader moduleFixed in 5.3.54GHSA-4mx5-xq7q-77cm
  7. 3.7Session invalidation upon enabling or disabling 2FAFixed in 5.3.54GHSA-5mg3-mv6j-57wc
  8. 3.5Insufficient CSRF protection for backend loginFixed in 5.3.54GHSA-rgq4-cg48-xjxj

Fortinet FortiOS

7 vulnerabilities · Servers and applications

  1. 9.6A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0…Up to 8.0.1CVE-2026-126254
  2. 9.3A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12,…Up to 8.0.1CVE-2026-126253
  3. 9.0A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS…Up to 8.0.0CVE-2026-126259
  4. 7.7A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a…Up to 7.6.4CVE-2026-121528
  5. 7.4A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0…Up to 8.0.1CVE-2026-126255
Show 2 more
  1. 7.4A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions,…Up to 8.0.1CVE-2026-126256
  2. 7.1A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy…Up to 8.0.0CVE-2026-126258

AVideo

15 vulnerabilities · Servers and applications

  1. 9.3WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source TagUp to 29.7.1CVE-2026-126806
  2. 9.3WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social LoginUp to 29.7.1CVE-2026-126542
  3. 8.7Stored XSS in video Source tags allows uploader-to-admin privilege escalationUp to 29.7.1GHSA-2qq6-qfcq-jmr9
  4. 8.7WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.phpUp to 29.7.1CVE-2026-126543
  5. 8.6WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hashUp to 29.7.1CVE-2026-126805
Show 10 more
  1. 8.6WWBN AVideo through 29.7.1 Missing Authorization via Live Restream EndpointsUp to 29.7.1CVE-2026-126541
  2. 8.3Missing ownership checks in MP4 import allow cross-user private video disclosure and deletionUp to 29.7.1GHSA-g69x-xc9q-2g2v
  3. 8.1AVideo ADs path traversal allows authenticated arbitrary file deletionUp to 29.7.1GHSA-58h3-9722-fgpm
  4. 7.2WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.phpUp to 29.7.1CVE-2026-126804
  5. 7.2Delegated Videos Admin can impersonate video owners and escalate to administrator via encoder hashesUp to 29.7.1GHSA-8wjr-gw73-9f2g
  6. 6.1WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.phpUp to 29.7.1CVE-2026-126809
  7. 5.4Stored XSS: a registered user's channel About text is entity-decoded by feedHtmlDescription() and rendered unescaped by feed/rss-style.xsl…Up to 29.7.1GHSA-2qxw-wm6h-5jr7
  8. 5.3WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags APIUp to 29.7.1CVE-2026-126545
  9. 5.3WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()Up to 29.7.1CVE-2026-126544
  10. 5.1WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS FeedUp to 29.7.1CVE-2026-126810

Broken access control in servers and applications

3 vulnerabilities

  1. 9.2DirectusDirectus before 12.1.0 Authorization Bypass via Public WebSocket REST InterfaceFixed in 12.1.0CVE-2026-126539
  2. 4.8LaravelTemporary signed URL expiration bypassFixed in 12.72.0, 13.41.0GHSA-v5ch-g375-82r6
  3. 4.8LaravelTemporary signed URL expiration bypass via unencoded numeric-keyed route parametersFixed in 12.72.0, 13.41.0GHSA-6rv8-qj5v-p8ch

Remote code execution in servers and applications

2 vulnerabilities

  1. CriticalApache HTTP ServerApache HTTP Server: mod_http2: heap corruption and RCE in assign_headersUp to 2.4.70CVE-2026-119618
  2. 7.4RoundcubeRoundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uidFixed in 1.6.21, 1.7.6CVE-2026-126813

Cross-site request forgery in WordPress plugins

18 vulnerabilities

  1. 8.8QualityUp to 3.3CVE-2026-125838
  2. 8.8ElitePressUp to 3.2.1CVE-2026-125839
  3. 8.8RamboUp to 3.0CVE-2026-125840
  4. 8.8HeroicUp to 1.4.2CVE-2026-125841
  5. 8.8Wallstreet AgencyUp to 1.3.4CVE-2026-125842
Show 13 more
  1. 8.8SpasalonUp to 3.0CVE-2026-125843
  2. 8.8viceUp to 1.4CVE-2026-125844
  3. 8.8vdequatorUp to 1.2.7CVE-2026-125845
  4. 8.8MazinoUp to 1.1CVE-2026-125846
  5. 8.8vdperantoUp to 2.2CVE-2026-125847
  6. 8.8LeoUp to 1.7.4CVE-2026-125848
  7. 8.8Shk CorporateUp to 2.4.3CVE-2026-125849
  8. 8.8Appointment DarkUp to 1.3.4CVE-2026-125850
  9. 8.8Edwiser BridgeUp to 4.3.4CVE-2026-125446
  10. 8.8RestroPressUp to 3.4.11CVE-2026-125784
  11. 5.4Locatoraid Store LocatorUp to 3.9.75CVE-2026-124263
  12. 5.4VISeekUp to 1.0.5CVE-2026-121770
  13. 4.3VOD InfomaniakUp to 1.5.16CVE-2026-125445

Node.js

15 vulnerabilities · Servers and applications · most fixed in 22.23.5, 24.22.3, 26.13.1

  1. 8.2Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardownFixed in 24.22.3, 26.13.1CVE-2026-123863
  2. 8.1Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername changeFixed in 24.22.3, 26.13.1CVE-2026-123872
  3. 8.1Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parserFixed in 24.22.3, 26.13.1CVE-2026-123864
  4. 7.5Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacksFixed in 24.22.3, 26.13.1CVE-2026-126051
  5. 7.5Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending writeFixed in 24.22.3, 26.13.1CVE-2026-123874
Show 10 more
  1. 7.5Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardownFixed in 24.22.3, 26.13.1CVE-2026-123866
  2. 7.5Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdownFixed in 24.22.3, 26.13.1CVE-2026-123865
  3. 6.8Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuseFixed in 24.22.3, 26.13.1CVE-2026-123877
  4. 6.2Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messagesFixed in 24.22.3, 26.13.1CVE-2026-123871
  5. 5.9Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelledFixed in 24.22.3, 26.13.1CVE-2026-123875
  6. 5.9Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained streamFixed in 24.22.3, 26.13.1CVE-2026-123868
  7. 5.9Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long originFixed in 24.22.3, 26.13.1CVE-2026-123828
  8. 4.2Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CAFixed in 24.22.3, 26.13.1CVE-2026-123867
  9. 2.9Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() callFixed in 24.22.3, 26.13.1CVE-2026-123862
  10. 2.5Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watchFixed in 24.22.3, 26.13.1CVE-2026-123829

OPNsense

4 vulnerabilities · Servers and applications

  1. 7.2Unquoted PPP password in mpd_*.conf allows root command execution (incomplete fix of CVE-2026-57154)Up to 26.10GHSA-f35q-c34m-pfw3
  2. MediumSource-restricted page-all group satisfies Monit full-admin check outside its allowed networkUp to 26.10GHSA-2f7g-25f3-55v7
  3. MediumLimited Status users can delete crash evidence through dismiss_statusUp to 26.10GHSA-2w8j-hpp2-8rfj
  4. MediumCaptive Portal template ZIP expansion exhausts WebGUI and backend memoryUp to 26.10GHSA-r23v-737v-6r5h

Cross-site scripting in WordPress plugins

24 vulnerabilities

  1. 7.1AI EngineUp to 3.9.1CVE-2026-123478
  2. 7.1Calculated Fields FormUp to 5.5.2.8CVE-2026-124253
  3. 7.1GeoDirectoryUp to 2.8.202CVE-2026-124250
  4. 6.5Element Pack Elementor AddonsUp to 10.0.4CVE-2026-125708
  5. 6.5PasssterUp to 4.3.21CVE-2026-125454
Show 19 more
  1. 6.5Display Eventbrite EventsUp to 6.9.1CVE-2026-123480
  2. 6.5Elementor Addon ElementsUp to 1.5CVE-2026-125743
  3. 6.5Futurio ExtraUp to 2.0.25CVE-2026-125433
  4. 6.5SureRankUp to 1.10.3CVE-2026-125450
  5. 6.5Premium Addons for ElementorUp to 4.11.116CVE-2026-125762
  6. 6.5CreateUp to 3.1.1CVE-2026-125045
  7. 6.5SureCartUp to 4.12.1CVE-2026-124411
  8. 6.5Bold Page BuilderUp to 5.9.11CVE-2026-125680
  9. 6.5YITH WooCommerce Ajax SearchUp to 2.30.0CVE-2026-125761
  10. 6.5Happy Addons for ElementorUp to 3.51.0CVE-2026-123473
  11. 6.5GenerateBlocksUp to 2.5.0CVE-2026-121773
  12. 6.5Element Pack Elementor AddonsUp to 10.0.3CVE-2026-124752
  13. 6.5Bold Page BuilderUp to 5.9.11CVE-2026-125455
  14. 6.5B BlocksUp to 2.1.15CVE-2026-125451
  15. 6.5Event postUp to 6.1.2CVE-2026-125781
  16. 6.5Delivery & Pickup Date Time for WooCommerceUp to 1.3.90CVE-2026-124256
  17. 6.5BP Better MessagesUp to 3.2.1CVE-2026-124257
  18. 6.4Author ImageAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterUp to 4.9.3CVE-2026-119097
  19. 6.1JoinchatReflected Cross-Site Scripting via '{HREF}' Dynamic VariableUp to 6.3.1CVE-2026-15785

Grafana

9 vulnerabilities · Servers and applications

  1. 7.1Cross-instance user impersonation through image renderer JWTsUp to 13.3.0CVE-2026-102589
  2. 7.1Folder permission bypass in the Git Sync repository files APIUp to 13.3.0CVE-2026-111024
  3. 7.1Privilege escalation through folder move in the folders APIFixed in 13.0.10CVE-2026-111000
  4. 6.5Memory exhaustion denial of service in SQL ExpressionsUp to 13.3.0CVE-2026-107509
  5. 6.5Path traversal in Git Sync delete and move jobsUp to 13.3.0CVE-2026-110992
Show 4 more
  1. 6.5Authorization bypass in the Git Sync provisioning jobs APIUp to 13.3.0CVE-2026-14242
  2. 6.5Folder authorization bypass in the Git Sync provisioning files APIUp to 13.3.0CVE-2026-13721
  3. 5.5Git Sync connections send credentials to unvalidated server URLsUp to 13.3.0CVE-2026-110289
  4. 4.3Team preferences RBAC bypass through the set-home-dash endpointUp to 13.0.12CVE-2026-82014

Memory corruption in servers and applications

4 vulnerabilities

  1. HighApache HTTP ServerApache HTTP Server: mod_md NULL pointer dereference leads to child process crashUp to 2.4.70CVE-2026-106023
  2. 4.8GNU C LibraryOne-byte buffer overflow in wide scanf %s and %[ conversionsUp to 2.44CVE-2026-115819
  3. 3.7GNU C LibraryDouble free after allocation failure in regcomp and regexecUp to 2.44CVE-2026-100290
  4. LowApache HTTP ServerApache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)Up to 2.4.70CVE-2026-109163

Palo Alto Networks PAN-OS

7 vulnerabilities · Servers and applications · most fixed in 11.1.16-h5, 11.2.16-h2, 12.1.10-h4

  1. 6.6PAN-OS: Sensitive Information Disclosure VulnerabilityFixed in 12.1.10-h4, 12.2.4-h2CVE-2026-0331
  2. 6.1PAN-OS: Authenticated Remote Code Execution (RCE) in PanoramaFixed in 12.1.10-h4, 12.2.4-h2CVE-2026-0330
  3. 4.6PAN-OS: Buffer Overflow VulnerabilityFixed in 12.1.10-h4, 12.2.4-h2CVE-2026-0329
  4. 2.7PAN-OS: User Impersonation through GlobalProtect PortalFixed in 12.1.10-h4, 12.2.4-h2CVE-2026-0328
  5. 2.3PAN-OS: Privilege Escalation Vulnerability in GlobalProtectFixed in 12.1.10-h4, 12.2.4-h2CVE-2026-0327
Show 2 more
  1. 1.7PAN-OS: Buffer Overflow Vulnerability in Protocol and Service ProcessingFixed in 12.1.10-h4, 12.2.4-h2CVE-2026-0326
  2. 1.3PAN-OS: GlobalProtect Authorization Bypass VulnerabilityFixed in 12.1.10-h4, 12.2.4-h2CVE-2026-0325

Broken access control in WordPress plugins

22 vulnerabilities

  1. 6.5e2pdfUp to 1.32.65CVE-2026-122671
  2. 5.4WPCafeUp to 3.0.22CVE-2026-124408
  3. 5.4RepairBuddyUp to 4.1235CVE-2026-125434
  4. 5.3CreateUp to 3.1.1CVE-2026-125046
  5. 5.3Kali FormsUp to 2.4.31CVE-2026-125448
Show 17 more
  1. 5.3SureFormsUp to 2.13.0CVE-2026-125763
  2. 5.3Tlp Food MenuUp to 6.0.7CVE-2026-125431
  3. 5.3Taxi Booking Manager for WooCommerceUp to 2.1.7CVE-2026-124261
  4. 5.3Profile BuilderUp to 4.0.6CVE-2026-125776
  5. 5.3ZoloBlocksUp to 2.8.2CVE-2026-124421
  6. 5.3Simply Schedule AppointmentsUp to 1.6.13.0CVE-2026-125437
  7. 5.3PasssterUp to 4.3.20CVE-2026-121574
  8. 5.3RepairBuddyUp to 4.1235CVE-2026-125438
  9. 5.3Kit (formerly ConvertKit)Up to 3.5.0CVE-2026-125439
  10. 5.3WP User ManagerUp to 2.10.4CVE-2026-124413
  11. 5.3Restrict User Access – MembershipUp to 2.8.3CVE-2026-115600
  12. 5.3King Addons for ElementorUp to 51.1.87CVE-2026-125444
  13. 5.3Restrict User Access – MembershipUp to 2.8.3CVE-2026-124271
  14. 4.3The Ultimate WordPress Toolkit – WP ExtendedUp to 3.4.2CVE-2026-123481
  15. 4.3The Post GridUp to 7.9.9CVE-2026-125436
  16. 4.3PowerPress PodcastingUp to 11.18.2CVE-2026-125782
  17. 4.3Happy Addons for ElementorUp to 3.51.0CVE-2026-124269

Content injection in WordPress plugins

5 vulnerabilities

  1. 5.3Back In Stock Notifier for WooCommerceUp to 7.5.2CVE-2026-125746
  2. 5.3Ad InserterUp to 2.8.19CVE-2026-124262
  3. 5.3Events Made EasyUp to 3.3.5CVE-2026-124255
  4. 5.3Strong TestimonialsUp to 3.3.17CVE-2026-121028
  5. 4.3myCredUp to 4.0.2CVE-2026-125778

Sensitive data exposure in WordPress plugins

4 vulnerabilities

  1. 5.3Hubbub LiteUp to 1.36.3.1CVE-2026-125767
  2. 5.3WPZOOM Social Feed Widget & BlockUp to 2.4.1CVE-2026-125766
  3. 5.3PowerPack Addons for ElementorUp to 3.1.3CVE-2026-125435
  4. 5.3Profile BuilderUp to 4.0.6CVE-2026-125777

WP Job Portal

4 vulnerabilities · WordPress plugins

  1. 5.3Broken Access ControlUp to 2.7.2CVE-2026-121014
  2. 4.3Broken Access ControlUp to 2.7.2CVE-2026-124416
  3. 4.3Broken Access ControlUp to 2.7.2CVE-2026-124417
  4. 4.3Broken Access ControlUp to 2.7.2CVE-2026-124753

Other vulnerabilities in WordPress plugins

2 vulnerabilities

  1. 8.86Storage RentalsAuthenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoning + Transient-Backed Auth…Up to 2.31.0CVE-2026-103883
  2. 8.8Reset DatabaseAuthenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()Up to 1.1.3CVE-2026-119615

Other vulnerabilities in servers and applications

3 vulnerabilities

  1. 8.6WebminWebmin through 2.670 Privilege Escalation via acl/save_group.cgiUp to 2.670CVE-2026-126780
  2. 8.2Parse ServerLiveQuery subscription with a large list constraint can block the event loopFixed in 9.12.0-alpha.2GHSA-f6wh-8wcf-xfv8
  3. 7.7WebminWebmin through 2.670 Users File Injection via acl/cert_issue.cgiUp to 2.670CVE-2026-126781

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.