UpHeron
All posts

Daily summary

Vulnerabilities of 12 November 2026: 116 new, 26 critical

116 vulnerabilities added on 12 November 2026, 26 critical and 40 high: Dokploy (67), Denial of service in servers and applications, Broken access control in WordPress plugins and more.

  • 26 critical
  • 40 high
  • 41 medium
  • 8 low
  • 1 unrated

Dokploy

67 vulnerabilities · Servers and applications · most fixed in 0.31.1

  1. 9.9Non-admin organisation member can gain root on the host via an unrestricted host bind-mountFixed in 0.31.1GHSA-jrg5-2gj5-h827
  2. 9.9Cross-organization IDOR across ~145 tRPC handlers via checkServicePermissionAndAccess / checkServiceAccess owner/admin bypass (CVE-2026-43917 missed siblings)…Fixed in 0.31.1GHSA-fx4f-j8fj-2q69
  3. 9.9Authenticated OS command injection in Dokploy leads to root remote code execution (systemic; multiple endpoints)Fixed in 0.31.1GHSA-5cvm-v3wv-2gw3
  4. 9.9Authenticated OS command injection in database backup/restore → root RCE (v0.29.8)Fixed in 0.31.1GHSA-qh9m-682j-9fqr
  5. 9.9Authenticated Remote Code Execution and Host Escape via Command Injection in Dokploy Domain Management ServiceName FieldFixed in 0.30.0GHSA-xmmr-fhf3-cwwj
Show 62 more
  1. 9.9Path Traversal + Command Injection in Patch Application (`generateApplyPatchesCommand`)Fixed in 0.31.1GHSA-phrr-h3mm-9vp6
  2. 9.9[CWE-78] Authenticated Shell Command Injection via Patch Repository Path in DokployFixed in 0.31.1GHSA-h542-rh5v-qgj2
  3. 9.9Authenticated Command Injection via unescaped backup.prefix in database/service backup commands leads to RCE as rootFixed in 0.31.1GHSA-2gq3-9q77-8hgv
  4. 9.9OS Command Injection via serviceName in Compose BackupFixed in 0.31.1GHSA-j329-jw7j-rxjm
  5. 9.9Authenticated Path Traversal in 'mounts.create' 'filePath' leads to Arbitrary Root-Owned File Write on Host via Bind MountFixed in 0.31.1GHSA-5mqv-h2xh-fvhg
  6. 9.9OS Command Injection via filePath in mount.deleteFileMount → HOST RCEFixed in 0.31.1GHSA-945r-hp2m-928m
  7. 9.9OS Command Injection via composePath remains in utils/docker/domain.ts - incomplete fix of CVE-2026-72865Fixed in 0.31.1GHSA-x2r4-3gv4-jv6x
  8. 9.9docker-container-terminal serviceId gate not bound to containerId (incomplete fix of CVE-2026-72864) - member with one service opens root shell in any org…Fixed in 0.31.0GHSA-86jc-q5q3-78vv
  9. 9.9Systemic Cross-Organization IDOR via Shared Permission Helpers, Affecting Credentials, Domains, File Mounts, and Database PasswordsFixed in 0.31.1GHSA-9889-w3j8-rm22
  10. 9.9Cross-organization project takeover via `project.update`Fixed in 0.31.1GHSA-h52x-gwf8-4h58
  11. 9.9Incomplete fix of GHSA-p2c7-8j28-c7gq + Missing Authorization in backup/restore (Member -> command execution on managed servers, instance exfiltration and…Fixed in 0.31.1GHSA-2w53-7ppr-3xpp
  12. 9.9`ai.deploy` does not validate serverId - members can deploy to other organizations' serversFixed in 0.31.1GHSA-8rch-pggc-942j
  13. 9.6Traefik rule injection via unsanitized host and path fields — cross-tenant traffic hijackFixed in 0.31.1GHSA-5qmc-4xhw-j6vp
  14. 9.1Dokploy Drop deployment ZIP traversal can overwrite global Traefik dynamic routing configurationFixed in 0.31.1GHSA-h8q2-p3w4-m3mr
  15. 9.1OS command injection via libsql appName missing APP_NAME_REGEX validationFixed in 0.31.0GHSA-x3g8-6v8j-rm56
  16. 9.1Path traversal in `appName` on the `/listen-docker-stats-monitoring` WebSocket lets a low-privileged member create arbitrary directories and write files as…Fixed in 0.31.1GHSA-87rx-r765-9c93
  17. CriticalIncomplete fix of GHSA-899j-cjwp-v4gw: serviceId lets a member reach any container (Member -> Root) over the docker WebSocket handlersUp to 0.30.8GHSA-pwg8-2x8c-wc2m
  18. CriticalPath Traversal & RCE via unzipDrop and SchedulesFixed in 0.31.1GHSA-wcp5-g62q-jfr9
  19. CriticalRCE via Command Injection in Schedule appNameFixed in 0.31.1GHSA-8m32-h7qx-8r79
  20. CriticalCross-organization SSH key attachment in Dokploy server updateFixed in 0.31.1GHSA-v2pj-9x4j-7hcj
  21. 8.4Incomplete Fix: Cross-Organization GitHub Provider Reassignment Exposes Stored CredentialsFixed in 0.31.1GHSA-fj57-g9cq-fwvq
  22. 8.3Missing authorization on all network.* endpoints (Member -> create/delete docker networks on org servers, cross-org access via serverId)Fixed in 0.31.1GHSA-r6pv-8cgq-pvxv
  23. 8.3Credential-redaction fix leaves Docker-source passwords in application responsesFixed in 0.31.1GHSA-v549-87g2-g95q
  24. 8.3Deployment history exposes registry passwords from rollback snapshotsFixed in 0.31.1GHSA-6947-4ch9-7px7
  25. 8.1SSRF: Custom notification endpoint takes arbitrary URL + headers — no URL/host validationFixed in 0.31.1GHSA-cq5q-r4h3-c83v
  26. 8.1Multiple cross-organization authorization gaps from incomplete org-scope coverage: git-provider update mutations reassign another org's provider and disclose…Fixed in 0.31.1GHSA-pfvx-m77f-6qr6
  27. 7.7Cross-organization Git-provider secret disclosure (IDOR) via {github,gitlab,bitbucket,gitea}.one tRPC handlersFixed in 0.31.1GHSA-66r5-5m5f-57vg
  28. 7.7Authenticated Server-Side Request Forgery in Dokploy via the AI provider `getModels` endpointFixed in 0.31.1GHSA-j7vw-q729-gm8m
  29. 7.7Arbitrary File Read via Path Traversal in `patch.readRepoFile`Fixed in 0.31.1GHSA-g6rj-m32j-2mc4
  30. 7.7Server-Side Request Forgery (SSRF) via Template baseUrl ParameterFixed in 0.31.1GHSA-gxcw-hpm8-vq4m
  31. 7.7Incomplete fix of GHSA-7r6p-v9gw-pwc8: listen-deployment.ts is named in that advisory but was never remediated — any authenticated member can stream host SSH…Fixed in 0.31.1GHSA-286g-v4cw-2x8v
  32. 7.6Removing a member leaves organization API keys active and preserves accessFixed in 0.31.1GHSA-wc7v-rjjv-9g7g
  33. 7.6Notification parent/child ID confusion allows cross-tenant alert and credential hijackingFixed in 0.31.1GHSA-wf8r-8h5f-pxqm
  34. 7.4Sensitive Credential Leakage: GitHub Authentication Token (`ghs_`) Exposed in Discord Webhook PayloadsFixed in 0.31.0GHSA-p8v8-6hm2-3w67
  35. 7.1/listen-deployment WebSocket has no service permission check - any member streams deployment logs of every service, including projects they have zero access toFixed in 0.31.1GHSA-vqmc-jp8m-qx86
  36. 7.1Ownerless volume backup exposes arbitrary Docker volumes without service accessFixed in 0.31.1GHSA-29rq-cf85-cvc5
  37. HighLocal privilege escalation to root: install.sh makes /etc/dokploy world-writable (0777)Up to 0.31.0GHSA-qxjv-6cvh-32c6
  38. HighOS Command Injection in scheduler execution, Traefik config write, and Compose deployment → HOST RCEFixed in 0.29.13GHSA-wm5j-x54v-3fjf
  39. HighPath Traversal + OS Command Injection in mount/patch-repo/schedule services → rm -rf / + HOST RCEFixed in 0.31.1GHSA-fgh8-p4fg-jc8h
  40. HighRemote deployment failures expose environment secrets in Dokploy container logsFixed in 0.31.0GHSA-22qj-9936-gq2m
  41. HighSSH private keys disclosed in full by sshKey.all and sshKey.one — the redactServerSshKey fix from #4857 never reached the sshKey routerFixed in 0.31.1GHSA-rwpf-vrr8-6g7c
  42. HighFull-read SSRF via ai.getModels / ai.testConnection - any authenticated user, no role checkFixed in 0.31.1GHSA-gv94-wp2p-75p6
  43. HighUsers can overwrite server-managed fields on their own account via `user.update`Fixed in 0.31.1GHSA-m7rq-qhjp-cmgm
  44. HighMember API key can list all containers and read logs of any container on the server via compose.readLogsFixed in 0.31.1GHSA-gw29-hh29-xhfr
  45. 6.8Vault provider credential exfiltration: echoing the "********" mask restores the stored secret, which is then sent to a caller-controlled endpoint URLFixed in 0.31.1GHSA-7f32-g5xc-mqr7
  46. 6.5Dokploy member users can read the global web-server SSH private key through settings.getWebServerSettingsFixed in 0.31.1GHSA-fr95-6x4c-3c5g
  47. 6.3Failed builds and backups send every application secret in plain text to notificationsFixed in 0.31.1GHSA-w452-9gw6-323p
  48. 6.3Missing authorization on deployment.killProcess/readLogs/removeDeployment and host-level schedule reads (cross-organization)Fixed in 0.31.1GHSA-6g88-x4hx-9837
  49. 6.0Cross-organization Docker network control through unchecked `serverId`Fixed in 0.31.1GHSA-3qp9-jw8g-424v
  50. 6.0Unverified profile email change hijacks pending organization invitationsFixed in 0.31.1GHSA-wc74-2pg4-3fm2
  51. 5.4CSRF on OAuth Authorization EndpointFixed in 0.31.1GHSA-vg9f-347r-pmqf
  52. 5.4Cross-organization API key via better-auth /api/auth/api-key/create (client-set metadata.organizationId)Fixed in 0.31.1GHSA-q2x3-gch7-6g53
  53. 5.3Dokploy < 0.31.1 Broken Access Control via readAppMonitoringFixed in 0.31.1CVE-2026-127212
  54. 5.3Missing Ownership Check in Application Monitoring EndpointFixed in 0.31.1GHSA-vxxh-2cp7-gr59
  55. 5.3Read-only Viewer can deploy applications and Compose stacks through exposed webhook tokensFixed in 0.31.1GHSA-xjv4-wwvv-vq3m
  56. 5.3Incomplete deployment IDOR fix exposes unowned logs and recordsFixed in 0.31.1GHSA-jph3-c3v5-2v4j
  57. 5.0Authenticated directory traversal in `patch.readRepoDirectories` lets any member enumerate the file tree of any git repository on the host, including other…Fixed in 0.31.1GHSA-q7cq-vxv7-449c
  58. 4.8Stored XSS via unsanitized whitelabeling `customCss` (`</style>` breakout) - enterprise-license-gated; patched in canary after v0.30.5Fixed in 0.31.1GHSA-j4h6-55cr-j72v
  59. 4.3"Access to API" permission not enforced server-side in user.createApiKeyFixed in 0.31.1GHSA-f6j7-hvv3-8jwm
  60. MediumS3 destination secret key leaked in backup failure notifications (database, Compose and volume backups)Fixed in 0.31.0GHSA-m68g-xqqg-jmf5
  61. MediumSaving the git source of an application or compose does not check access to the git provider: a member can point their service at another user's unshared…Fixed in 0.31.1GHSA-hjg5-rhxv-62h2
  62. LowS3 credential redaction never fires: redact.ts requires double quotes, shell-quote never emits them (CWE-532)Fixed in 0.31.0GHSA-4pfc-fvr6-wj82

Denial of service in servers and applications

1 vulnerability

  1. 9.3NetScaler ADC and GatewayMemory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler GatewayFixed in 14.1-73.57, 14.1-73.58 FIPSCVE-2026-120868

Broken access control in WordPress plugins

5 vulnerabilities

  1. 8.7WooCommerce PayPal Pro Payment GatewayPayment Bypass via pp_capture_orderFixed in 4.1.1CVE-2026-127204
  2. 7.1MultiVendorXBroken Access Control via stores REST RouteFixed in 5.0.22CVE-2026-127211
  3. 6.9Contact Form 7 Image CaptchaImage CAPTCHA for Contact Form 7 and WPForms 3.3.29 CAPTCHA BypassUp to 3.3.29CVE-2026-127206
  4. 5.4Quiz And Survey MasterUp to 11.3.0CVE-2026-125787
  5. 5.3Sendcloud Connected ShippingSendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX ActionsUp to 1.0.41CVE-2026-127207

Traefik

5 vulnerabilities · Servers and applications · most fixed in 2.11.62, 3.7.18, 3.8.0-rc.2

  1. 8.7Unauthenticated memory-exhaustion DoS: the Compress middleware pins ~18 MiB of zstd encoder state per in-flight responseFixed in 3.7.18, 3.8.0-rc.2GHSA-x5pf-cqh3-2gv8
  2. 7.8sanitizePath does not remove path-parameter dot-segments (/..;x/), enabling path-based authorization bypassFixed in 3.7.18, 3.8.0-rc.2GHSA-cp28-5662-543f
  3. 7.0Incomplete fix for GHSA-hrpp-p4fc-wwf8 allows ForwardAuth NTLM authentication bypass via Proxy-AuthorizationFixed in 3.7.18, 3.8.0-rc.2GHSA-p956-6gvv-mxqp
  4. 7.0ingress-nginx client certificate authentication (auth-tls-secret) verification bypass and Ssl-Client-* header spoofing on shared hostsFixed in 3.7.18, 3.8.0-rc.2GHSA-ccgh-9g52-6vwg
  5. 6.3Unbounded BasicAuth password length gives ~1857x CPU amplification through MD5-crypt, pre-authenticationFixed in 3.7.18, 3.8.0-rc.2GHSA-rr42-h8r2-f28g

Frappe Framework

5 vulnerabilities · Servers and applications

  1. 8.2Blind SQL Injection via X-Frappe-Request-Id headerFixed in 15.120.0, 16.33.0GHSA-vp4r-5v6w-r962
  2. HighSandbox bypass via imported functions leaking into Jinja globals through module-path hooksFixed in 15.121.2, 16.36.0GHSA-qrxv-3vjh-gpx7
  3. HighOAuth2 password grant bypasses two-factor authenticationFixed in 15.121.1, 16.35.0GHSA-h3mh-9vmc-cpfg
  4. 4.6Stored spreadsheet formula injection in CSV and XLSX exportsFixed in 15.119.0, 16.32.0GHSA-c76w-4wg2-hpgf
  5. MediumComment SpoofingFixed in 15.108.0, 16.18.3CVE-2026-47278

Grafana

4 vulnerabilities · Servers and applications · most fixed in 12.4.15, 13.0.13, 13.1.10

  1. 7.1Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentialsFixed in 12.4.15CVE-2026-106475
  2. 6.5Memory exhaustion denial of service in Elasticsearch data source index patternsFixed in 12.4.15CVE-2026-81843
  3. 6.3Server-side request forgery in the Prometheus data source resource APIFixed in 13.0.13, 13.1.10CVE-2026-106472
  4. 5.3Unintended API access through the Google Cloud Monitoring data source resource proxyFixed in 13.0.13, 13.1.10CVE-2026-107365

Nginx UI

4 vulnerabilities · Servers and applications · most fixed in 2.9.1

  1. 6.6Full backup exports expose reusable interactive login sessions to management credentialsFixed in 2.9.1GHSA-hf3h-p3fr-3f2r
  2. 5.3Unauthenticated dependency inventory + version disclosure via `/api/licenses*`Fixed in 2.9.1GHSA-mfj4-8rf3-rpq6
  3. 3.8JwtSecret Overwrite via Settings API Causes Session Invalidation and MonopolyFixed in 2.9.1GHSA-2rjr-44wx-8qpg
  4. 2.7OpenAI API Key Exfiltration via Unprotected BaseUrl Setting ChangeFixed in 2.9.1GHSA-p355-qjwh-8hgm

Cross-site scripting in WordPress plugins

3 vulnerabilities

  1. 6.5JetEngineUp to 3.9.1CVE-2026-125785
  2. 5.4WP Table Builder – Drag & Drop Table BuilderAuthenticated (Contributor+) Stored Cross-Site Scripting via 'url'Up to 2.1.7CVE-2026-2982
  3. –ElementorElementor Website Builder – more than just a page builder: Cross-site ScriptingFixed in 4.3.6CVE-2026-104718

Astro

5 vulnerabilities · Servers and applications

  1. 6.3Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystemsFixed in 7.4.7CVE-2026-126364
  2. 5.4Astro: XSS via unescaped code for unsupported languages in @astrojs/prismFixed in 7.4.3CVE-2026-126365
  3. 2.3Astro: Reflected XSS via unescaped slot names in @astrojs/solid-jsFixed in 7.1.2CVE-2026-126363
  4. 2.3Astro: Reflected XSS via unescaped slot names in @astrojs/svelteFixed in 9.1.2CVE-2026-126362
  5. 2.3XSS via attribute injection in dynamic tag namesFixed in 7.4.5CVE-2026-126361

Other vulnerabilities in WordPress plugins

4 vulnerabilities

  1. 8.8Simple JWT LoginCross Site Request Forgery (CSRF)Up to 3.6.8CVE-2026-125836
  2. 7.1Backup MigrationPath Traversal via PclZip Restore FallbackFixed in 2.1.8CVE-2026-127050
  3. 5.3Gutenverse FormCSV Formula Injection via Form SubmissionFixed in 3.2.2CVE-2026-124018
  4. 5.3Quiz And Survey MasterContent InjectionUp to 11.3.0CVE-2026-125786

Other vulnerabilities in servers and applications

13 vulnerabilities

  1. 8.4PleskThe Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription…Up to 18.0.82.2CVE-2026-82977
  2. 7.9runcmalicious image can bind-mount an arbitrary host directory into a container across checkpoint/restoreFixed in 1.5.3, 1.6.0-rc.2CVE-2026-119101
  3. 7.7LiteLLMAuthenticated secret exfiltration via Azure Entra credential parameters in the request bodyFixed in 1.109.1, 1.110.0-rc.2GHSA-2rwg-2wh4-7c4f
  4. 7.3Movable TypeMovable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted…Up to 8.8.6CVE-2026-117687
  5. 6.5HashiCorp VaultVault vulnerable to ACL deny bypass via trailing slashFixed in 2.2.2CVE-2026-93335
Show 8 more
  1. 6.5BudibasePublic API View Row Search Bypasses Per-View Authorization via Resource ID Parameter MismatchFixed in 3.48.0GHSA-8wqw-xg9x-89h8
  2. 6.3MLflowMLflow < 3.18.0 Path Traversal via model_id in log_outputs APIFixed in 3.18.0CVE-2026-127202
  3. 5.9HashiCorp VaultVault integrated storage join may disclose server environment credentialsFixed in 2.2.2CVE-2026-92735
  4. 5.4BudibaseBudibase filesystem oracle and conditional directory deletion via body.file.pathFixed in 3.51.0GHSA-4xqp-vfh8-4fv7
  5. 5.4BudibaseSSRF blacklist bypass: IPv6 unspecified address :: omitted from outbound-fetch default deny list reaches loopback servicesFixed in 3.49.0GHSA-m2mm-7xvw-9623
  6. 5.4AVideoAVideo CSRF on YPTWallet saveConfiguration.php lets an attacker hijack a user's crypto wallet and donation webhookUp to 29.6.0GHSA-27wf-8499-p469
  7. 2.7HashiCorp VaultVault audit device prefix vulnerable to log injectionFixed in 2.2.2CVE-2026-93333
  8. 2.3PythonCookie Attribute Injection via Unescaped Semicolons in http.cookies.MorselFixed in 3.16.0CVE-2026-16052

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.