Daily summary
Vulnerabilities of 13 November 2026: 230 new, 13 critical
230 vulnerabilities added on 13 November 2026, 13 critical and 88 high: Arbitrary file upload in WordPress plugins, PHP object injection in WordPress plugins, Remote code execution in WordPress plugins and more.
- 13 critical
- 88 high
- 119 medium
- 10 low
Arbitrary file upload in WordPress plugins
3 vulnerabilities
PHP object injection in WordPress plugins
4 vulnerabilities
Remote code execution in WordPress plugins
2 vulnerabilities
NetScaler ADC and Gateway
7 vulnerabilities · Servers and applications · most fixed in 13.1-37.293 FIPs and NDcPP, 13.1-64.39, 14.1-73.57
- 9.5Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler…
- 9.3Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
- 9.3Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service in Citrix NetScaler
- 9.3Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
- 9.3Memory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
SQL injection in WordPress plugins
8 vulnerabilities
Broken access control in servers and applications
4 vulnerabilities
- 9.2Control Web PanelControl Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes
- 7.1Dolibarr ERP CRMDolibarr < 24.0.2 IDOR via Ticket Documents API
- 6.5HashiCorp VaultVault vulnerable to ACL deny bypass via case-variant auth method user and group names
- 5.3REDAXOREDAXO before 5.21.6 Authorization Bypass of Live Version Permission
PostgreSQL
52 vulnerabilities · Servers and applications · most fixed in 16.16, 17.12, 18.7
- 8.8PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code
- 8.8PostgreSQL output parameter type confusion executes arbitrary code
- 8.8PostgreSQL expanded-record domain-check use-after-free executes arbitrary code
- 8.8PostgreSQL plpgsql record-field type confusion executes arbitrary code
- 8.8PostgreSQL FDW batch-insert mismatch executes arbitrary code
Show 47 more
- 8.8PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code
- 8.8PostgreSQL type-cache invalidation gap executes arbitrary code
- 8.8PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code
- 8.8PostgreSQL dropped-column type confusion executes arbitrary code
- 8.8PostgreSQL transition-table cursor use-after-free executes arbitrary code
- 8.8PostgreSQL materialized set-returning function type confusion executes arbitrary code
- 8.8PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions
- 8.8PostgreSQL tuple-size integer wraparound executes arbitrary code
- 8.8PostgreSQL commutator or negator result-type confusion executes arbitrary code
- 8.8PostgreSQL portal setup use-after-free executes arbitrary code
- 8.8PostgreSQL pg_dump tar restore.sql fails to block psql command injection
- 8.8PostgreSQL min/max aggregate type confusion executes arbitrary code
- 8.8PostgreSQL generation memory context integer wraparound executes arbitrary code
- 8.8PostgreSQL statistics import type confusion executes arbitrary code
- 8.8PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf
- 8.8PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code
- 8.8PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code
- 8.8PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code
- 8.8PostgreSQL pg_dump not-null constraint name allows SQL injection
- 8.8PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find
- 8.8PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code
- 8.8PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation
- 8.8PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code
- 8.8PostgreSQL plperl blessed-reference type confusion may execute arbitrary code
- 8.8PostgreSQL composite-type change during field assignment executes arbitrary code
- 8.8PostgreSQL plperl prepared-query use-after-free executes arbitrary code
- 8.8PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code
- 8.1PostgreSQL dblink and subscriptions can append to arbitrary files
- 8.1PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code
- 8.0PostgreSQL reindexdb index name quoting allows SQL injection
- 7.2PostgreSQL extension script schema mishandling executes arbitrary SQL
- 7.2PostgreSQL extension-script substitutions allow SQL injection through object names
- 7.2PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user
- 6.5PostgreSQL parallel B-tree array scan reads beyond array bounds
- 5.4PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition
- 5.4PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables
- 5.4PostgreSQL MERGE can place the wrong row in a trigger transition table
- 5.3PostgreSQL pre-authentication cancel request can leak a spinlock
- 4.3PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies
- 4.3PostgreSQL pg_show_all_settings() use-after-free discloses memory
- 4.3PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks
- 4.3PostgreSQL security_barrier analysis can expose hidden values through indirect expressions
- 4.3PostgreSQL unterminated name value discloses server memory
- 4.3PostgreSQL COPY error context uses freed field storage
- 4.3PostgreSQL dict_int reads beyond zero-length tokens
- 3.7PostgreSQL pg_basebackup can use backup manifest content as a format string
- 3.1PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions
vLLM
6 vulnerabilities · Servers and applications · most fixed in 0.31.0
- 8.7vLLM 0.10.1 before 0.31.0 Cohere2 Vision DoS via max_patches
- 8.2vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models
- 7.1vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames
- 6.9vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames
- 6.9vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()
- 6.9vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels
Broken access control in WordPress plugins
18 vulnerabilities
- 8.6KanbanzBroken Access Control via admin-ajax Handlers
- 7.5Gmail SMTP
- 7.2PagelayerMissing Authorization via Abilities API
- 6.9LearnPress Course WishlistIDOR via render_button
- 6.5Passster
Show 13 more
- 6.5Everest Backup
- 6.3CleverReach® WP
- 5.3RepairBuddy
- 5.3Church Admin
- 5.3Event Tickets
- 5.3CURCY
- 5.3HT Mega
- 5.3Gutenberg Blocks
- 5.3WebinarIgnition
- 5.3Brizy
- 5.3Spectra
- 4.3Imagify
- 4.3myCred
Path traversal in servers and applications
3 vulnerabilities
Ghost
10 vulnerabilities · Servers and applications · most fixed in 6.76.0
- 8.1Brute-Force Protection Bypass via Concurrent Requests and Missing Rate Limits
- 6.5Denial of Service via Crafted Revue Import
- 6.5Denial of Service via Async Helper ID in Theme Data
- 5.5Owner Role Assignment via Content Import
- 5.3Disclosure of Deleted and Hidden Comment Content via Members Comments API Filters
Show 5 more
- 5.3Private Site Access Code Brute Force via Forged Session Cookies
- 5.3Members-only Content Exposed via Content API Plaintext and Excerpt Fields
- 4.3Media Thumbnail Overwrite by Contributors
- 4.3Revenue Data Exposed to Staff Users via Stats Endpoints
- 3.1Imported Media Fetched Over Plaintext HTTP for Protocol-Relative URLs
ZITADEL
8 vulnerabilities · Servers and applications · most fixed in 4.20.3
- 8.1Login V1: Authentication bypass in the OIDC authorization code flow
- 8.1Bypass of GHSA-mchc-246r-6m76: account takeover via userinfo in the public host header
- 7.4Login V2 exposes internal functions as unauthenticated endpoints
- 7.4Login V2: authentication bypass via unauthenticated (zero-factor) session for OIDC and SAML requests
- 7.1Session API and Login V2: organization login policy not enforced for password sign-in
Arbitrary file access in WordPress plugins
2 vulnerabilities
Apache APISIX
7 vulnerabilities · Servers and applications
- 7.8Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header
- 7.0Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding
- 6.9Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare
- 6.4Apache APISIX: authz-keycloak authorization scope mismatch
- 6.4Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers
n8n
15 vulnerabilities · Servers and applications · most fixed in 2.45.5, 2.46.1, 3.0.1
- 7.7n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node
- 7.7n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape
- 7.5Custom Instance Role with User Management Permissions Gives Control of the Owner Account
- 6.3n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset
- 6.3n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes
Show 10 more
- 6.3n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat
- 6.3n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download
- 6.0n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool
- 5.3Workflow Activation Allows Trigger Nodes to Use Credentials the Publisher Cannot Access
- 5.3AWS Bedrock Nodes Skip SSRF Protection for Custom Runtime Endpoints
- 5.3Integration Nodes Send Authenticated Requests to Unintended API Endpoints
- 5.3n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key
- 5.1n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration
- 4.9n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key
- 4.8n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback
OpenBao
4 vulnerabilities · Servers and applications · most fixed in 2.6.5, 2.7.2
- 7.6OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import
- 7.6OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths
- 7.0OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials
- 4.6OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates
SvelteKit
8 vulnerabilities · Servers and applications · most fixed in 2.70.4, 3.1.1
- 7.5DoS while parsing form data from a remote functions `form`
- 7.5Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle
- 5.9SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
- 5.9SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
- 5.9SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
Show 3 more
Cross-site scripting in WordPress plugins
31 vulnerabilities
- 7.2EZ SQL Reports Shortcode Widget and DB BackupUnauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
- 7.1Catna – Woo Name Your Price and Offers
- 7.1Wplingua
- 7.1WP Photo Album Plus
- 7.1Salon booking system
Show 26 more
- 7.1Woody ad snippets
- 7.1Custom Post Types and Custom Fields creator – WCK
- 7.1Dynamic User Directory
- 7.1Make
- 7.1Unbounce Landing Pages
- 7.1WPJAM Basic
- 6.5WP Job Portal
- 6.5rtMedia for WordPress, BuddyPress and bbPress
- 6.5Extension for Leaflet Map
- 6.5PowerPack Lite for Beaver Builder
- 6.5myCred
- 6.5JetTabs
- 6.5HT Mega
- 6.5WP Go Maps
- 6.5Spectra
- 6.5MapSVG
- 6.5Royal Elementor Addons
- 6.5Gutenberg Blocks
- 6.5YITH WooCommerce Ajax Product Filter
- 6.4WPZOOM Addons for ElementorAuthenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters
- 6.4WPeMatico RSS Feed FetcherAuthenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter
- 6.4Download ManagerAuthenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter
- 6.4PasssterAuthenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter
- 6.4Recipe Card Blocks LiteAuthenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
- 5.4PowerPress Podcasting plugin by BlubrryAuthenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes
- 4.4CF7 AppsAuthenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value
Nuxt
7 vulnerabilities · Servers and applications · most fixed in 4.0.0, 4.6.4
- 6.9Nuxt payload URL generation has quadratic cost for repeated slashes in the request path
- 6.5Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes
- 6.5Incomplete fix for GHSA-6gq8-jgmh-3ffp: an encoded slash (`%2F`) in the request path bypasses route rules on catch-all page routes
- 5.9Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file
- 5.3Nuxt exposes the message and data of unhandled errors thrown during server rendering
Content injection in WordPress plugins
5 vulnerabilities
Sensitive data exposure in WordPress plugins
3 vulnerabilities
Authentication bypass in WordPress plugins
2 vulnerabilities
Sensitive data exposure in servers and applications
2 vulnerabilities
Other vulnerabilities in servers and applications
14 vulnerabilities
- 9.2Control Web PanelControl Web Panel < 1.30.6 Host Header Password Reset Poisoning
- 8.7GravGrav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login
- 7.5Umbraco CMSv7 XLTS: Missing authentication on Canvas Designer lets anonymous users create, overwrite and delete site style files
- 6.8HashiCorp VaultExpired Vault login MFA requests may remain redeemable
- 6.5Umbraco CMSv7/v8 XLTS: Back-office login checks the password before account lockout, weakening brute-force protection
Show 9 more
- 6.3FlowiseFlowise 3.1.4 SSRF Bypass via Custom Function Sandbox
- 6.3SymfonyThe "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies
- 5.3AVideoVideo password disclosure in the video_from_program API for accessible playlists
- 5.3Umbraco CMSv7/v8 XLTS: Back-office login response timing reveals whether a username exists
- 4.3MariaDBOut-of-bound buffer read in ST_NumPoints() and ST_NumGeometries() of a truncated WKB
- 4.1Expatlibexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory
- MediumHugoXSS via unescaped `wrapperClass` option in the `highlight` shortcode
- 2.3LaravelTask Output Injection - Concurrency Process
- 2.1ContaoContao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change
Other vulnerabilities in WordPress plugins
5 vulnerabilities
- 8.8SureDashAuthenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint
- 7.1Injection GuardCSRF Password Hash Disclosure
- 6.5WooCommerceRace Condition
- 5.3Post to Google My BusinessSSRF via Preview REST Route
- 2.7WP STAGINGAuthenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.