Security Digest: October 27, 2026 - 43 Critical Vulnerabilities

Today’s threat picture is severe: 43 critical vulnerabilities span database servers, job management platforms, WordPress plugins, Joomla extensions, network devices, and cloud tooling. The highest-risk issues enable authentication bypass, command execution, SQL injection, and memory corruption—several are exploitable remotely and could lead to full system compromise.

· 21 min read

Executive Summary

Today’s threat picture is severe: 43 critical vulnerabilities span database servers, job management platforms, WordPress plugins, Joomla extensions, network devices, and cloud tooling. The highest-risk issues enable authentication bypass, command execution, SQL injection, and memory corruption—several are exploitable remotely and could lead to full system compromise.

Act now: prioritize internet-facing systems, apply vendor patches immediately, and disable or restrict exposed management and admin interfaces until remediation is complete. Where patching is not yet possible, isolate affected services, tighten access controls, and increase monitoring for suspicious logins, command activity, and unexpected outbound connections.

Critical Vulnerabilities

  • CVE-2026-82117: HiRDB authentication bypass
    • Impact: Attackers may bypass authentication and gain unauthorized access.
    • Affected Systems: HiRDB Server Version 10 (10-00 before 10-12-01); Version 9 (09-00 through 09-66-22); Additional Function Version 9; Version 9(32); Additional Function Version 9(32).
    • Immediate Action: Patch to a fixed release now; restrict network access to HiRDB services.
    • Mitigation: Apply the vendor update and verify no exposed admin or database ports remain open.
  • CVE-2026-82118: HiRDB stack-based buffer overflow
    • Impact: Remote code execution or service crash may be possible.
    • Affected Systems: Same HiRDB versions as above.
    • Immediate Action: Treat as urgent on any exposed HiRDB instance.
    • Mitigation: Patch immediately; isolate the service until updated.
  • CVE-2026-86574: JP1/Base heap-based buffer overflow
    • Impact: Potential code execution or denial of service.
    • Affected Systems: JP1/Base 11-00 before 12-50-54.
    • Immediate Action: Upgrade to 12-50-54 or later.
    • Mitigation: Restrict management access and monitor for crashes.
  • CVE-2026-82120: HiRDB heap-based buffer overflow
    • Impact: Memory corruption can lead to compromise or outage.
    • Affected Systems: Same HiRDB versions as above.
    • Immediate Action: Patch immediately; remove unnecessary exposure.
    • Mitigation: Apply vendor fix and validate service hardening.
  • CVE-2026-92885: Qode Membership authentication bypass
    • Impact: Unauthenticated attackers can take over WordPress accounts, including administrators.
    • Affected Systems: Qode Membership plugin up to 2.0.6.2.
    • Immediate Action: Disable the plugin or update immediately.
    • Mitigation: Rotate admin credentials and review recent logins.
  • CVE-2026-82119: HiRDB OS command injection
    • Impact: Remote attackers may execute arbitrary commands.
    • Affected Systems: Same HiRDB versions as above.
    • Immediate Action: Patch now and isolate the server.
    • Mitigation: Apply the fix and audit for suspicious command activity.
  • CVE-2026-76934: JP1/AJS3 stack-based buffer overflow
    • Impact: Possible code execution or crash on Manager/Agent systems.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager and Agent 11-00 before 13-50-31.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Restrict access to job management interfaces.
  • CVE-2026-76938: JP1/AJS3 authentication bypass
    • Impact: Unauthorized access to Manager systems.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager 10-00 before 13-50-31.
    • Immediate Action: Patch and verify access controls.
    • Mitigation: Limit network reachability until updated.
  • CVE-2026-76939: JP1/AJS3 heap-based buffer overflow
    • Impact: Potential remote compromise or service disruption.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager and Agent 11-00 before 13-50-31.
    • Immediate Action: Apply vendor patch.
    • Mitigation: Monitor for abnormal crashes and restarts.
  • CVE-2026-82116: HiRDB missing authentication
    • Impact: Critical functions may be accessed without auth.
    • Affected Systems: Same HiRDB versions as above.
    • Immediate Action: Restrict access and patch now.
    • Mitigation: Confirm management endpoints are not internet-facing.
  • CVE-2026-76932: JP1/AJS3 stack-based buffer overflow
    • Impact: Potential code execution or outage.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager and Agent 11-00 before 13-50-31.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Isolate until patched.
  • CVE-2026-76936: JP1/AJS3 stack-based buffer overflow
    • Impact: Potential code execution or outage.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager 10-00 before 13-50-31.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Restrict management network access.
  • CVE-2026-76935: JP1/AJS3 stack-based buffer overflow
    • Impact: Potential code execution or outage.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager 10-00 before 13-50-31.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Monitor for abnormal process behavior.
  • CVE-2026-76933: JP1/AJS3 heap-based buffer overflow
    • Impact: Potential code execution or outage.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager and Agent 11-00 before 13-50-31.
    • Immediate Action: Patch now.
    • Mitigation: Segment and restrict access to affected hosts.
  • CVE-2026-86576: JP1 products heap-based buffer overflow
    • Impact: Cross-product compromise risk.
    • Affected Systems: JP1/Integrated Management 3 Manager; JP1/AJS3 Manager/Agent/Agent Minimal Edition 13-00 before 13-50-31; JP1/Base 11-00 before 12-50-54.
    • Immediate Action: Patch all affected JP1 components.
    • Mitigation: Validate versions and isolate admin interfaces.
  • CVE-2026-86575: JP1 products stack-based buffer overflow
    • Impact: Possible code execution or denial of service.
    • Affected Systems: Same JP1 product set as above.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Restrict trusted hosts only.
  • CVE-2026-86577: JP1 products out-of-bounds write
    • Impact: Memory corruption may enable compromise.
    • Affected Systems: Same JP1 product set as above.
    • Immediate Action: Patch now.
    • Mitigation: Watch for crashes and anomalous traffic.
  • CVE-2026-82122: HiRDB stack-based buffer overflow
    • Impact: Potential remote compromise or outage.
    • Affected Systems: Same HiRDB versions as above.
    • Immediate Action: Apply vendor fix immediately.
    • Mitigation: Remove external access until remediated.
  • CVE-2026-76937: JP1/AJS3 heap-based buffer overflow
    • Impact: Potential code execution or crash.
    • Affected Systems: JP1/Automatic Job Management System 3 Manager 10-00 before 13-50-31.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Monitor the Manager service closely.
  • CVE-2026-102789: Gridbox missing authorization check
    • Impact: Attackers may access restricted editor functions.
    • Affected Systems: Joomla Gridbox extension below 2.20.4.2.
    • Immediate Action: Update the extension immediately.
    • Mitigation: Review editor permissions and admin logs.
  • CVE-2026-102788: Gridbox unauthenticated SQL injection
    • Impact: Remote attackers can extract or alter database data.
    • Affected Systems: Joomla Gridbox extension below 2.20.4.2.
    • Immediate Action: Patch now and restrict public access.
    • Mitigation: Validate WAF rules and database logs.
  • CVE-2026-116836: airMAX M stored XSS
    • Impact: Attackers on the adjacent network may escalate privileges.
    • Affected Systems: airMAX M devices.
    • Immediate Action: Update firmware and isolate device management.
    • Mitigation: Limit local network exposure.
  • CVE-2026-116838: airMAX M CSRF to command injection
    • Impact: Authenticated users can be tricked into running commands.
    • Affected Systems: airMAX M devices.
    • Immediate Action: Patch firmware and enforce admin hygiene.
    • Mitigation: Use strong session controls and network segmentation.
  • CVE-2026-75891: Kirki privilege escalation via deserialization
    • Impact: Authenticated low-privilege users may gain admin access.
    • Affected Systems: Kirki plugin up to 6.2.5.
    • Immediate Action: Update immediately and review all subscriber accounts.
    • Mitigation: Search for unexpected admin password changes.
  • CVE-2026-116818: OpenPanel unauthenticated SQL injection
    • Impact: Cross-tenant data exposure through WebSocket access.
    • Affected Systems: OpenPanel before 3.0.0.
    • Immediate Action: Upgrade now and restrict WebSocket access.
    • Mitigation: Audit tenant isolation and query logs.
  • CVE-2026-116843: Mistral Vibe RCE via git filter drivers
    • Impact: Attacker-controlled repositories can execute commands.
    • Affected Systems: Mistral Vibe before 3.0.3.
    • Immediate Action: Update immediately; avoid opening untrusted repos.
    • Mitigation: Disable untrusted worktree operations where possible.
  • CVE-2026-116808: OpenPanel authenticated SQL injection
    • Impact: Cross-tenant data can be read by authenticated users.
    • Affected Systems: OpenPanel before 3.0.0.
    • Immediate Action: Patch now.
    • Mitigation: Review database permissions and access logs.
  • CVE-2026-116819: OpenPanel secrets disclosure
    • Impact: Integration secrets and tokens may be exposed to project members.
    • Affected Systems: OpenPanel before 3.0.0.
    • Immediate Action: Upgrade and rotate exposed secrets.
    • Mitigation: Check all notification and integration settings.
  • CVE-2026-117494: SVG XSS in AI sessions API
    • Impact: Script execution in the assistant window.
    • Affected Systems: /api/v2/ai/sessions handling data:image/svg+xml;base64 content.
    • Immediate Action: Block SVG uploads and patch rendering paths.
    • Mitigation: Sanitize uploads and monitor for injected content.
  • CVE-2026-116825: YesWiki replay attack
    • Impact: Captured signed requests can be replayed to repeat actions.
    • Affected Systems: YesWiki 4.6.2 before 4.7.0.
    • Immediate Action: Update and invalidate exposed request signatures.
    • Mitigation: Enforce nonce/date validation and rotate secrets.
  • CVE-2026-117493: BloX widgets stored XSS
    • Impact: Malicious widget content can execute in browsers.
    • Affected Systems: BloX widget API.
    • Immediate Action: Patch and remove untrusted widget content.
    • Mitigation: Review dashboards for injected HTML/JS.
  • CVE-2026-85299: Google Compute Engine snapshot authorization flaw
    • Impact: Cross-project disk data could be exfiltrated.
    • Affected Systems: GCE versions prior to 2026-08-31; patched on 31 Aug 2026.
    • Immediate Action: No customer action needed if already patched.
    • Mitigation: Verify compliance with the August patch baseline.
  • CVE-2026-116827: YesWiki SSRF via CSV import
    • Impact: Admins can be tricked into fetching internal or cloud resources.
    • Affected Systems: YesWiki before 4.7.0.
    • Immediate Action: Update and restrict CSV import use.
    • Mitigation: Block file:// and internal URL access.
  • CVE-2026-116826: YesWiki SSRF via duplication feature
    • Impact: Arbitrary outbound requests and data exposure.
    • Affected Systems: YesWiki before 4.7.0.
    • Immediate Action: Patch now and restrict duplication API access.
    • Mitigation: Prevent file and internal URL fetching.
  • CVE-2026-18449: BMC IPMI command execution
    • Impact: Attackers may execute arbitrary commands in active sessions.
    • Affected Systems: BMC/IPMI environments affected by the integrity/encryption failure.
    • Immediate Action: Apply vendor firmware updates immediately.
    • Mitigation: Restrict BMC access to dedicated management networks.
  • CVE-2026-16521: BMC OS command injection
    • Impact: Command payloads may execute after service restart.
    • Affected Systems: Affected BMC function with insufficient filtering.
    • Immediate Action: Patch firmware and review restart procedures.
    • Mitigation: Limit privileged access to BMC interfaces.
  • CVE-2026-111820: WordPress Analytics Insights stored XSS
    • Impact: Unauthenticated attackers can inject scripts into pages.
    • Affected Systems: Analytics Insights plugin up to 6.3.12.
    • Immediate Action: Update immediately and review affected content.
    • Mitigation: Sanitize page titles and inspect rendered pages.
  • CVE-2026-116821: YesWiki read-ACL bypass
    • Impact: Attackers may read pages and Bazar entries restricted to others.
    • Affected Systems: YesWiki before 4.7.0.
    • Immediate Action: Patch and review public listing access.
    • Mitigation: Audit ACL rules and usernames for abuse.
  • CVE-2026-116812: OpenPanel SQL injection in cohort access
    • Impact: Cross-tenant ClickHouse data may be exposed.
    • Affected Systems: OpenPanel before 3.0.0.
    • Immediate Action: Upgrade now.
    • Mitigation: Validate all cohort and filter inputs.
  • CVE-2026-116814: OpenPanel information exposure in logs
    • Impact: Database URLs and password-reset tokens may leak via logs.
    • Affected Systems: OpenPanel before 3.0.0.
    • Immediate Action: Patch and rotate any exposed credentials.
    • Mitigation: Restrict log access and scrub sensitive output.
  • CVE-2026-116813: OpenPanel SQL injection in conversion service
    • Impact: Analytics data from other tenants may be read.
    • Affected Systems: OpenPanel before 3.0.0.
    • Immediate Action: Update immediately.
    • Mitigation: Review query construction and tenant boundaries.
  • CVE-2026-116839: airMAX M CSRF leading to DoS
    • Impact: Authenticated users can be tricked into disrupting service.
    • Affected Systems: airMAX M devices.
    • Immediate Action: Patch firmware and harden admin sessions.
    • Mitigation: Use network segmentation and strict admin access.
  • CVE-2026-116807: OpenPanel SQL injection bypassing tenant scoping
    • Impact: Attackers can read events from all projects.
    • Affected Systems: OpenPanel before 3.0.0.
    • Immediate Action: Patch now and inspect data access logs.
    • Mitigation: Enforce parameterized queries and tenant isolation.

Previously Alerted

What to Do Now

  1. Patch first: Update HiRDB, JP1, OpenPanel, YesWiki, WordPress plugins, Joomla Gridbox, airMAX M, Kirki, BloX, Mistral Vibe, and BMC firmware immediately.
  2. Contain exposure: Remove internet access from admin consoles, WebSockets, database ports, and BMC interfaces until fixes are verified.
  3. Rotate credentials: Reset administrator passwords and rotate any secrets that may have been exposed, especially in OpenPanel and WordPress environments.
  4. Verify versions: Confirm every affected host is on a fixed release and not just partially updated.
  5. Monitor aggressively: Look for unusual logins, unexpected SQL errors, outbound requests, command execution, new admin accounts, and service crashes.

Verification steps: check package versions, plugin inventories, and appliance firmware; confirm WAF and firewall rules; review authentication logs; and validate that no legacy endpoints remain reachable.

Monitoring recommendations: alert on spikes in 401/403 responses, new sessions from unusual IPs, outbound DNS/HTTP requests from servers that should not browse the internet, and repeated restarts of HiRDB, JP1, or BMC-related services.

Related Resources

  • Internal blog posts: Coming soon — remediation guidance for HiRDB, JP1, OpenPanel, and WordPress plugin exposure.
  • Official vendor advisories: HiRDB, JP1, Google Cloud, WordPress plugin, Joomla extension, YesWiki, airMAX M, and BMC vendor security advisories.

Keep reading