Security Digest: October 28, 2026 - 33 Critical Vulnerabilities

Today’s alert is dominated by remote code execution, authentication bypass, and file upload flaws across WordPress plugins, Dell PowerProtect Data Domain, Jackson, and other widely deployed platforms. Several issues are unauthenticated and internet-reachable, making them immediate patch priorities.

· 18 min read

Executive Summary

Today’s alert is dominated by remote code execution, authentication bypass, and file upload flaws across WordPress plugins, Dell PowerProtect Data Domain, Jackson, and other widely deployed platforms. Several issues are unauthenticated and internet-reachable, making them immediate patch priorities.

Act now: patch exposed systems first, disable or restrict vulnerable features where patching is delayed, and hunt for signs of webshells, new admin accounts, unusual login activity, and suspicious outbound connections.

Critical Vulnerabilities

  • CVE-2026-106013: Jupiter X Core WordPress auth bypass
    • Impact: Attackers can log in as the WordPress account tied to the X app owner email, often the site administrator.
    • Affected Systems: Jupiter X Core plugin up to 4.61.0.
    • Immediate Action: Disable X/Twitter social login now if exposed; rotate WordPress admin credentials and X API credentials.
    • Mitigation: Update to a fixed release as soon as available and review admin sessions and user mappings.
  • CVE-2026-86400: Dell PowerProtect Data Domain root RCE
    • Impact: Unauthenticated remote attackers can gain root command execution.
    • Affected Systems: Feature Release 7.7.1.0-8.8; LTS2024 7.13.1.0-7.13.1.80; LTS2025 8.3.1.0-8.3.1.40; LTS2026 8.6.1.0-8.6.1.20.
    • Immediate Action: Isolate management interfaces and apply vendor updates immediately.
    • Mitigation: Upgrade at the earliest opportunity; restrict remote access until patched.
  • CVE-2026-84999: Pie Register Premium unrestricted upload
    • Impact: Unauthenticated attackers may upload executable files and trigger remote code execution.
    • Affected Systems: Pie Register Premium up to 3.8.4.0.
    • Immediate Action: Disable the upload feature or plugin until patched.
    • Mitigation: Update immediately; review uploads for PHP or other dangerous extensions.
  • CVE-2026-109218: Contact Manager arbitrary file upload
    • Impact: Attackers may upload files that can execute as code on some servers.
    • Affected Systems: Contact Manager up to 9.1.2.
    • Immediate Action: Block public upload endpoints and remove the plugin if not essential.
    • Mitigation: Patch to the fixed version and inspect web-accessible upload directories.
  • CVE-2026-86384: Dell PowerProtect Data Domain hard-coded key exposure
    • Impact: Credentials may be exposed and reused to access systems.
    • Affected Systems: Same Dell Data Domain release lines as above.
    • Immediate Action: Rotate credentials and limit remote management access.
    • Mitigation: Apply Dell updates and review account and key usage.
  • CVE-2026-110879: Jackson databind generic-type validation bypass
    • Impact: Attackers can smuggle dangerous classes through generic arguments and reach code execution in affected integrations.
    • Affected Systems: jackson-databind 2.10.0+ and tools.jackson.core 3.0.0+.
    • Immediate Action: Disable class-name polymorphism where possible and review all deserialization entry points.
    • Mitigation: Upgrade to a fixed release and tighten type validators.
  • CVE-2026-118375: llama.cpp RPC stack overflow
    • Impact: Remote peers can crash the server and may execute code.
    • Affected Systems: llama.cpp b8841 before b11865.
    • Immediate Action: Restrict RPC exposure immediately.
    • Mitigation: Upgrade to b11865 or later.
  • CVE-2026-90717: Dell PowerProtect Data Domain Management Center auth bypass
    • Impact: Low-privileged attackers may gain elevated access and affect managed systems.
    • Affected Systems: Same Dell release families as above.
    • Immediate Action: Restrict access to the management center now.
    • Mitigation: Patch and review delegation and privilege assignments.
  • CVE-2026-58256: GRR LDAP config injection to PHP RCE
    • Impact: Malicious LDAP settings can poison config files and execute PHP.
    • Affected Systems: GRR prior to 4.5.0.
    • Immediate Action: Disable untrusted LDAP configuration changes.
    • Mitigation: Upgrade to 4.5.0 and inspect generated config files.
  • CVE-2026-14571: Futurum Software blind SQL injection
    • Impact: Attackers can query the database and extract sensitive customer data.
    • Affected Systems: Futurum Software management platform affected builds.
    • Immediate Action: Put the application behind stricter network controls and monitor DB activity.
    • Mitigation: Apply the vendor fix and validate WAF rules.
  • CVE-2026-111120: VikRentCar CSRF to template RCE
    • Impact: A forged request can write PHP into executable templates.
    • Affected Systems: VikRentCar up to 1.4.8.
    • Immediate Action: Restrict admin access and enforce MFA; watch for template changes.
    • Mitigation: Patch immediately and verify template integrity.
  • CVE-2026-86398: Dell PowerProtect Data Domain path traversal
    • Impact: Low-privileged remote attackers may access the filesystem.
    • Affected Systems: Same Dell release families as above.
    • Immediate Action: Block untrusted remote access to the appliance.
    • Mitigation: Upgrade and review file access logs.
  • CVE-2026-109384: IvyForms arbitrary file upload
    • Impact: Authenticated attackers can enable dangerous uploads and trigger RCE through public form submission.
    • Affected Systems: IvyForms up to 1.5.1.
    • Immediate Action: Remove dangerous extensions from form configs now.
    • Mitigation: Patch and audit published forms and uploads.
  • CVE-2026-92797: MemberPress CSRF profile change
    • Impact: Attackers can change user email addresses and drive account takeover.
    • Affected Systems: MemberPress up to 1.14.1.
    • Immediate Action: Force logout and require re-authentication for profile changes.
    • Mitigation: Update and confirm nonce enforcement.
  • CVE-2026-58255: Cronicle event injection to run jobs as root
    • Impact: Low-privileged users can run jobs as arbitrary users, including root.
    • Affected Systems: Cronicle prior to 0.9.121.
    • Immediate Action: Disable non-admin event creation and run permissions.
    • Mitigation: Upgrade and review job execution identities.
  • CVE-2014-125138: qEngine/Kemana/Cart Engine unrestricted upload
    • Impact: Editor users can upload PHP and execute code.
    • Affected Systems: qEngine CMS through 6.0.0; Kemana Directory through 1.5.6; Cart Engine through 3.0.0.
    • Immediate Action: Remove public access to image upload paths.
    • Mitigation: Upgrade or retire exposed installations.
  • CVE-2026-117607: Xerte language-pack RCE
    • Impact: Authenticated users with system permission can execute PHP via crafted language packs.
    • Affected Systems: Xerte Online Toolkits through 3.15.5.
    • Immediate Action: Restrict language pack imports.
    • Mitigation: Update and inspect uploaded ZIP contents.
  • CVE-2015-20129: CrushFTP CSRF admin actions
    • Impact: Attackers can create privileged users or change server settings if an admin is lured to a malicious page.
    • Affected Systems: CrushFTP before 7.3.0.
    • Immediate Action: Disable legacy instances or isolate them from the internet.
    • Mitigation: Upgrade and enable CSRF protections where possible.
  • CVE-2026-118378: Tabularis SQLite SQL injection
    • Impact: Attackers can read, modify, or drop SQLite data and bypass read-only controls.
    • Affected Systems: Tabularis before 0.28.0.
    • Immediate Action: Restrict MCP client input and disable untrusted tool use.
    • Mitigation: Upgrade and validate all table-name inputs.
  • CVE-2026-118374: LibreSSL OCSP memory exhaustion
    • Impact: Malicious OCSP responders can exhaust memory and break certificate checks.
    • Affected Systems: LibreSSL ocspcheck through 4.4.0.
    • Immediate Action: Limit exposure to untrusted OCSP traffic.
    • Mitigation: Upgrade and prefer trusted OCSP paths.
  • CVE-2026-117610: libexpat NULL dereference crash
    • Impact: Attackers can crash applications parsing crafted XML streams.
    • Affected Systems: libexpat through 2.9.0.
    • Immediate Action: Patch XML parsing services first.
    • Mitigation: Update libexpat and add parser input limits.
  • CVE-2026-58205: GRR reflected XSS
    • Impact: Attackers can run script in a victim’s browser and hijack sessions.
    • Affected Systems: GRR prior to 4.5.0.
    • Immediate Action: Remove leftover install files and block public access to them.
    • Mitigation: Upgrade and set auth cookies to HttpOnly where supported.
  • CVE-2026-15323: Lumise directory traversal
    • Impact: Attackers can read arbitrary files on the server.
    • Affected Systems: Lumise up to 2.1.2.
    • Immediate Action: Disable the cart endpoint if not needed.
    • Mitigation: Patch and review file disclosure exposure.
  • CVE-2026-104895: Async Smile parser memory exhaustion
    • Impact: A tiny payload can trigger huge allocations or crashes on async endpoints.
    • Affected Systems: Jackson Smile asynchronous parser implementations.
    • Immediate Action: Rate-limit and size-limit Smile inputs immediately.
    • Mitigation: Upgrade to a fixed release and enforce parser bounds.
  • CVE-2026-58257: GRR database restore file access
    • Impact: Admins can read or delete arbitrary files through crafted restore paths.
    • Affected Systems: GRR prior to 4.5.0.
    • Immediate Action: Restrict restore access and review admin activity.
    • Mitigation: Upgrade and validate restore paths.
  • CVE-2026-97019: AMP for WP stored XSS
    • Impact: Attackers can inject scripts that run when users view affected pages.
    • Affected Systems: AMP for WP up to 1.1.17.
    • Immediate Action: Disable untrusted shortcode entry points.
    • Mitigation: Update and audit posts and user profile content.
  • CVE-2026-110662: MxChat stored DOM XSS
    • Impact: A single unauthenticated POST can plant script for admin execution.
    • Affected Systems: MxChat up to 3.2.25.
    • Immediate Action: Turn off the transcripts page if possible and inspect stored feedback.
    • Mitigation: Patch and clear malicious stored content.
  • CVE-2026-109381: Mage Eventpress privilege escalation
    • Impact: Shop Managers may become administrators.
    • Affected Systems: Mage Eventpress up to 5.7.8.
    • Immediate Action: Review all Shop Manager accounts immediately.
    • Mitigation: Update and verify capability checks.
  • CVE-2026-111111: Prime Slider stored XSS
    • Impact: Attackers can inject script into pages viewed by others.
    • Affected Systems: Prime Slider up to 4.7.2.
    • Immediate Action: Disable public comment input on affected sliders.
    • Mitigation: Patch and sanitize stored content.
  • CVE-2026-111314: affiliate-toolkit stored XSS
    • Impact: Attackers can store script that runs in rendered product pages.
    • Affected Systems: affiliate-toolkit up to 3.9.2.
    • Immediate Action: Disable AJAX loading if not required and review product URLs.
    • Mitigation: Update and restrict who can edit product data.
  • CVE-2026-109999: AI Marketing Expert stored DOM XSS
    • Impact: Attackers can plant script through chatbot fields and target admins.
    • Affected Systems: AI Marketing Expert up to 1.2.8.
    • Immediate Action: Disable the chatbot module if exposed.
    • Mitigation: Patch and clear stored bot data.
  • CVE-2014-125137: qEngine/Kemana/Cart Engine local file inclusion
    • Impact: Authenticated admins can read local files.
    • Affected Systems: qEngine CMS through 6.0.0; Kemana Directory through 1.5.6; Cart Engine through 3.0.0.
    • Immediate Action: Remove admin access from untrusted users.
    • Mitigation: Upgrade and review file inclusion controls.
  • CVE-2013-20008: Linksys WAG200G password change weakness
    • Impact: Attackers can change the admin password and take persistent control.
    • Affected Systems: Linksys WAG200G through 1.01.06.
    • Immediate Action: Isolate or replace this legacy device now.
    • Mitigation: Apply vendor guidance if available; otherwise retire the device.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first, especially Dell PowerProtect, WordPress plugins, Jackson-based services, and any exposed file upload or auth endpoints.
  2. Disable vulnerable features if patching is not immediate: social login, public uploads, language imports, chatbot/transcript features, and admin restore tools.
  3. Rotate credentials for admin accounts, API keys, X/Twitter integrations, and any systems that may have been exposed.
  4. Verify exposure by checking public endpoints, plugin versions, package manifests, and management interfaces against the affected ranges.
  5. Search for compromise by reviewing web server logs, new admin users, unexpected template changes, suspicious uploads, and outbound connections from affected hosts.

Verification steps: confirm patched versions are deployed, compare running builds to vendor advisories, and check for any files created or modified in upload, template, or config directories during the last 30 days.

Monitoring recommendations: alert on new PHP files, unexpected POSTs to admin-ajax and REST routes, privilege changes, failed logins followed by success, and unusual traffic from management appliances.

Related Resources

  • Internal blog posts: to be published — incident response checklist for WordPress plugin exploitation and appliance compromise.
  • Official vendor advisories: Dell PowerProtect Data Domain / Management Center, WordPress plugin changelogs, Jackson databind security advisories, llama.cpp release notes, LibreSSL and libexpat project advisories.

Keep reading