Security Digest: November 5, 2026 - 38 Critical Vulnerabilities

Today’s advisory set is dominated by high-risk authentication bypasses, privilege escalations, and remote code execution paths across WordPress, Kubernetes policy tooling, and identity systems. If you run Kyverno, Pocket ID, GLPI, WordPress plugins, OPNsense, or exposed appliance/admin services, treat this as a same-day patch and containment event.

· 21 min read

Urgent Security Alert: 38 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s advisory set is dominated by high-risk authentication bypasses, privilege escalations, and remote code execution paths across WordPress, Kubernetes policy tooling, OIDC identity systems, and network-facing appliances. If you run Kyverno, Pocket ID, GLPI, WordPress plugins, OPNsense, or exposed appliance/admin services, treat this as a same-day patch and containment event.

Several of these flaws can lead to cluster takeover, administrator account creation, root-level command execution, or sensitive data exposure. Prioritize internet-facing systems first, then internal platforms that control identity, admission, or secrets.

Critical Vulnerabilities

  • CVE-2026-100109: Security For WooCommerce plugin admin account creation
    • Impact: Unauthenticated attackers can create administrator accounts and take over WordPress sites.
    • Affected Systems: Security For WooCommerce 1.0.10 through 1.0.16.
    • Immediate Action: Disable the plugin or remove public access to user-creation flows immediately.
    • Mitigation: Update to a fixed release as soon as available; review all admin users and rotate credentials.
  • CVE-2026-115770: Pocket ID email verification bypass
    • Impact: Attackers can mark an arbitrary email as verified and potentially hijack account matching in downstream apps.
    • Affected Systems: Pocket ID 2.2.0 through 2.11.x; fixed in 2.12.0.
    • Immediate Action: Upgrade to 2.12.0 now and audit accounts with recent email changes.
    • Mitigation: Temporarily disable self-service email editing if you cannot patch immediately.
  • CVE-2026-122313: Kyverno namespace escape via mutate policy target matching
    • Impact: Tenants can modify resources in other namespaces and alter cluster policy objects.
    • Affected Systems: Kyverno 1.17.0 through 1.19.1.
    • Immediate Action: Upgrade Kyverno to 1.19.2 immediately.
    • Mitigation: Restrict who can create NamespacedMutatingPolicy objects until patched.
  • CVE-2026-122311: Kyverno resource path traversal in CEL get/post
    • Impact: Namespace-scoped policies can read/write arbitrary cluster objects using Kyverno’s service account.
    • Affected Systems: Kyverno 1.16.0 through 1.19.1.
    • Immediate Action: Patch to 1.19.2 and review all namespaced CEL policies.
    • Mitigation: Remove untrusted policy authoring rights until fixed.
  • CVE-2026-122303: Kyverno cross-namespace overwrite via mutate-existing
    • Impact: Attackers can overwrite Secrets, Deployments, and policies outside their namespace.
    • Affected Systems: Kyverno 1.17.0 through 1.19.1.
    • Immediate Action: Upgrade to 1.19.2 and disable risky mutate-existing policies.
    • Mitigation: Audit background-controller activity for unexpected cross-namespace writes.
  • CVE-2026-123025: OPNsense os-acme-client command injection
    • Impact: Remote authenticated users can execute arbitrary commands as root.
    • Affected Systems: OPNsense os-acme-client through 4.17.
    • Immediate Action: Restrict certificate issuance/renewal access and patch immediately.
    • Mitigation: Treat exposed WebGUI/API access as high risk until updated.
  • CVE-2026-122304: Kyverno cleanup controller namespace escape
    • Impact: Namespace admins can read cross-namespace Secrets and modify webhook configurations.
    • Affected Systems: Kyverno 1.17.0 through 1.19.1.
    • Immediate Action: Upgrade to 1.19.2.
    • Mitigation: Review CleanupPolicy use and limit policy-authoring permissions.
  • CVE-2026-122310: Kyverno raw URL path execution bypass
    • Impact: Namespace users can reach cluster-scoped endpoints and gain cluster admin.
    • Affected Systems: Kyverno 1.19.1 before 1.19.2.
    • Immediate Action: Patch to 1.19.2 now.
    • Mitigation: Block untrusted policy creation until upgrade is complete.
  • CVE-2026-54384: VitaFit SNS login authentication bypass
    • Impact: Remote attackers can obtain full sessions for victim accounts.
    • Affected Systems: VitaFit cloud API before 2026-10-30.
    • Immediate Action: Disable SNS login flows or take the service offline until patched.
    • Mitigation: Force password resets and invalidate active sessions.
  • CVE-2026-122302: Kyverno generate-rule privilege escalation
    • Impact: Namespace admins can create resources beyond their RBAC and trigger cluster-wide generation.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Upgrade to 1.19.2 and review generate policies.
    • Mitigation: Restrict generate-rule authoring to trusted admins only.
  • CVE-2026-122051: Edimax BR-6208AC command injection
    • Impact: Remote attackers can run commands on affected routers.
    • Affected Systems: Edimax BR-6208AC 1.32.
    • Immediate Action: Remove exposure of the device to untrusted networks.
    • Mitigation: Replace unsupported hardware where possible; no vendor response is noted.
  • CVE-2026-52848: GLPI OTP verification bypass
    • Impact: Unauthenticated users can skip one-time-password checks and defeat 2FA.
    • Affected Systems: GLPI 11.0.0 through 11.0.7.
    • Immediate Action: Upgrade to 11.0.8 immediately.
    • Mitigation: Review login logs for abnormal successful logins.
  • CVE-2026-122992: DStarGateway integer underflow
    • Impact: Crafted input can crash or destabilize the gateway.
    • Affected Systems: G4KLX/F4FXL DStarGateway before 7b75de6.
    • Immediate Action: Patch to 7b75de6 or later.
    • Mitigation: Monitor for malformed RS-MS1A sender input.
  • CVE-2026-118193: GiveWP donor role privilege escalation
    • Impact: Authenticated GiveWP managers can assign elevated WordPress roles to donors.
    • Affected Systems: GiveWP up to 4.19.1.
    • Immediate Action: Restrict GiveWP Manager access and inspect donor role settings.
    • Mitigation: Update after vendor fix; remove imported JSON settings if suspicious.
  • CVE-2026-47678: GLPI SQL injection in dropdown endpoint
    • Impact: Authenticated attackers can inject SQL and access or alter database data.
    • Affected Systems: GLPI 9.4.0 through 10.0.25 and 11.0.0 through 11.0.7.
    • Immediate Action: Patch to 10.0.26 or 11.0.8.
    • Mitigation: Watch for unusual database queries from authenticated sessions.
  • CVE-2026-76892: tsParticles MCP server crash via malformed JSON
    • Impact: A single bad request can kill the Node.js process and take the service offline.
    • Affected Systems: @tsparticles/mcp-server before 4.3.1.
    • Immediate Action: Upgrade to 4.3.1 and restart affected services.
    • Mitigation: Put the service behind request filtering if immediate patching is delayed.
  • CVE-2026-122314: Kyverno policy engine crash via type assertion
    • Impact: Attackers can crash admission control and trigger policy bypass under fail-open settings.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Upgrade to 1.19.2 now.
    • Mitigation: Set failurePolicy to fail closed where operationally possible.
  • CVE-2026-122319: Kyverno In/NotIn operator crash
    • Impact: Malformed resource values can panic the policy engine and disrupt admission.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Patch immediately.
    • Mitigation: Limit who can submit resources into policy-controlled namespaces.
  • CVE-2026-123014: iTerm2 x-man-page argument injection
    • Impact: Crafted URLs can execute commands as the logged-in user.
    • Affected Systems: iTerm2 before 3.7.7beta2.
    • Immediate Action: Update iTerm2 and warn users not to open untrusted x-man-page links.
    • Mitigation: Monitor for suspicious pager launches.
  • CVE-2026-54381: VitaFit public storage bucket exposure
    • Impact: Unauthenticated attackers can list and download sensitive user files.
    • Affected Systems: VitaFit cloud API before 2026-10-30.
    • Immediate Action: Lock down bucket access immediately and rotate exposed credentials.
    • Mitigation: Review object access logs and notify affected users if required.
  • CVE-2026-122299: Dulwich commit parsing mismatch in Poetry
    • Impact: Attackers can make Poetry fetch a different tree than reviewers saw, enabling malicious code execution during builds.
    • Affected Systems: Dulwich before 1.2.20; Poetry 2.5.1 by default use case.
    • Immediate Action: Pin or disable Dulwich-based installs and update affected tooling.
    • Mitigation: Rebuild from trusted refs and inspect dependency checkout behavior.
  • CVE-2026-122316: Kyverno mutate-existing cross-namespace modification
    • Impact: Tenants can alter resources outside their namespace, including Pod Security labels.
    • Affected Systems: Kyverno 1.17.0 through 1.19.1.
    • Immediate Action: Upgrade to 1.19.2.
    • Mitigation: Audit NamespacedMutatingPolicy objects for cross-namespace targets.
  • CVE-2026-122308: Kyverno generate handler label spoofing
    • Impact: Users can trigger synchronized generate policies and clone sensitive Secrets.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Patch and review label-based generate flows.
    • Mitigation: Restrict create/update rights on ConfigMaps and related triggers.
  • CVE-2026-122320: Kyverno clone namespace disclosure
    • Impact: Namespaced policy authors can copy resources from other namespaces into their own.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Upgrade to 1.19.2.
    • Mitigation: Review clone and cloneList templates for tenant-controlled namespace values.
  • CVE-2026-123033: TrueNAS SCALE HA heartbeat auth bypass
    • Impact: Attackers on the same network segment can gain full admin API access and root command execution.
    • Affected Systems: TrueNAS SCALE before 25.10.8 and affected release trains.
    • Immediate Action: Isolate management networks and patch immediately.
    • Mitigation: Verify HA settings and restrict Layer-2 access to storage management interfaces.
  • CVE-2026-122312: Kyverno API call namespace isolation bypass
    • Impact: Users can reach cluster-scoped endpoints and read resources outside their namespace.
    • Affected Systems: Kyverno 1.19.1 before 1.19.2.
    • Immediate Action: Upgrade to 1.19.2.
    • Mitigation: Block policy creation by non-admin tenants until fixed.
  • CVE-2026-122305: Kyverno substitution loop denial of service
    • Impact: Attackers can hang the admission webhook with self-referential templates.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Patch and watch webhook latency.
    • Mitigation: Consider stricter resource admission controls during remediation.
  • CVE-2026-122306: Kyverno wildcard pattern DoS
    • Impact: Crafted policy patterns can pin CPU and cause admission timeouts.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Upgrade to 1.19.2.
    • Mitigation: Audit policies for complex wildcard match/exclude rules.
  • CVE-2026-122307: Kyverno policy exception bypass
    • Impact: Attackers can weaken generated admission policies and admit forbidden resources.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Patch immediately and review PolicyException permissions.
    • Mitigation: Disable untrusted exception creation paths.
  • CVE-2026-93389: LiteSpeed Cache WooCommerce data leak
    • Impact: Unauthenticated users can read other shoppers’ cart, checkout, and personal data.
    • Affected Systems: LiteSpeed Cache up to 7.9.1 with Cache REST enabled.
    • Immediate Action: Disable Cache REST now and purge caches.
    • Mitigation: Upgrade and invalidate exposed session artifacts.
  • CVE-2026-116617: Motors plugin file deletion
    • Impact: Authenticated users can delete other users’ uploaded images and media.
    • Affected Systems: Motors plugin up to 1.4.128.
    • Immediate Action: Patch and review profile-edit permissions.
    • Mitigation: Check uploads for missing or replaced media files.
  • CVE-2026-62662: Pocket ID audience claim abuse
    • Impact: Authenticated clients can mint tokens for unauthorized audiences and bypass service-to-service controls.
    • Affected Systems: Pocket ID 1.11.0 through 2.9.x; fixed in 2.10.0.
    • Immediate Action: Upgrade to 2.10.0 or later.
    • Mitigation: Verify resource servers enforce audience checks independently.
  • CVE-2026-76826: tsParticles release workflow command injection
    • Impact: Maintainers can be exposed to command execution during release builds.
    • Affected Systems: tsParticles 4.0.0 through 4.3.1 release workflow.
    • Immediate Action: Upgrade the release workflow to 4.3.2 and review CI permissions.
    • Mitigation: Treat release-note content as untrusted input.
  • CVE-2026-109408: vault-java-driver TLS verification disabled
    • Impact: Attackers on the network path can steal Vault tokens and secrets.
    • Affected Systems: io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3.
    • Immediate Action: Upgrade to 7.0.0 and verify TLS settings explicitly.
    • Mitigation: Do not rely on environment-variable defaults for certificate validation.
  • CVE-2026-122318: Kyverno image verification bypass
    • Impact: Malicious images can be admitted even when signer pinning is configured.
    • Affected Systems: Kyverno before 1.19.2.
    • Immediate Action: Upgrade to 1.19.2.
    • Mitigation: Re-check image policy enforcement after deployment.
  • CVE-2026-123012: Gogs Smart HTTP verb-check bypass
    • Impact: Pushes may be accepted when only read access should be allowed.
    • Affected Systems: Gogs 0.14.3.
    • Immediate Action: Restrict repository write access and patch as soon as available.
    • Mitigation: Review authorization rules for case-sensitive verb handling.
  • CVE-2026-109849: Hinemos password change privilege issue
    • Impact: Attackers with specific non-admin permissions can change an administrator password.
    • Affected Systems: Hinemos installations with exposed password-change API permissions.
    • Immediate Action: Revoke unnecessary API permissions immediately.
    • Mitigation: Audit admin account changes and reset credentials if abuse is suspected.
  • CVE-2026-54383: VitaFit excessive data exposure
    • Impact: Authenticated users can harvest sensitive profile and health data at scale.
    • Affected Systems: VitaFit cloud API before 2026-10-30.
    • Immediate Action: Restrict endpoint access and review data-minimization controls.
    • Mitigation: Check for bulk enumeration patterns in API logs.

What to Do Now

  1. Patch the highest-risk internet-facing systems first: Kyverno, Pocket ID, GLPI, WordPress plugins, OPNsense, TrueNAS SCALE, iTerm2, and any exposed appliance admin portals.
  2. Disable risky features temporarily: self-service account editing, public cache REST, untrusted policy authoring, and certificate issuance/renewal endpoints where feasible.
  3. Review privileged accounts and sessions: look for new WordPress admins, suspicious OIDC/email changes, unexpected Kubernetes policy objects, and abnormal login success after 2FA.
  4. Contain exposed services: restrict management interfaces to trusted networks and remove public exposure until fixes are deployed.
  5. Rotate secrets where compromise is plausible: WordPress admin credentials, Vault tokens, OIDC client secrets, API keys, and any credentials tied to affected services.

Verification steps:

  • Confirm installed versions against the affected ranges listed above.
  • Check for suspicious policy objects, new users, modified roles, and unexpected cross-namespace activity.
  • Inspect web and API logs for malformed JSON, unusual query strings, and repeated login or token requests.

Monitoring recommendations:

  • Alert on new admin creation, privilege changes, and policy/controller crashes.
  • Watch for spikes in webhook latency, admission failures, and Kubernetes controller restarts.
  • Track public cache hits for personalized pages and any unusual object downloads from storage buckets.

Related Resources

  • Internal: Refer to the upcoming internal incident-response brief and hardening checklist for Kubernetes policy engines and WordPress plugins.
  • Official vendor advisories: Kyverno, Pocket ID, GLPI, OPNsense, TrueNAS SCALE, iTerm2, LiteSpeed Cache, GiveWP, Gogs, and vendor security notices for VitaFit and Edimax.

Keep reading