Security Digest: November 6, 2026 - 26 Critical Vulnerabilities

Today’s alert is severe: 26 critical and high-severity vulnerabilities affect WordPress plugins, machine-learning platforms, identity tools, and enterprise software. Several issues allow unauthenticated takeover, privilege escalation, stored XSS, SQL injection, SSRF, and pipeline abuse that could cross tenant boundaries.

· 15 min read

Executive Summary

Today’s alert is severe: 26 critical and high-severity vulnerabilities affect WordPress plugins, machine-learning platforms, identity tools, and enterprise software. Several issues allow unauthenticated takeover, privilege escalation, stored XSS, SQL injection, SSRF, and pipeline abuse that could cross tenant boundaries.

Act now: prioritize exposed internet-facing systems, apply vendor patches immediately, and disable or isolate affected features until updates are confirmed. If you run Kubeflow, WordPress plugins listed below, or PowerSYSTEM Center, treat this as a same-day remediation event.

Critical Vulnerabilities

  • CVE-2026-119516: Radius Booking object injection
    • Impact: Attackers may trigger object injection through untrusted deserialization.
    • Affected Systems: Radius Booking — Booking Calendar for Appointments & Services through 1.0.20.
    • Immediate Action: Remove or disable the plugin until patched.
    • Mitigation: Upgrade to a fixed release as soon as the vendor publishes one; restrict access to the admin panel in the meantime.
  • CVE-2026-120844: miniOrange OAuth SSO privilege escalation
    • Impact: Low-privilege users may gain elevated access.
    • Affected Systems: OAuth Single Sign On – SSO (OAuth Client) through 7.1.3.
    • Immediate Action: Patch immediately and review all recent role changes.
    • Mitigation: Upgrade to a fixed version; audit OAuth app assignments and admin accounts.
  • CVE-2026-77596: Kubeflow Pipelines authorization bypass
    • Impact: Tenant isolation can be bypassed; attackers may inject pipeline versions into shared pipelines.
    • Affected Systems: Kubeflow Pipelines prior to 2.18.0.
    • Immediate Action: Upgrade now and restrict direct API exposure.
    • Mitigation: Update to 2.18.0; ensure an authenticating proxy protects the API server.
  • CVE-2026-63017: PowerSYSTEM Center authorization flaw
    • Impact: Authenticated low-privilege users can access admin-only resources.
    • Affected Systems: PowerSYSTEM Center.
    • Immediate Action: Block non-admin access paths and patch immediately.
    • Mitigation: Apply vendor fixes; review all privilege assignments and access logs.
  • CVE-2026-63774: PowerSYSTEM Center SQL command injection
    • Impact: Attackers may execute unauthorized SQL commands.
    • Affected Systems: PowerSYSTEM Center report designer.
    • Immediate Action: Disable report designer access for non-essential users.
    • Mitigation: Patch immediately; inspect database activity for suspicious queries.
  • CVE-2026-88800: MDJM role deletion without authorization
    • Impact: Unauthenticated attackers can delete roles, including administrator.
    • Affected Systems: MDJM Event Management and Mobile Events Manager through 1.7.8.7.
    • Immediate Action: Disable the plugin now on any public site.
    • Mitigation: Upgrade when fixed; restore role integrity and verify admin access.
  • CVE-2026-113663: AG2 command injection via sandbox shell tool
    • Impact: Attacker-influenced commands can execute arbitrary shell statements.
    • Affected Systems: AG2 0.13.2 through 1.1.0; autogen 0.13.2 through 0.14.1.
    • Immediate Action: Stop using ShellSandbox configurations that pass user-influenced commands.
    • Mitigation: Upgrade to ag2 1.1.1; review agent prompts and shell execution policies.
  • CVE-2026-123087: SIREC SQL injection
    • Impact: Attackers may alter queries and extract unexpected data.
    • Affected Systems: Atmira SIREC.
    • Immediate Action: Patch and monitor database error logs.
    • Mitigation: Use the vendor fix; validate all JSON-derived fields before query use.
  • CVE-2026-121823: armeria path normalization bypass
    • Impact: Unauthenticated attackers may bypass path-based access controls.
    • Affected Systems: armeria prior to 1.43.0.
    • Immediate Action: Upgrade immediately and review any route-based protections.
    • Mitigation: Move to 1.43.0 or later; re-test all protected endpoints.
  • CVE-2026-119432: Foxit Workspace stored XSS
    • Impact: Crafted shared files can execute script in a victim’s session.
    • Affected Systems: Foxit Workspace file share preview.
    • Immediate Action: Restrict file sharing and preview features until patched.
    • Mitigation: Apply vendor updates; reset exposed credentials if abuse is suspected.
  • CVE-2025-71458: FTS3 Web Monitoring SQL injection
    • Impact: Attackers can read cloud storage credentials and secrets.
    • Affected Systems: fts-monitoring 3.12.0 through 3.13.2 and 3.14.0.
    • Immediate Action: Take /linkinfo offline or restrict it immediately.
    • Mitigation: Patch and rotate any exposed cloud credentials.
  • CVE-2026-88981: Kubeflow artifact SSRF/data exfiltration
    • Impact: Attackers can make the UI fetch arbitrary reachable hosts and return data.
    • Affected Systems: Kubeflow Pipelines prior to 2.18.0, especially standalone auth-disabled deployments.
    • Immediate Action: Upgrade and isolate the UI from internal networks.
    • Mitigation: Update to 2.18.0; enforce endpoint allowlists.
  • CVE-2026-88980: Kubeflow internal resource fetch
    • Impact: Attackers may retrieve internal HTTP responses and possibly metadata-derived data.
    • Affected Systems: Kubeflow Pipelines prior to 2.18.0.
    • Immediate Action: Patch immediately and restrict outbound access from the UI.
    • Mitigation: Upgrade to 2.18.0; tighten artifact URL validation.
  • CVE-2026-33379: Grafana snapshot authorization bypass
    • Impact: Any role, including Viewer, can create, publish, and delete snapshots.
    • Affected Systems: Grafana OSS and Enterprise 12.4.
    • Immediate Action: Upgrade if you run 12.4; audit public snapshot exposure.
    • Mitigation: Move off 12.4; review snapshot permissions and sharing settings.
  • CVE-2026-88801: MDJM stored XSS via role creation
    • Impact: Authenticated users can inject script that runs in admin pages.
    • Affected Systems: MDJM Event Management and Mobile Events Manager through 1.7.8.7.
    • Immediate Action: Disable the plugin or restrict authoring rights immediately.
    • Mitigation: Upgrade when available; inspect admin sessions for compromise.
  • CVE-2026-119431: Foxit Workspace SSRF in file upload
    • Impact: Attackers can force server-side requests to internal resources.
    • Affected Systems: Foxit Workspace file-upload functionality.
    • Immediate Action: Limit upload features and block internal destination access.
    • Mitigation: Patch; monitor for unexpected internal connection attempts.
  • CVE-2026-119433: Foxit Workspace undocumented SSRF
    • Impact: Remote attackers can probe internal or external resources through the server.
    • Affected Systems: Undocumented Foxit Workspace API endpoint.
    • Immediate Action: Restrict access to undocumented endpoints now.
    • Mitigation: Apply vendor fixes and enforce network egress controls.
  • CVE-2026-77299: Regexp2 memory exhaustion
    • Impact: Small malicious patterns can trigger massive memory use and crash processes.
    • Affected Systems: regexp2 prior to 2.3.0.
    • Immediate Action: Upgrade immediately where user-supplied patterns are accepted.
    • Mitigation: Move to 2.3.0; add input limits and isolate regex processing.
  • CVE-2026-19877: INFINITT ULite weak image-share passwords
    • Impact: Attackers can brute-force share passwords and access medical images.
    • Affected Systems: ULite 5.0.2.1_BN48_20260528 and earlier.
    • Immediate Action: Upgrade and rotate any share credentials.
    • Mitigation: Update to ULite 5.0.2.1 BN50; shorten link lifetime where possible.
  • CVE-2026-116592: undici cache poisoning / response confusion
    • Impact: Cached responses may be poisoned or served to the wrong user.
    • Affected Systems: undici 7.30.1 and 8.12.2 through 8.12.3.
    • Immediate Action: Upgrade all Node.js services using shared caching and redirects.
    • Mitigation: Move to 7.30.2 or 8.12.4+; disable shared caching on redirectable requests.
  • CVE-2026-87964: CTX Feed PHP code injection
    • Impact: Authenticated attackers with Shop Manager access can execute PHP code.
    • Affected Systems: Product Feed Manager for WooCommerce through 8.0.26.
    • Immediate Action: Disable the plugin or restrict Shop Manager access now.
    • Mitigation: Patch immediately; verify the eval path is no longer reachable.
  • CVE-2026-88984: Kubeflow shared-pipeline modification bypass
    • Impact: Authenticated users can modify or delete shared pipeline definitions.
    • Affected Systems: Kubeflow Pipelines prior to 2.16.1.
    • Immediate Action: Upgrade and review shared pipeline integrity.
    • Mitigation: Update to 2.16.1; confirm RBAC is enforced for shared pipelines.
  • CVE-2026-110291: Graphina stored XSS
    • Impact: Unauthenticated attackers can inject scripts into chart pages.
    • Affected Systems: Graphina through 3.1.13.
    • Immediate Action: Disable affected chart inputs until patched.
    • Mitigation: Upgrade and purge malicious chart data.
  • CVE-2026-110776: MDTF stored XSS
    • Impact: Unauthenticated attackers can execute scripts on pages using the shortcode.
    • Affected Systems: MDTF through 1.4.1.
    • Immediate Action: Remove the shortcode from public pages if possible.
    • Mitigation: Patch and review affected posts for injected content.
  • CVE-2026-39744: WCFM Membership stored XSS
    • Impact: Stored scripts can execute in user browsers.
    • Affected Systems: WCFM Membership through 2.12.0.
    • Immediate Action: Update the plugin and inspect member-submitted content.
    • Mitigation: Apply vendor fixes and sanitize stored fields.
  • CVE-2026-119488: Pie Register stored XSS
    • Impact: Stored scripts may run in visitor or admin sessions.
    • Affected Systems: Pie Register through 3.8.4.15.
    • Immediate Action: Patch now and review registration fields.
    • Mitigation: Upgrade and clear any malicious registrations or profile data.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first, especially WordPress plugins, Kubeflow, Grafana 12.4, Foxit Workspace, PowerSYSTEM Center, and Node.js services using undici.
  2. Disable risky features until fixes land: file previews, uploads, shared pipeline editing, undocumented APIs, and shared snapshot publishing.
  3. Review admin and service accounts for unexpected privilege changes, new roles, or suspicious pipeline and plugin activity.
  4. Rotate secrets if any SQL injection, SSRF, or credential exposure is confirmed or suspected.
  5. Validate versions now with package inventories and plugin lists; confirm you are not running the affected releases.

Verification: Check deployed versions against the ranges above, confirm external exposure of affected endpoints, and review logs for unusual uploads, redirects, SQL errors, role deletions, and pipeline modifications.

Monitoring: Watch for admin logins from unfamiliar IPs, new WordPress roles, unexpected outbound requests, abnormal database queries, and repeated requests to upload, preview, or redirect endpoints.

Related Resources

  • Internal coverage: Add a follow-up internal blog post on today’s highest-risk WordPress, Kubeflow, and Foxit issues.
  • Official vendor advisories: Monitor vendor security advisories for fixed versions, rollback guidance, and any emergency mitigations.

Keep reading