Security Digest: November 9, 2026 - 18 Critical Vulnerabilities

Today’s advisory set is dominated by remote code execution, unauthenticated command execution, and auth bypass flaws across web apps, network appliances, and WordPress plugins. The highest-risk issues include a Python eval() exposure in otterdog, multiple SYSTEM-level RCEs in NEC WinShare, and publicly exploitable device vulnerabilities with proof-of-concept code already available.

· 12 min read

Urgent Security Digest: 18 Critical Vulnerabilities Demand Immediate Action

Executive Summary

Today’s advisory set is dominated by remote code execution, unauthenticated command execution, and auth bypass flaws across web apps, network appliances, and WordPress plugins. The highest-risk issues include a Python eval() exposure in otterdog, multiple SYSTEM-level RCEs in NEC WinShare, and publicly exploitable device vulnerabilities with proof-of-concept code already available.

Act now: patch exposed systems first, disable or restrict affected services where possible, and assume internet-facing instances of the most severe products are at immediate risk.

Critical Vulnerabilities

CVE-2026-123870: otterdog webhook eval() leads to unauthenticated Python execution

  • Impact: An attacker can send a crafted webhook and execute arbitrary Python on the host when the webhook secret is unset or empty.
  • Affected Systems: otterdog webapp deployments with GITHUB_WEBHOOK_SECRET unset or blank.
  • Immediate Action: Set a strong webhook secret immediately and block unauthenticated webhook access until patched.
  • Mitigation: Update to a fixed release as soon as available; remove any use of eval() in webhook handling.

CVE-2026-113363: NEC WebSAM WinShare packet flaw enables SYSTEM command execution

  • Impact: Remote unauthenticated attackers can execute arbitrary commands as SYSTEM.
  • Affected Systems: WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0, and Ver 7.7.0 through 7.7.2 on Windows.
  • Immediate Action: Isolate WinShare hosts from untrusted networks and prioritize emergency patching.
  • Mitigation: Apply vendor updates; if patching is delayed, restrict network exposure at the firewall and service level.

CVE-2026-124580: Feiyuxing VW2100/VEC10GP Weixin Auth Endpoint command injection

  • Impact: Remote attackers can inject OS commands; public exploit code is available.
  • Affected Systems: VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775.
  • Immediate Action: Treat as actively exploitable; disconnect internet exposure where possible.
  • Mitigation: Apply vendor remediation if issued; otherwise place behind strict access controls and monitor for compromise.

CVE-2026-113364: NEC WebSAM WinShare malformed packet buffer overflow

  • Impact: Remote unauthenticated code execution with SYSTEM privileges.
  • Affected Systems: WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0, and Ver 7.7.0 through 7.7.2 on Windows.
  • Immediate Action: Patch immediately and remove the service from exposed networks.
  • Mitigation: Apply the fixed version from NEC; use network segmentation until remediation is complete.

CVE-2026-119506: DynamiApps Frontend Admin privilege escalation

  • Impact: Attackers can gain higher privileges than intended inside WordPress.
  • Affected Systems: Frontend Admin by DynamiApps through 3.30.1.
  • Immediate Action: Update the plugin now and audit admin/user roles.
  • Mitigation: Remove unneeded privileged accounts and verify permission boundaries after upgrade.

CVE-2026-124577: Intelbras SG 2404 PoE improper authentication

  • Impact: Remote attackers can bypass authentication on the web management interface.
  • Affected Systems: SG 2404 PoE L2+ 1.00.70 and 1.00.72.
  • Immediate Action: Upgrade to 1.00.74 immediately.
  • Mitigation: Restrict management access until updated; do not expose the interface to the internet.

CVE-2026-92683: Neo4j GraphQL JWT filter bypass

  • Impact: An attacker with a valid JWT can bypass most filter conditions.
  • Affected Systems: @neo4j/graphql versions 7.0.0 through 7.6.6.
  • Immediate Action: Upgrade to 7.6.7 or later and review authorization logic.
  • Mitigation: Re-test all JWT-based access rules and assume affected queries may have been over-permissive.

CVE-2026-94249: Liderahenk missing authorization

  • Impact: Privilege abuse through missing authorization checks.
  • Affected Systems: Liderahenk before 2.0.3.
  • Immediate Action: Patch immediately and review access controls.
  • Mitigation: Enforce least privilege and validate all admin actions after upgrade.

CVE-2026-121760: weDocs access control bypass

  • Impact: Attackers can exploit incorrectly configured access control and reach restricted content or actions.
  • Affected Systems: weDocs through 2.6.1.
  • Immediate Action: Update the plugin and verify all documentation permissions.
  • Mitigation: Remove public access to sensitive doc workflows until patched.

CVE-2026-123484: JetFormBuilder DOM-based XSS

  • Impact: Attackers can run JavaScript in users’ browsers.
  • Affected Systems: JetFormBuilder through 3.6.8.
  • Immediate Action: Update immediately and inspect forms for unsafe input handling.
  • Mitigation: Apply escaping and content-security controls; review recent form changes.

CVE-2026-119504: Frontend Admin stored XSS

  • Impact: Malicious scripts can persist and execute for other users.
  • Affected Systems: Frontend Admin through 3.30.1.
  • Immediate Action: Patch now and review stored content for injected scripts.
  • Mitigation: Sanitize all user-supplied fields and invalidate suspicious sessions.

CVE-2026-111403: WP Inventory Manager reflected XSS

  • Impact: Attackers can steal sessions or manipulate pages via crafted links.
  • Affected Systems: WP Inventory Manager through 2.5.9.
  • Immediate Action: Update the plugin and warn users against untrusted links.
  • Mitigation: Filter request parameters and verify output encoding.

CVE-2026-54863: Review Schema reflected XSS

  • Impact: Browser-side code execution through malicious input.
  • Affected Systems: Review Schema through 3.1.4.
  • Immediate Action: Patch immediately and review exposed review endpoints.
  • Mitigation: Escape all rendered input and monitor for unusual request patterns.

CVE-2026-121764: FV Flowplayer stored XSS

  • Impact: Persistent script injection in WordPress pages.
  • Affected Systems: FV Flowplayer Video Player through 7.5.56.7212.
  • Immediate Action: Update the plugin and scan for malicious embedded content.
  • Mitigation: Restrict content editing rights and review plugin-generated HTML.

CVE-2026-123463: Checkout Files Upload for WooCommerce stored XSS

  • Impact: Stored XSS can compromise admin or shopper sessions; tags also indicate potential broader abuse.
  • Affected Systems: Checkout Files Upload for WooCommerce through 2.4.0.
  • Immediate Action: Patch now and inspect uploaded file metadata and saved fields.
  • Mitigation: Enforce strict file validation and output encoding.

CVE-2026-121780: Flying Images stored XSS

  • Impact: Malicious scripts can execute in victim browsers.
  • Affected Systems: Flying Images through 2.4.15.
  • Immediate Action: Upgrade immediately and audit recent media-related inputs.
  • Mitigation: Sanitize stored values and review admin access logs.

CVE-2026-119505: Welcart e-Commerce stored XSS

  • Impact: Persistent browser-side code execution in e-commerce workflows.
  • Affected Systems: Welcart e-Commerce through 2.12.6.
  • Immediate Action: Patch immediately and review checkout and account pages.
  • Mitigation: Remove suspicious content, rotate credentials if admin sessions were exposed, and validate templates.

CVE-2026-119483: Form Maker by 10Web stored XSS

  • Impact: Stored malicious script can affect visitors and administrators.
  • Affected Systems: Form Maker by 10Web through 1.15.50.
  • Immediate Action: Update now and review all saved form entries.
  • Mitigation: Apply strict input sanitization and output escaping across form rendering.

What to Do Now

  1. Patch the internet-facing systems first: NEC WinShare, otterdog, Intelbras management interfaces, and any exposed WordPress sites.
  2. Disable or restrict vulnerable services until updates are verified, especially remote management and webhook endpoints.
  3. Review logs for exploitation signs: unexpected commands, new admin sessions, suspicious webhook payloads, and unknown script injections.
  4. Rotate credentials and invalidate sessions if any affected admin, management, or customer-facing systems may have been exposed.

Verification: Confirm installed versions against the affected ranges below, then validate that fixes are deployed across production, staging, and any internet-facing replicas.

CVE-2026-113363 / 113364: NEC WebSAM WinShare 7.2.0-7.7.2
CVE-2026-124577: Intelbras SG 2404 PoE 1.00.70, 1.00.72
CVE-2026-92683: @neo4j/graphql 7.0.0-7.6.6
CVE-2026-123484: JetFormBuilder through 3.6.8
CVE-2026-119506 / 119504: Frontend Admin through 3.30.1

Monitoring: Watch for webshells, unexpected outbound connections, authentication anomalies, admin role changes, and repeated requests to webhook, upload, and form endpoints.

Related Resources

  • Internal blog post: Coming soon — detailed remediation guidance for today’s critical CVEs.
  • Official vendor advisories: NEC WebSAM WinShare, Intelbras SG 2404 PoE, Neo4j GraphQL, DynamiApps Frontend Admin, and WordPress plugin vendor security notices.

Keep reading