# CVEs published 2026-11-14

65 CVEs were published on November 14, 2026: 11 critical, 10 high. 1 early warning was posted. Days are UTC.
## Early warnings

- [SZB-0b4026fb85](https://cve.now/SZB-0b4026fb85): Cursor confirms breach that let hackers push malicious Claude Code extension

## CVEs

- [CVE-2026-129353](https://cve.now/CVE-2026-129353.md): D-Link DIR-600L unauthenticated stack overflow in authentication.cgi (CVSS 10.0, D-Link DIR-600L)
- [CVE-2026-129352](https://cve.now/CVE-2026-129352.md): TRENDnet TEW-657BRM stack overflow in upgrade\_flash.cgi (CVSS 9.4, TRENDnet TEW-657BRM)
- [CVE-2026-129351](https://cve.now/CVE-2026-129351.md): TRENDnet TEW-657BRM remote memory corruption in mini\_httpd (CVSS 10.0, TRENDnet TEW-657BRM)
- [CVE-2015-10149](https://cve.now/CVE-2015-10149.md): Dancer path traversal and injection via session cookie IDs (no CVSS, Dancer)
- [CVE-2026-129456](https://cve.now/CVE-2026-129456.md): FRRouting remote use-after-free in bgpd tunnel encapsulation (CVSS 7.7, frrouting)
- [CVE-2026-129447](https://cve.now/CVE-2026-129447.md): Kroki reflected XSS in DBML SVG endpoint (CVSS 5.3, yuzutech kroki)
- [CVE-2026-129267](https://cve.now/CVE-2026-129267.md): XBackBone cross-site scripting in MediaController getRawById (CVSS 5.1, sergix44 XBackBone)
- [CVE-2026-129264](https://cve.now/CVE-2026-129264.md): sox\_ng out-of-bounds write in VOC decoder read\_samples\_voc (CVSS 5.1, sox\_ng)
- [CVE-2026-129262](https://cve.now/CVE-2026-129262.md): Wubang Five-in-One Safety Production Management Information System unauthenticated file upload in DiyFileUpload (CVSS 6.9, Wuxi Wubang Security Software Wubang Five-in-One Safety Pro…)
- [CVE-2026-129261](https://cve.now/CVE-2026-129261.md): Kingston FURY CTRL RGB Control Software local system takeover via NTIOLib\_X64.sys IOCTL (CVSS 9.3, Kingston FURY CTRL RGB Control Software)
- [CVE-2026-129260](https://cve.now/CVE-2026-129260.md): VanBlog file read via path traversal in custom page handler (CVSS 5.1, Mereithhh VanBlog)
- [CVE-2026-116753](https://cve.now/CVE-2026-116753.md): Ninjateam Multi Step for Contact Form 7 stored XSS in multipart field name parameter (CVSS 7.2, ninjateam Multi Step for Contact Form)
- [CVE-2026-127115](https://cve.now/CVE-2026-127115.md): BuddyForms stored XSS in login form shortcode attribute (CVSS 5.4, themekraft BuddyForms)
- [CVE-2026-120687](https://cve.now/CVE-2026-120687.md): Lightbox & Modal Popup WordPress Plugin FooBox unauthenticated stored XSS in image alt attributes (CVSS 7.2, fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox)
- [CVE-2026-110531](https://cve.now/CVE-2026-110531.md): FV Player stored XSS in popup shortcode attribute (CVSS 6.4, foliovision FV Player)
- [CVE-2026-129259](https://cve.now/CVE-2026-129259.md): VanBlog cross-site scripting in image upload endpoint (CVSS 5.1, Mereithhh VanBlog)
- [CVE-2026-129258](https://cve.now/CVE-2026-129258.md): Tenda AC18 unverified firmware install in upgrade handler (CVSS 9.4, Tenda AC18)
- [CVE-2011-10042](https://cve.now/CVE-2011-10042.md): HTTP Session command injection in memcached session store (no CVSS, http-session)
- [CVE-2026-19907](https://cve.now/CVE-2026-19907.md): Shipo authentication bypass in login cookie verification (CVSS 9.8, Shipo)
- [CVE-2026-18053](https://cve.now/CVE-2026-18053.md): LearnDash MemberDash account takeover via IDOR in profile editing (CVSS 8.8, LearnDash MemberDash)
- [CVE-2026-120522](https://cve.now/CVE-2026-120522.md): Cloud Storage Manager for Fluent Forms path traversal file write via Google Drive filenames (CVSS 9.8, fluentwiz Cloud Storage Manager for Fluent Forms – Google D…)
- [CVE-2025-71464](https://cve.now/CVE-2025-71464.md): Angular Editor cross-site scripting in toggleEditorMode() source view (CVSS 5.3, kolkov angular-editor)
- [CVE-2025-71465](https://cve.now/CVE-2025-71465.md): Angular Editor cross-site scripting in refreshView() (CVSS 5.3, kolkov angular-editor)
- [CVE-2026-129428](https://cve.now/CVE-2026-129428.md): Pulse remote authorization bypass in AI assistant approval API (CVSS 5.3, rcourtman Pulse)
- [CVE-2026-129429](https://cve.now/CVE-2026-129429.md): india-payroll unauthorized payroll data access in tax regime selector (CVSS 7.1, frappe india-payroll)
- [CVE-2026-129430](https://cve.now/CVE-2026-129430.md): filesharing stored XSS in bundle description markdown links (CVSS 5.1, axeloz filesharing)
- [CVE-2026-129431](https://cve.now/CVE-2026-129431.md): Ettercap out-of-bounds heap read in SOCKS5 dissector (CVSS 7.1, ettercap)
- [CVE-2026-129432](https://cve.now/CVE-2026-129432.md): Ettercap out-of-bounds heap read in NFS mountd dissector (CVSS 7.1, ettercap)
- [CVE-2026-129433](https://cve.now/CVE-2026-129433.md): Dokploy command injection in compose backup serviceName (CVSS 9.4, dokploy)
- [CVE-2026-129255](https://cve.now/CVE-2026-129255.md): CoolerMaster MASTERPLUS+ local privilege escalation in WinRing0x64.sys driver (CVSS 9.3, CoolerMaster MASTERPLUS+)
- [CVE-2026-129254](https://cve.now/CVE-2026-129254.md): Opixido OCMS cross-site scripting via img parameter in admin TUI (CVSS 5.3, Opixido OCMS)
- [CVE-2026-129115](https://cve.now/CVE-2026-129115.md): JSON-XS freed memory read in FREEZE encoding (no CVSS, JSON-XS)
- [CVE-2026-129114](https://cve.now/CVE-2026-129114.md): JSON-XS heap buffer overflow in incremental parser (no CVSS, JSON-XS)
- [CVE-2026-129113](https://cve.now/CVE-2026-129113.md): JSON-XS denial of service via underflow in incremental parser (no CVSS, JSON-XS)
- [CVE-2026-124541](https://cve.now/CVE-2026-124541.md): JSON-XS memory leak in decode\_str on rejected long strings (no CVSS, JSON-XS)
- [CVE-2026-124540](https://cve.now/CVE-2026-124540.md): JSON-XS denial of service via stack exhaustion in decode\_tag (no CVSS, JSON-XS)
- [CVE-2026-124539](https://cve.now/CVE-2026-124539.md): JSON-XS memory leak in decode\_hv for malformed objects (no CVSS, JSON-XS)
- [CVE-2026-124536](https://cve.now/CVE-2026-124536.md): JSON-XS memory exhaustion in incremental parser (no CVSS, JSON-XS)
- [CVE-2026-129251](https://cve.now/CVE-2026-129251.md): CloudSchool cross-site scripting in event description handler (CVSS 4.8, hrshadhin CloudSchool)
- [CVE-2026-129250](https://cve.now/CVE-2026-129250.md): Edimax BR6478ACV2 buffer overflow in formPPTPSetup web handler (CVSS 9.4, Edimax BR6478ACV2)
- [CVE-2026-129427](https://cve.now/CVE-2026-129427.md): Cervantes stored XSS in avatar upload enables account takeover (CVSS 8.7, CervantesSec cervantes)
- [CVE-2026-129248](https://cve.now/CVE-2026-129248.md): Akaunting validation bypass in invoice item quantity checks (CVSS 5.3, Akaunting)
- [CVE-2026-129247](https://cve.now/CVE-2026-129247.md): RuoYi path traversal in code generator file name handling (CVSS 5.1, yangzongzhuan RuoYi)
- [CVE-2026-18742](https://cve.now/CVE-2026-18742.md): UX-themes Flatsome stored XSS in custom HTML block attributes (CVSS 6.4, UX-themes Flatsome)
- [CVE-2026-129181](https://cve.now/CVE-2026-129181.md): Visitor Management System unauthenticated SQL injection in login endpoint (CVSS 6.9, projectworlds Visitor Management System)
- [CVE-2026-129319](https://cve.now/CVE-2026-129319.md): Create ECDH private key recovery in elliptic curve key agreement (CVSS 8.2, browserify create-ecdh)
- [CVE-2026-126697](https://cve.now/CVE-2026-126697.md): Quick Page/Post Redirect Plugin backdoor via hidden off-repository update channel (no CVSS, Quick Page/Post Redirect Plugin)
- [CVE-2026-126640](https://cve.now/CVE-2026-126640.md): WP Ultimate CSV Importer authenticated SQL injection in LifterLMS import (no CVSS, WP Ultimate CSV Importer)
- [CVE-2026-126639](https://cve.now/CVE-2026-126639.md): WP Ultimate CSV Importer unauthenticated post data disclosure via export files (no CVSS, WP Ultimate CSV Importer)
- [CVE-2026-124649](https://cve.now/CVE-2026-124649.md): Lightbox with PhotoSwipe stored XSS in image captions via comment link titles (no CVSS, Lightbox with PhotoSwipe)
- [CVE-2026-123122](https://cve.now/CVE-2026-123122.md): Checkout Files Upload for WooCommerce stored XSS in checkout file upload (no CVSS, Checkout Files Upload for WooCommerce)
- [CVE-2026-123046](https://cve.now/CVE-2026-123046.md): SEOJuice admin account creation via CSRF in REST API filter (no CVSS, SEOJuice)
- [CVE-2026-119258](https://cve.now/CVE-2026-119258.md): Swipe authentication bypass in login flow allows admin takeover (no CVSS, Swipe)
- [CVE-2026-118183](https://cve.now/CVE-2026-118183.md): Duplicate Post publishing restriction bypass in post duplication (no CVSS, Duplicate Post)
- [CVE-2026-118182](https://cve.now/CVE-2026-118182.md): Duplicate Post authenticated slug takeover of any readable post (no CVSS, Duplicate Post)
- [CVE-2026-118181](https://cve.now/CVE-2026-118181.md): Duplicate Post access control bypass in plugin settings (no CVSS, Duplicate Post)
- [CVE-2026-117490](https://cve.now/CVE-2026-117490.md): Flatsome authorization bypass in ux\_builder\_save AJAX action (no CVSS, Flatsome)
- [CVE-2026-117487](https://cve.now/CVE-2026-117487.md): Flatsome unauthenticated access to unpublished posts via AJAX (no CVSS, Flatsome)
- [CVE-2026-116528](https://cve.now/CVE-2026-116528.md): Chargely Free Subscriptions For Woocommernce credential disclosure in REST settings endpoint (no CVSS, Chargely Free Subscriptions For Woocommernce)
- [CVE-2026-105984](https://cve.now/CVE-2026-105984.md): Email Marketing 4Dem unauthenticated data deletion in AJAX actions (no CVSS, Email Marketing 4Dem)
- [CVE-2026-105983](https://cve.now/CVE-2026-105983.md): Email Marketing 4Dem unauthenticated settings change in WordPress AJAX routes (no CVSS, Email Marketing 4Dem)
- [CVE-2026-111034](https://cve.now/CVE-2026-111034.md): Countdown, Coming Soon, Maintenance post title disclosure in select2Ajax AJAX action (no CVSS, Countdown, Coming Soon, Maintenance)
- [CVE-2026-111033](https://cve.now/CVE-2026-111033.md): Countdown, Coming Soon, Maintenance stored XSS in savePost countdown data (no CVSS, Countdown, Coming Soon, Maintenance)
- [CVE-2026-124969](https://cve.now/CVE-2026-124969.md): Optimole Optimize Images arbitrary file deletion via deserialization in comments (CVSS 7.1, Optimole – Optimize Images | Convert WebP & AVIF | CDN & La…)
- [CVE-2026-126173](https://cve.now/CVE-2026-126173.md): AutomatorWP Webhooks unauthenticated password reset in webhook handler (CVSS 9.8, AutomatorWP Webhooks)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-11-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.