العربية
🚨 BreakingFBI Warns Artex AI Tool Automates Hacks at Machine Speed

Critical CVEs: Synology, SharePoint, VS Code and Routers

Security World Teamاقرأ بالعربية

Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.

Illustration for Vulnerabilities & CVEs
Illustration by Security World

⚡ Why it matters

Critical flaws in widely used products such as Synology NAS devices, home routers and WordPress plugins are often exploited within days. This list helps you decide what to patch first.

Widely used products

  • Synology DSM (CVE-2026-76954): SQL injection in the Auth API lets a remote attacker read or write files and cause denial of service. Fixed in 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5 and 7.4.1-90080-1.
  • Microsoft SharePoint (CVE-2026-120002): incorrect authorization lets an authorized attacker elevate privileges over a network.
  • Visual Studio Code (CVE-2026-120779): code injection lets an unauthorized attacker execute code over a network.

Developer tools and servers

  • Dokploy (CVE-2026-129433): command injection before 0.31.1 lets an org member run commands as root during scheduled backups and take over the host via the Docker socket.
  • sysPass (CVE-2026-129110): 3.0.1 to 3.2.11 can be reinstalled without authentication, creating an admin and executing commands.
  • NginxPulse (CVE-2026-129171): unauthenticated SQL injection before 1.6.26.
  • NextScan (CVE-2026-126797): a hardcoded JWT key allows forging admin tokens.
  • FrankenPHP Docker images (CVE-2026-128027): before 1.1.11, images were not rebuilt with library fixes, leaving known flaws exploitable.
  • Replicate Cog (CVE-2026-56712): SSRF through 0.23.1 that can expose internal services.

WordPress plugins

  • AutomatorWP Pro (CVE-2026-126173): authorization bypass up to 1.4.4.
  • Cloud Storage Manager for Fluent Forms (CVE-2026-120522): arbitrary file write up to 1.2.0.
  • Shipo (CVE-2026-19907): authentication bypass in 1.6 through 1.8.0.

Network and physical security devices

  • D-Link DIR-600L, TRENDnet TEW-657BRM, Tenda AC18, Edimax BR6478ACV2 and Linksys EA8100 routers: buffer overflows and other bugs, some with public exploits.
  • PLANET GS-5220-8P2T2S switch before firmware 3.2412b261008.
  • RBH Integra32 access control: code execution as SYSTEM via TCP port 2001.

What to do

  1. Patch Synology, SharePoint and VS Code first.
  2. Update the listed WordPress plugins or remove them if unused.
  3. Old routers are often out of support: replace them and disable remote management.

🔗 Sources

CVESynology DSMSharePointVS CodeWordPressrouterscritical vulnerabilities

This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.

Related stories