Critical Flaws in vm2, Veeam, and WordPress Plugins

Critical vulnerabilities in the vm2 Node.js sandbox library allow for sandbox escapes and arbitrary code execution. Versions 3.9.6 through 3.10.5 are affected by a mutable proxy vulnerability (CVE-2026-44005), while versions prior to 3.11.0 are susceptible to sandbox escapes using a host object (CVE-2026-43997). These flaws could enable attackers to compromise the underlying host system. As [The Hacker News] reports, these vulnerabilities are critical due to the nature of sandboxing environments, which are designed for security.

Veeam has disclosed a critical vulnerability (CVE-2026-64633) that allows for remote, unauthenticated code execution on agent hosts. While details are scarce, the potential for unauthenticated remote code execution is a significant concern for any environment utilizing Veeam agents. This vulnerability was highlighted in [Cyber Security News], underscoring the broad impact such a flaw could have across many organizations.

Several WordPress plugins are affected by critical vulnerabilities, including the Embed HTML5 Game plugin (CVE-2026-4357) which allows unauthenticated attackers to upload PHP backdoors. Additionally, the Divi Ajax Filter plugin (CVE-2026-11613) suffers from Local File Inclusion, and the JobSearch plugin (CVE-2026-84834) has unauthenticated PHP Object Injection. These flaws, as noted by [Vypr Intelligence], highlight ongoing security issues within the WordPress ecosystem, potentially impacting a vast number of websites.

A critical SQL injection vulnerability in IBM Operational Decision Manager (CVE-2026-18658) allows unauthenticated attackers to execute arbitrary SQL statements. This could lead to data breaches or system compromise. The vulnerability affects multiple versions of ODM, including 9.6.0.0, 9.5.0.0, 8.11.1.0, and others, underscoring the need for prompt patching.

Multiple critical vulnerabilities have been identified across various AI and framework platforms. SadTalker (CVE-2026-85696), TEN Framework (CVE-2026-85688), Getomni AI (CVE-2026-85672), Aimhubio (CVE-2026-85663), and Haris Musa (CVE-2026-85661) all contain critical OS command injection or arbitrary file read/write vulnerabilities. These flaws often stem from improper input sanitization, allowing attackers to execute commands or access sensitive files.

A critical vulnerability in D-Link DNS-340L (CVE-2026-85223) allows for manipulation of arguments in the dropbox.cgi component, potentially leading to unauthorized access or control. The vulnerability affects version 1.01B04 and is related to the callback_url and sync_interval parameters.

The Joomla Extension - miniorange.com OAuth Client (CVE-2026-77995) has a critical arbitrary account takeover vulnerability in versions prior to 3.2.0. By manipulating a cookie value, attackers can log in as any user, including administrators.

A critical Remote Code Execution (RCE) vulnerability exists in WGDashboard version 4.2.3 and earlier (CVE-2026-15733). This flaw allows authenticated attackers to execute arbitrary commands as root through OS command injection.

Versa Director (CVE-2024-42450) has a critical vulnerability related to its default PostgreSQL configuration, which uses a common password across all instances. This could allow unauthenticated attackers to access sensitive operational and configuration data.

Critical vulnerabilities were found in R2R through 3.6.6 (CVE-2026-82526), allowing unauthenticated attackers to execute arbitrary SQL statements via stacked SQL injection.

The Bricksforge plugin for WordPress (CVE-2026-84814) has a critical privilege escalation vulnerability in versions up to 3.1.8.8.

YITH Request a Quote for WooCommerce Premium (CVE-2026-84238) has an unauthenticated Broken Access Control vulnerability in versions prior to 4.46.0.

CAT (CVE-2026-85181) has a critical vulnerability where session cookies are not properly integrity checked, allowing attackers to forge valid session cookies and bypass IP binding validation.