20 vulnerabilities across 15 products scored HIGH or above on September 04, 2026.

  • 🟠 HIGH: 20

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin.

🟠 [HIGH] ibm/operational_decision_manager

1 CVE | CVSS 3.1: 9.8 | AAS 11.4

  • cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 8.11.0.1)
  • cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 8.12.0.1)
  • cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.0.0.1)
  • cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.5.0.0)
  • cpe:2.3:a:ibm:operational_decision_manager:*:*:*:*:*:*:*:* (>= 9.6.0.0)

IBM Operational Decision Manager versions 8.11.0.1 through 9.6.0.0 is affected by one critical vulnerability (CVE-2026-18658, CVSS 9.8) involving an unauthenticated SQL injection flaw that can be chained to achieve remote code execution via web shell deployment. Organizations using ODM for business rule automation should treat this as an urgent priority, as no authentication is required to exploit the issue and it provides full system compromise.

Administrators should apply the patches referenced in IBM’s advisory at https://www.ibm.com/support/pages/node/7286196 immediately, and review affected systems for indicators of compromise including unexpected files in the application web root and anomalous database queries.

Vendor Advisory

🟠 [HIGH] haris-musa/excel-mcp-server

1 CVE | CVSS 4.0: 9.3 | AAS 11.0

  • cpe:2.3:a:haris-musa:excel-mcp-server:*:*:*:*:*:*:*:*

The excel-mcp-server version 0.1.8, an MCP-based Excel file integration tool, is affected by one high-severity vulnerability (CVE-2026-85661, CVSS 9.3) that allows arbitrary file read and write when the EXCEL_FILES_PATH environment variable is not configured. In stdio mode without this path restriction, an attacker can supply crafted file paths to access or modify any file the server process can reach, potentially leading to data exfiltration or system compromise.

Teams running excel-mcp-server should immediately ensure the EXCEL_FILES_PATH variable is explicitly set to a restricted directory, and update to a patched version once available by monitoring the project repository at https://github.com/haris-musa/excel-mcp-server.

Vendor Advisory

🟠 [HIGH] freeipmi/freeipmi

5 CVEs | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:freeipmi:freeipmi:*:*:*:*:*:*:*:* (< 1.6.19)

FreeIPMI versions prior to 1.6.19 are affected by five vulnerabilities, including at least one critical stack-based buffer overflow (CVSS 9.8) in the ipmi-oem Dell system info handling code. These flaws could allow attackers to achieve remote code execution on systems running vulnerable FreeIPMI tools, making this a high priority for any organization using FreeIPMI for IPMI-based hardware management, particularly in data center and server environments.

Administrators should upgrade to FreeIPMI 1.6.19 or later immediately, available at https://ftp.gnu.org/gnu/freeipmi/, and review any exposed IPMI management interfaces for signs of unauthorized access.

Vendor Advisory

🟠 [HIGH] firecrawl/firecrawl-mcp-server

1 CVE | CVSS 4.0: 8.7 | AAS 10.8

  • cpe:2.3:a:firecrawl:firecrawl-mcp-server:*:*:*:*:*:*:*:*

The firecrawl-mcp-server version 3.20.2, an MCP integration for the Firecrawl web scraping service, is affected by one high-severity arbitrary file read vulnerability (CVE-2026-85606, CVSS 8.7) in its firecrawl_parse tool. The flaw allows attackers to use path traversal or absolute paths to read sensitive local files such as credentials and environment variables, which are then exposed through the model context.

Teams using firecrawl-mcp-server should check for an updated version at https://github.com/firecrawl/firecrawl-mcp-server and, until patched, restrict access to the MCP server and audit any environments where it runs for potential credential exposure.

Vendor Advisory

🟠 [HIGH] lm-sys/fastchat

1 CVE | CVSS 4.0: 9.3 | AAS 10.7

  • cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*

FastChat, the open-source LLM serving platform by LM-SYS, is affected by one high-severity authentication bypass vulnerability (CVE-2026-85695, CVSS 9.3) in its /register_worker endpoint that allows unauthenticated attackers to register rogue worker nodes. Exploitation enables interception of user prompts, images, and model responses by hijacking model names, as well as server-side request forgery to probe internal network infrastructure across the worker mesh.

Organizations deploying FastChat for LLM inference should immediately restrict network access to the controller’s /register_worker endpoint, monitor for unauthorized worker registrations, and watch the project repository at https://github.com/lm-sys/FastChat for a security patch.

Vendor Advisory

🟠 [HIGH] nangohq/nango

1 CVE | CVSS 4.0: 9.2 | AAS 10.5

  • cpe:2.3:a:nangohq:nango:*:*:*:*:*:*:*:*

Nango, an open-source integration platform, versions prior to 0.71.6 are affected by one high-severity missing authentication vulnerability (CVE-2026-9317, CVSS 9.2) in the runner tRPC server. Attackers with network access to the runner port can invoke the exposed start procedure without any credentials, bypassing the unenforced RUNNER_SECRET_KEY, to achieve remote code execution within the runner process.

Organizations using Nango should upgrade to version 0.71.6 or later immediately, and ensure the runner port is not exposed to untrusted networks. The fix is available at https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2.

Vendor Advisory

🟠 [HIGH] canva/canva

2 CVEs | CVSS 3.1: 9.6 | AAS 10.4

  • cpe:2.3:a:canva:canva:*:*:*:*:*:*:*:* (< 2.376.0)

The Canva Android application prior to version 2.376.0 is affected by two high-severity vulnerabilities, including at least one (CVE-2026-85085, CVSS 9.6) that allows external origins to be loaded in a privileged WebView, enabling attackers who control a loaded page to interact with Canva using the victim’s authenticated session. Organizations with managed mobile device fleets or BYOD policies where Canva is widely used should prioritize this update, as exploitation could lead to unauthorized access to user accounts and design assets.

Ensure the Canva Android app is updated to version 2.376.0 or later across all devices, and review the vendor advisory at https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a for additional details.

Vendor Advisory

🟠 [HIGH] opentalker/sadtalker

1 CVE | CVSS 4.0: 9.3 | AAS 10.2

  • cpe:2.3:a:opentalker:sadtalker:*:*:*:*:*:*:*:*

SadTalker, an open-source AI-driven talking face generation tool, is affected by one high-severity OS command injection vulnerability (CVE-2026-85696, CVSS 9.3) in its video muxing process. Attackers can upload audio files with crafted filenames containing shell metacharacters that are interpolated unsanitized into ffmpeg commands, resulting in arbitrary system command execution during video generation.

Organizations or researchers running SadTalker, particularly any publicly accessible instances, should restrict access immediately and monitor the project repository at https://github.com/OpenTalker/SadTalker for a security patch. Any deployment accepting user-uploaded audio files should be considered at risk of full system compromise.

Vendor Advisory

🟠 [HIGH] getomni-ai/zerox

1 CVE | CVSS 4.0: 9.3 | AAS 10.2

  • cpe:2.3:a:getomni-ai:zerox:*:*:*:*:*:*:*:*

Zerox version 1.1.20, an AI-powered document processing tool, is affected by one high-severity OS command injection vulnerability (CVE-2026-85672, CVSS 9.3) in its file download mechanism. Attackers can craft document URLs with malicious file extensions containing command substitution syntax, which is passed unsanitized to poppler shell commands, enabling arbitrary OS command execution before document processing begins.

Teams using zerox to process external or user-supplied document URLs should treat this as critical, as exploitation leads to full system compromise. Monitor the project repository at https://github.com/getomni-ai/zerox for a patched release and restrict untrusted URL input in the interim.

Vendor Advisory

🟠 [HIGH] datalab-to/marker

1 CVE | CVSS 4.0: 8.8 | AAS 10.2

  • cpe:2.3:a:datalab-to:marker:*:*:*:*:*:*:*:*

Marker versions through 2.0.0, a document-to-markdown conversion tool, is affected by one high-severity path traversal vulnerability (CVE-2026-85684, CVSS 8.8) in the FastAPI /marker/upload handler. Unauthenticated attackers can supply crafted filenames with directory traversal sequences to write arbitrary files to any location on the system or delete existing files, potentially achieving remote code execution.

Teams running Marker with the API server exposed should restrict access immediately and monitor the project repository at https://github.com/datalab-to/marker for a patched release. Any internet-facing deployment should be considered at high risk of compromise.

Vendor Advisory

🟠 [HIGH] hiyouga/llamafactory

1 CVE | CVSS 4.0: 8.7 | AAS 10.1

  • cpe:2.3:a:hiyouga:llamafactory:*:*:*:*:*:*:*:*

LLaMA-Factory, a popular open-source LLM fine-tuning framework, is affected by one high-severity server-side request forgery vulnerability (CVE-2026-85673, CVSS 8.7) in its OpenAI-compatible API multimodal media URL handler. The SSRF validation can be bypassed via HTTP redirects or DNS rebinding because URL re-resolution after redirect is not re-validated, allowing unauthenticated attackers to access internal network resources and cloud metadata endpoints.

Organizations running LLaMA-Factory with the API server exposed should restrict network access to the service immediately and monitor the project repository at https://github.com/hiyouga/LlamaFactory for a security fix. Cloud deployments are at particular risk due to potential metadata service credential theft.

Vendor Advisory

🟠 [HIGH] aaif-goose/goose

1 CVE | CVSS 4.0: 8.7 | AAS 10.1

  • cpe:2.3:a:aaif-goose:goose:*:*:*:*:*:*:*:*

Goose version 1.37.0, an open-source AI agent framework, is affected by one high-severity arbitrary command execution vulnerability (CVE-2026-85623, CVSS 8.7) where malicious recipes can execute shell commands via stdio extensions and retry.checks configurations that bypass the built-in recipe security scan. Attackers can distribute crafted recipes that run arbitrary commands with the privileges of the user running goose, making anyone who imports untrusted recipes vulnerable to full system compromise.

Users of goose should avoid loading recipes from untrusted sources, monitor the project repository at https://github.com/aaif-goose/goose for a patched release, and audit any previously imported third-party recipes for suspicious extension or retry configurations.

Vendor Advisory

🟠 [HIGH] agentscope-ai/agentscope

1 CVE | CVSS 4.0: 8.7 | AAS 10.1

  • cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*

AgentScope versions through 2.0.7.post1, a multi-agent application framework, is affected by one high-severity path traversal vulnerability (CVE-2026-85685, CVSS 8.7) in the LocalWorkspace.add_skill function. Attackers can supply arbitrary directory paths via the skill_path parameter to copy sensitive server directories into the agent workspace, where they become accessible through the skill listing interface, leading to potential exposure of credentials, configuration files, and other sensitive data.

Teams running AgentScope should restrict network access to the service and monitor the project repository at https://github.com/agentscope-ai/agentscope for a patched release. Any deployment accepting untrusted input to workspace management endpoints should be considered at risk.

Vendor Advisory

🟠 [HIGH] traefik/traefik

1 CVE | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*

Traefik versions prior to v2.11.55 are affected by one critical authentication bypass vulnerability (CVE-2026-85595, CVSS 9.3) in the digestAuth middleware. Unknown usernames are assigned an empty secret instead of being rejected, allowing attackers to compute a valid digest response with arbitrary credentials and bypass authentication on any digestAuth-protected route without needing a valid account.

Organizations using Traefik with digestAuth middleware should upgrade to version 2.11.55 or later immediately, as all protected routes are trivially bypassable. Review the security advisory at https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c for full details and audit access logs for unauthorized requests to protected endpoints.

Vendor Advisory

🟠 [HIGH] asus/control_center_enterprise_(acc)

1 CVE | CVSS 4.0: 10.0 | AAS 9.8

  • cpe:2.3:a:asus:control_center_enterprise_acc:*:*:*:*:*:*:*:* (< 1.0.64.0)

ASUS Control Center Enterprise (ACC) is affected by one critical vulnerability (CVE-2026-75754, CVSS 10.0) combining missing authentication, server-side request forgery, and hard-coded credentials that allows an unauthenticated attacker to retrieve an encryption key via HTTP, enable SSH on port 2222, and log in with built-in credentials to obtain a root shell. Exploitation grants full read, write, and delete access to the ACC platform and remote control of all managed servers, PCs, and workstations across the environment.

Organizations using ASUS Control Center Enterprise should treat this as an emergency, apply patches from https://www.asus.com/security-advisory immediately, and block external access to ACC management interfaces. Any exposed deployment should be investigated for compromise given the trivial exploitation path.

Vendor Advisory