3 vulnerabilities across 2 products scored HIGH or above on September 05, 2026.

  • 🟠 HIGH: 3

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin.

🟠 [HIGH] yeswiki/yeswiki

2 CVEs | CVSS 3.1: 9.4 | AAS 10.0

  • cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*

YesWiki — Multiple Critical Vulnerabilities

YesWiki, an open-source wiki system written in PHP, is affected by 2 vulnerabilities, including at least one rated CVSS 9.4 HIGH. The most severe issue allows any user with default write access to delete arbitrary wiki pages without authorization by exploiting the EraseSpamedCommentsAction component, which performs no access control checks. These vulnerabilities are considered exploitable and are particularly dangerous on default-configured installations where write access is open to all users.

Teams running YesWiki should upgrade to version 4.6.6 or later immediately. Organizations unable to patch should review and restrict default write ACLs and limit access to wiki actions as an interim mitigation. Refer to the vendor advisory and associated commits on GitHub for full remediation details.

Vendor Advisory

🟠 [HIGH] xmlsoft/libxml2

1 CVE | CVSS 3.1: 8.0 | AAS 9.3

  • cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* (< 2.15.4)

libxml2 — Stack-Based Buffer Overflow

libxml2, the widely used XML parsing library maintained by xmlsoft and distributed across virtually all Linux distributions, is affected by 1 vulnerability rated CVSS 8.0 HIGH. The flaw is a stack-based buffer overflow in the xmlSnprintfElements function within valid.c, triggered via strcat, and is considered exploitable. Given that libxml2 is a foundational dependency embedded in countless applications, web servers, and operating systems, this issue has a broad potential blast radius.

Teams should upgrade libxml2 to version 2.15.4 or later as soon as possible. System administrators should audit all systems and container images for bundled or statically linked copies of libxml2, as the library is frequently embedded in third-party software. Refer to the vendor commit on GitHub for technical details and patch information.

Vendor Advisory