15 vulnerabilities across 11 products scored HIGH or above on September 09, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 14

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-48273 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.1 → 15.1 (CRITICAL → CRITICAL). Originally in 2026-09-08 bulletin.
  • [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin.
  • [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 13.4 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin.

🔴 [CRITICAL] parse-community/parse-server

1 CVE | CVSS 4.0: 9.1 | AAS 12.0

  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (< 8.6.88)
  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (>= 9.0.0, < 9.10.1-alpha.7)

Parse Server — CRITICAL LDAP Authentication Bypass

Parse Server by parse-community is affected by one critical vulnerability (CVE-2026-87806, CVSS 9.1). The LDAP authentication adapter in versions through 8.6.87 and 9.0.0 through 9.10.1-alpha.6 fails to verify that a client-supplied password is non-empty before forwarding it to the directory server. An attacker can submit a zero-length credential, triggering an unauthenticated LDAP simple bind per RFC 4513, which the adapter incorrectly accepts as valid authentication. This vulnerability is considered exploitable. Any organization using Parse Server with the built-in LDAP authentication adapter should treat this as an urgent priority. Upgrade to a patched release immediately and review the vendor advisory at the link above for remediation details.

Vendor Advisory

🟠 [HIGH] checkpoint/quantum_security_gateway

2 CVEs | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*

Check Point Quantum Security Gateway — HIGH Severity VPN Processing Vulnerabilities

Check Point Quantum Security Gateway and Quantum Security Management are affected by 2 vulnerabilities (CVSS 9.8), including at least one heap-based buffer overflow in VPN certificate ASN.1 decoding that allows an unauthenticated remote attacker to execute arbitrary code. These vulnerabilities are considered exploitable and require no authentication, making them especially dangerous for internet-facing deployments. Organizations running Check Point Quantum Security Gateway or Security Management appliances should apply vendor-provided patches immediately and consult the advisory at the link above for affected versions and hotfix details.

Vendor Advisory

🟠 [HIGH] open-webui/open-webui

3 CVEs | CVSS 3.1: 8.7 | AAS 10.5

  • cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*

Open WebUI — HIGH Severity Account Takeover and Related Vulnerabilities

Open WebUI, a self-hosted AI platform, is affected by 3 vulnerabilities (CVSS 8.7), including at least one sandbox escape in the terminal port preview component that allows an authenticated attacker to achieve full account takeover. Versions 0.8.11 through 0.11.0 render terminal port content in an iframe sandbox with both allow-scripts and allow-same-origin, enabling malicious script hosted on a previewed port to execute in the Open WebUI origin context and hijack a victim’s session. Organizations running self-hosted Open WebUI instances should upgrade to version 0.11.1 or later immediately and review the vendor advisory at the link above for details on all three vulnerabilities.

Vendor Advisory

🟠 [HIGH] mantisbt/mantisbt

1 CVE | CVSS 4.0: 9.3 | AAS 10.3

  • cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

MantisBT — HIGH Severity SOAP API Authentication Bypass

MantisBT versions 2.28.3 and earlier are affected by a critical authentication bypass vulnerability (CVE-2026-47156, CVSS 9.3) in the SOAP API’s login function. An attacker who knows any valid session cookie string can authenticate as any other user, including the administrator, without knowing the target’s password. This is exploitable with zero prior access on default installations because self-registration is enabled by default, allowing an attacker to create an account, obtain their own cookie string, and then impersonate any user via the API. Organizations running MantisBT should apply the vendor patch immediately, and if patching is not possible, consider disabling the SOAP API or restricting self-registration as interim mitigations.

Vendor Advisory

🟠 [HIGH] videolan/vlc_media_player

1 CVE | CVSS 4.0: 8.6 | AAS 9.7

  • cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*

VLC Media Player — HIGH Severity Integer Overflow in Picture Buffer Allocation

VLC media player is affected by one vulnerability (CVE-2026-56711, CVSS 8.6) involving a 32-bit integer overflow in the picture buffer allocation routine. When computing buffer sizes in AllocatePicture, plane dimension fields are multiplied using 32-bit arithmetic that can wrap before being widened to a 64-bit accumulator, bypassing the existing overflow check and resulting in a critically undersized heap allocation. This vulnerability is considered exploitable and could be triggered by opening a crafted media file. Organizations and end users running VLC should monitor the VideoLAN project repository for a patched release and avoid opening untrusted media files until a fix is available.

Vendor Advisory

🟠 [HIGH] newfold/wp_plugin_web

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:newfold:wp_plugin_web:*:*:*:*:*:*:*:*

Newfold WordPress Plugin (wp-module-data) — HIGH Severity Authentication Bypass

Several Newfold WordPress plugins that bundle the wp-module-data module are affected by one authentication bypass vulnerability (CVE-2026-80099, CVSS 8.8). The module’s authentication method, which runs on every unauthenticated REST API request, performs a token comparison that collapses to a predictable value when the stored auth token is unset, allowing an attacker to forge a valid Bearer token and gain full authenticated access to the WordPress REST API. This is considered exploitable and affects any WordPress site running a Newfold plugin that includes the vulnerable module. Site administrators should update all Newfold plugins to versions incorporating the patched wp-module-data module immediately, and review site activity logs for signs of unauthorized REST API access.

Vendor Advisory

🟠 [HIGH] luben/zstd-jni

1 CVE | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:luben:zstd-jni:*:*:*:*:*:*:*:* (< 1.5.7-14)

zstd-jni — HIGH Severity Out-of-Bounds Memory Read

zstd-jni versions before 1.5.7-14 are affected by one vulnerability (CVE-2026-87823, CVSS 8.8) involving improper 32-bit signed bounds checks on native methods that handle direct ByteBuffer frame-size operations. An attacker can supply crafted negative or overflowing offset values to trigger out-of-bounds memory reads, potentially causing JVM termination or extracting data from unintended memory locations. This is considered exploitable and impacts any Java application using the zstd-jni library for Zstandard compression. Teams should upgrade zstd-jni to version 1.5.7-14 or later and audit dependent applications for exposure to untrusted compressed input.

Vendor Advisory

🟠 [HIGH] tdunning/t-digest

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:tdunning:t-digest:*:*:*:*:*:*:*:*

t-digest — HIGH Severity Deserialization Denial of Service

t-digest versions 3.1 through 3.3 are affected by one vulnerability (CVE-2026-87822, CVSS 8.7) caused by missing validation of centroid mean values during deserialization. An attacker can craft a malicious serialized digest containing NaN centroids that bypass validation checks and degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays and effective denial of service during merge operations. This is considered exploitable and affects any application that deserializes t-digest data from untrusted sources, which is common in distributed analytics and streaming aggregation pipelines. Teams should upgrade to a patched version, monitor the vendor repository for a fix, and ensure that untrusted serialized digest input is not processed without validation.

Vendor Advisory

🟠 [HIGH] pmmp/pocketmine-mp

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:pmmp:pocketmine-mp:*:*:*:*:*:*:*:* (< 5.41.1)

PocketMine-MP — HIGH Severity Denial of Service via LoginPacket

PocketMine-MP versions before 5.41.1 are affected by one denial of service vulnerability (CVE-2026-86201, CVSS 8.7) in LoginPacket processing. An attacker can send crafted LoginPackets containing deeply nested or oversized object structures in unknown clientData JWT properties, which are logged without sanitization, triggering out-of-memory conditions that crash the server. This is considered exploitable by any unauthenticated remote client connecting to an affected server. Administrators running PocketMine-MP Minecraft Bedrock servers should upgrade to version 5.41.1 or later immediately to mitigate this risk.

Vendor Advisory

🟠 [HIGH] gitpython-developers/gitpython

2 CVEs | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:gitpython-developers:gitpython:*:*:*:*:*:*:*:* (< 3.1.60)

GitPython — HIGH Severity Regular Expression Denial of Service

GitPython versions before 3.1.60 are affected by 2 vulnerabilities (CVSS 8.7), including at least one regular expression denial of service in the Actor.name_email_regex pattern used to parse commit author and committer fields. An attacker can craft a commit object with a malformed author field containing an unterminated angle bracket, causing quadratic regex backtracking that exhausts CPU resources for over two minutes per commit access. These vulnerabilities are considered exploitable and impact any application or CI/CD pipeline that uses GitPython to process untrusted repositories or commit data. Teams should upgrade to GitPython 3.1.60 or later and review the vendor advisory for full details on both issues.

Vendor Advisory

🟠 [HIGH] pglombardo/passwordpusher

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:pglombardo:passwordpusher:*:*:*:*:*:*:*:*

PasswordPusher — HIGH Severity View Limit Bypass via Race Condition

PasswordPusher versions before 2.11.1 are affected by one vulnerability (CVE-2026-87816, CVSS 8.7) involving a time-of-check-to-time-of-use race condition in view limit enforcement. An unauthenticated attacker can send concurrent requests to the secret show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires, effectively defeating the expire_after_views protection that is fundamental to the application’s security model. This is considered exploitable and undermines the core guarantee of secret-sharing workflows. Organizations using PasswordPusher for sharing credentials or sensitive data should upgrade to version 2.11.1 or later immediately and consider rotating any secrets that were shared through affected instances.

Vendor Advisory