15 vulnerabilities across 11 products scored HIGH or above on September 09, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 14

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-85046 (google/chrome) — F1: exploitable → functional, AAS: 10.6 → 12.6 (HIGH → CRITICAL). Originally in 2026-09-03 bulletin.
  • [UPGRADED] CVE-2026-20212 (cisco/cisco_nx-os_software) — F1: theoretical → poc, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-02 bulletin.

🔴 [CRITICAL] parse-community/parse-server

1 CVE | CVSS 4.0: 9.1 | AAS 12.0

  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (< 8.6.88)
  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (>= 9.0.0, < 9.10.1-alpha.7)

Parse Server — CRITICAL — 1 CVE

Parse Server versions 8.6.87 and earlier, as well as 9.0.0 through 9.10.1-alpha.6, contain a critical authentication bypass in the built-in LDAP authentication adapter (CVE-2026-87806, CVSS 9.1). The adapter fails to verify that a client has actually supplied a password before forwarding it to the LDAP directory, and treats any non-error response as successful authentication. An attacker can submit an empty password to trigger an unauthenticated LDAP bind per RFC 4513, bypassing authentication entirely without valid credentials.

Organizations running Parse Server with LDAP authentication enabled should treat this as an immediate priority. Upgrade to a patched version as soon as one is available, and consult the vendor advisory at the link above for specific remediation guidance. As an interim measure, consider disabling the LDAP authentication adapter or enforcing minimum password length validation at the application layer until the fix is applied.

Vendor Advisory

🟠 [HIGH] checkpoint/quantum_security_gateway

2 CVEs | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:*

Check Point Quantum Security Gateway — HIGH — 2 CVEs

Check Point Quantum Security Gateway and Quantum Security Management are affected by 2 vulnerabilities, including at least one critical heap-based buffer overflow in VPN certificate ASN.1 decoding (CVSS 9.8). An unauthenticated remote attacker can exploit this flaw to execute arbitrary code on affected systems, requiring no user interaction or prior access. Given that these devices typically sit at the network perimeter handling VPN traffic, the exposure is significant.

Network and security teams running Check Point Quantum Security Gateway or Security Management appliances should apply vendor-provided hotfixes immediately. Consult the vendor advisory at the link above for affected versions and patching instructions. Where immediate patching is not feasible, consider restricting VPN access to trusted sources and monitoring for anomalous certificate-related traffic as a temporary mitigation.

Vendor Advisory

🟠 [HIGH] open-webui/open-webui

3 CVEs | CVSS 3.1: 8.7 | AAS 10.5

  • cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:* (>= 0.8.11, < 0.11.1)
  • cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:* (>= 0.9.6, < 0.11.1)
  • cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:* (>= 0.6.41, < 0.11.1)

Open WebUI — HIGH — 3 CVEs

Open WebUI versions 0.8.11 through 0.11.0 are affected by 3 vulnerabilities, including multiple high-severity issues (CVSS 8.7). The lead vulnerability involves an insecure iframe sandbox configuration in the terminal port preview component, where the combination of allow-scripts and allow-same-origin permits an authenticated attacker with access to a shared terminal server to execute scripts under the Open WebUI origin, enabling full account takeover of any user who previews the malicious port.

Organizations self-hosting Open WebUI for internal AI platforms should upgrade to version 0.11.1 or later immediately. This is especially urgent in multi-user environments where terminal server access is shared, as exploitation requires only that a victim open a port preview. Review the referenced commit and vendor advisory for full details on all three fixes.

Vendor Advisory

🟠 [HIGH] mantisbt/mantisbt

1 CVE | CVSS 4.0: 9.3 | AAS 10.3

  • cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

MantisBT — HIGH — 1 CVE

MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API’s login function (CVE-2026-47156, CVSS 9.3). An attacker who knows any valid session cookie string can authenticate as any other user, including the administrator, without knowing the target’s password. This is exploitable with zero prior access on default installations because self-registration is enabled by default, allowing an attacker to create an account, obtain their own cookie string, and then impersonate any user on the system.

Any organization running MantisBT with the SOAP API enabled should treat this as an immediate priority. Apply the vendor-provided patch referenced in the commit above as soon as possible. As a temporary mitigation, consider disabling the SOAP API if it is not required, and disable self-registration if not actively needed to reduce the attack surface.

Vendor Advisory

🟠 [HIGH] videolan/vlc_media_player

1 CVE | CVSS 4.0: 8.6 | AAS 9.7

  • cpe:2.3:a:videolan:vlc_media_player:*:*:*:*:*:*:*:*

VLC Media Player — HIGH — 1 CVE

VLC media player contains a high-severity integer overflow vulnerability in its picture buffer allocation logic (CVE-2026-56711, CVSS 8.6). The flaw occurs in AllocatePicture where 32-bit arithmetic wraps before being widened to a 64-bit size value, causing a critically undersized heap allocation. An attacker can exploit this by crafting a malicious media file that triggers the overflow, potentially leading to arbitrary code execution when a user opens the file.

IT teams and endpoint administrators deploying VLC across their environments should monitor the VLC project for a patched release and upgrade as soon as one is available. Until a fix is applied, consider restricting the opening of media files from untrusted sources and advising users to exercise caution with files received externally. Review the vendor advisory at the VideoLAN GitHub repository for further updates.

Vendor Advisory

🟠 [HIGH] newfold/wp_plugin_web

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:newfold:wp_plugin_web:*:*:*:*:*:*:*:*

Newfold WordPress Plugin (Web) — HIGH — 1 CVE

Several Newfold WordPress plugins that bundle the wp-module-data module are affected by an authentication bypass vulnerability (CVE-2026-80099, CVSS 8.8). The flaw exists in the module’s REST API authentication filter, where the HMAC-style token comparison degenerates when the stored auth token returns false. PHP coerces the reversed false value to an empty string, collapsing the expected secret and allowing an attacker to craft a trivially predictable Bearer token that bypasses authentication for all REST API endpoints.

WordPress administrators running any Newfold plugin that includes the wp-module-data module should update immediately to a version incorporating the referenced commit fix. This vulnerability is particularly dangerous because it affects all unauthenticated REST API requests and can grant full administrative API access without valid credentials. Review installed plugins for Newfold branding or the bundled wp-module-data component, and consult the vendor advisory for specific affected plugin versions.

Vendor Advisory

🟠 [HIGH] luben/zstd-jni

1 CVE | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:luben:zstd-jni:*:*:*:*:*:*:*:* (< 1.5.7-14)

zstd-jni — HIGH — 1 CVE

zstd-jni versions before 1.5.7-14 contain an out-of-bounds memory read vulnerability in native methods that handle direct ByteBuffer frame-size operations (CVE-2026-87823, CVSS 8.8). The flaw stems from 32-bit signed bounds checks that fail to account for negative or overflowing offset values, allowing an attacker to supply crafted negative offsets near Integer.MIN_VALUE to read from unintended memory locations, potentially causing JVM termination or leaking sensitive data from process memory.

Development and platform teams using zstd-jni as a compression dependency should upgrade to version 1.5.7-14 or later immediately. This library is widely embedded in Java applications and data processing frameworks, so teams should audit their dependency trees for transitive inclusions. Consult the vendor repository at the link above for release details and further guidance.

Vendor Advisory

🟠 [HIGH] pglombardo/passwordpusher

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:pglombardo:passwordpusher:*:*:*:*:*:*:*:* (< 2.11.1)

PasswordPusher — HIGH — 1 CVE

PasswordPusher versions before 2.11.1 contain a time-of-check-to-time-of-use race condition in view limit enforcement (CVE-2026-87816, CVSS 8.7). An unauthenticated attacker can send concurrent requests to the secret viewing endpoint to access a one-time push multiple times before the view counter increments and the secret expires, effectively defeating the core security control that limits secret exposure.

Organizations using PasswordPusher to share sensitive credentials or secrets should upgrade to version 2.11.1 or later immediately. This vulnerability directly undermines the one-time viewing guarantee that is the primary security premise of the application, making any secret shared through an unpatched instance potentially accessible to an intercepting attacker beyond its intended view limit. Consult the vendor advisory at the link above for full details.

Vendor Advisory

🟠 [HIGH] pmmp/pocketmine-mp

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:pmmp:pocketmine-mp:*:*:*:*:*:*:*:* (< 5.41.1)

PocketMine-MP — HIGH — 1 CVE

PocketMine-MP versions before 5.41.1 contain a denial of service vulnerability in LoginPacket processing (CVE-2026-86201, CVSS 8.7). An attacker can send crafted LoginPackets containing deeply nested or oversized object structures in unknown clientData JWT properties, which are logged without sanitization, triggering excessive memory consumption and crashing the server with an out-of-memory condition.

Server operators running PocketMine-MP should upgrade to version 5.41.1 or later immediately, as this vulnerability can be exploited remotely by any unauthenticated client without prior access. Since the attack only requires sending a single malicious login packet, exposed servers are trivially disruptable. Review the referenced commit for patch details and consider network-level rate limiting on login traffic as a temporary mitigation.

Vendor Advisory

🟠 [HIGH] tdunning/t-digest

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:tdunning:t-digest:*:*:*:*:*:*:*:* (>= 3.1, < 3.4)

t-digest — HIGH — 1 CVE

t-digest versions 3.1 through 3.3 contain a deserialization vulnerability in MergingDigest.fromBytes that fails to validate centroid mean values (CVE-2026-87822, CVSS 8.7). An attacker can craft a malicious serialized digest containing NaN centroid values that bypass validation checks and degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays and potential denial of service during merge operations.

Development and platform teams using t-digest for quantile estimation or streaming analytics should upgrade beyond version 3.3 as soon as a patched release is available. This library is commonly embedded in data processing pipelines and analytics platforms, so teams should check dependency trees for transitive inclusions. Until a fix is applied, avoid deserializing t-digest structures from untrusted sources and consult the vendor repository at the link above for updates.

Vendor Advisory

🟠 [HIGH] gitpython-developers/gitpython

2 CVEs | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:gitpython-developers:gitpython:*:*:*:*:*:*:*:* (< 3.1.60)

GitPython — HIGH — 2 CVEs

GitPython versions before 3.1.60 are affected by 2 vulnerabilities, including multiple flaws related to insufficient validation of git directory locations (CVSS 8.7). An attacker can craft a malicious repository containing tracked files such as gitdir, commondir, and HEAD that impersonate the git directory structure, enabling arbitrary code execution via a poisoned pre-commit hook when a victim clones or opens the repository and calls index.commit().

Development teams and CI/CD pipeline operators using GitPython as a dependency should upgrade to version 3.1.60 or later immediately. This is especially critical in automated environments that clone or process untrusted repositories, as exploitation requires only that the victim open a crafted repository and perform a commit operation. Consult the vendor advisory at the link above for full details on both vulnerabilities and affected configurations.

Vendor Advisory