26 vulnerabilities across 12 products scored HIGH or above on September 11, 2026.

  • 🟠 HIGH: 26

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-48273 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.1 → 15.1 (CRITICAL → CRITICAL). Originally in 2026-09-08 bulletin.
  • [UPGRADED] CVE-2026-75650 (adobe/commerce) — F1: exploitable → itw, AAS: 14.1 → 17.1 (CRITICAL → EMERGENCY). Originally in 2026-09-07 bulletin.

🟠 [HIGH] designcomputer/mysql-mcp-server

1 CVE | CVSS 3.1: 10.0 | AAS 11.2

  • cpe:2.3:a:designcomputer:mysql-mcp-server:*:*:*:*:*:*:*:*

designcomputer mysql-mcp-server — Critical Remote Access Vulnerability

designcomputer’s mysql-mcp-server is affected by one critical vulnerability (CVE-2026-59971, CVSS 10.0) in which the SSE/HTTP transport mode fails to enable DNS-rebinding protection, CORS middleware, or any form of authentication, while binding to all network interfaces by default. This allows remote attackers to interact with the exposed MCP server without restriction, potentially leading to unauthorized database access. The default stdio transport mode is not affected.

Teams running mysql-mcp-server with MCP_TRANSPORT=sse should treat this as an urgent priority. Review the vendor advisory at the linked GitHub Security Advisory (GHSA-rqfv-2mw9-78g2), apply any available patches, and as an immediate mitigation ensure the service is not exposed on public interfaces and restrict network access to trusted hosts only.

Vendor Advisory

🟠 [HIGH] getsimplecms-ce/getsimplecms-ce

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:getsimplecms-ce:getsimplecms-ce:*:*:*:*:*:*:*:*

GetSimple CMS CE — Critical Unauthenticated Admin Account Creation

GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) are affected by one critical vulnerability (CVE-2026-53952, CVSS 9.8) that allows unauthenticated attackers to create a new administrator account. A logic flaw in the post-installation cleanup fails to remove the setup file, leaving it permanently accessible and enabling full administrative takeover without credentials.

Organizations running any affected version of GetSimple CMS or its Community Edition should treat this as an urgent priority. Review the vendor advisory at GHSA-rw2c-w4mg-46g4, upgrade to a patched release immediately, and verify that the admin/setup.php file has been removed from all deployed instances.

Vendor Advisory

🟠 [HIGH] authorizerdev/authorizer

1 CVE | CVSS 3.1: 9.3 | AAS 10.8

  • cpe:2.3:a:authorizerdev:authorizer:*:*:*:*:*:*:*:*

Authorizerdev Authorizer — Critical OAuth Redirect URI Validation Bypass

Authorizer versions prior to 2.2.1 are affected by one critical vulnerability (CVE-2026-54072, CVSS 9.3) in which the /authorize endpoint fails to validate the redirect_uri parameter against configured AllowedOrigins. When using implicit grant flows with response_type=token or id_token, an attacker can supply an arbitrary redirect URL to steal access tokens, ID tokens, and refresh tokens via a crafted authorization link, enabling full account takeover. A proof-of-concept exploit is publicly available.

Organizations self-hosting Authorizer for authentication should upgrade to version 2.2.1 or later immediately. Review the vendor advisory at GHSA-h29v-hj44-q8cv for full details, audit logs for suspicious authorization requests with unexpected redirect URIs, and consider rotating tokens for any users who may have been affected.

Vendor Advisory

🟠 [HIGH] gohugoio/hugo

2 CVEs | CVSS 4.0: 9.3 | AAS 10.7

  • cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:*

Hugo Static Site Generator — Critical Path Traversal via Symlinks

Hugo versions after v0.123.0 and before v0.165.0 are affected by two critical vulnerabilities (CVE-2026-89258 and CVE-2026-89259, max CVSS 9.3) involving symlink handling that bypasses path confinement. An attacker who can place a symlink inside a mounted directory, such as a vendored theme, can cause functions like resources.Get and os.ReadFile to follow the symlink and access files outside the intended project boundaries, potentially exposing sensitive data from the build environment.

Teams using Hugo for static site generation should upgrade to version 0.165.0 or later immediately. Review the vendor advisory at GHSA-vrv5-r5rf-6v4j, audit any third-party or vendored themes for unexpected symlinks, and treat untrusted theme content with caution until patched versions are deployed across all build pipelines.

Vendor Advisory

🟠 [HIGH] apache_software_foundation/apache_opennlp

1 CVE | CVSS 4.0: 10.0 | AAS 10.7

  • cpe:2.3:a:apache:apache_opennlp:*:*:*:*:*:*:*:*

Apache OpenNLP — Critical Regular Expression Denial of Service

Apache OpenNLP is affected by one critical vulnerability (CVE-2026-82617, CVSS 10.0) in which the built-in EMAIL and URL regex patterns exposed by RegexNameFinderFactory contain ambiguous nested quantifiers. Applications that use these default name finders to process untrusted text can be forced into super-linear backtracking or unbounded matcher recursion, resulting in denial of service through CPU exhaustion or stack overflow.

Teams using Apache OpenNLP’s RegexNameFinder with the default email or URL patterns against user-supplied input should review the vendor advisory on the Apache mailing list immediately. Apply any available patches or updated releases, and as an interim mitigation consider replacing the vulnerable default patterns with safe alternatives or adding input length limits before name-finder processing.

Vendor Advisory

🟠 [HIGH] headroomlabs-ai/headroom

1 CVE | CVSS 3.1: 8.8 | AAS 10.6

  • cpe:2.3:a:headroomlabs-ai:headroom:*:*:*:*:*:*:*:* (< 0.35.0)

Headroom AI — WebSocket Origin Validation Bypass Enabling Unauthorized LLM Access

Headroom versions prior to 0.35.0 are affected by one high-severity vulnerability (CVE-2026-71416, CVSS 8.8) in which the WebSocket server fails to validate the Origin header on incoming client connections. This allows a malicious WebSocket client, including one running in a headless browser, to bypass authentication and perform arbitrary requests against the upstream large language model, potentially enabling unauthorized data access or abuse of LLM resources.

Teams deploying Headroom for LLM data compression should upgrade to version 0.35.0 or later immediately. Review the vendor advisory at the linked GitHub release page, audit network access controls around the WebSocket endpoint, and monitor for any anomalous or unauthorized LLM request activity that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] wpeverest/everest_forms

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:wpeverest:everest_forms:*:*:*:*:*:*:*:*

WPEverest Everest Forms — Critical Unauthenticated PHP Object Injection

The Everest Forms WordPress plugin versions 3.6.0 and below are affected by one critical vulnerability (CVE-2026-62103, CVSS 9.8) that allows unauthenticated PHP object injection. Depending on the POP chains available in the WordPress installation, this can potentially be leveraged for remote code execution, file deletion, or other severe impacts without requiring any user credentials.

WordPress site administrators using Everest Forms should update to a patched version immediately. Review the vendor advisory on Patchstack for full details, audit sites for signs of compromise, and consider temporarily deactivating the plugin on any installations that cannot be updated right away.

Vendor Advisory

🟠 [HIGH] wwbn/avideo

7 CVEs | CVSS 4.0: 9.3 | AAS 10.5

  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

WWBN AVideo — Multiple Critical Vulnerabilities Including Stored XSS

WWBN AVideo is affected by seven vulnerabilities (including CVE-2026-89253, CVE-2026-89254, CVE-2026-89256, and others, max CVSS 9.3) spanning multiple attack vectors. The lead issue involves stored cross-site scripting through insufficient sanitization of the user donation link profile field, where inadequate URL validation and lack of proper output encoding allow injected JavaScript to execute in the context of other users’ sessions. Additional vulnerabilities in this set compound the overall risk to affected installations.

Organizations running AVideo should review the vendor advisory at GHSA-34jx-r3p9-7pp2 and apply all available patches immediately. Given the breadth of issues and exploitable nature of these flaws, administrators should audit their instances for signs of compromise, restrict untrusted user registration where possible, and prioritize updating to a release that addresses all seven vulnerabilities.

Vendor Advisory

🟠 [HIGH] mistralai/mistral-vibe

6 CVEs | CVSS 4.0: 10.0 | AAS 10.4

  • cpe:2.3:a:mistralai:mistral-vibe:*:*:*:*:*:*:*:* (>= 1.3.4)
  • cpe:2.3:a:mistralai:mistral-vibe:*:*:*:*:*:*:*:* (>= 2.6.0)

MistralAI Mistral Vibe — Multiple Critical Arbitrary Code Execution Vulnerabilities

Mistral Vibe is affected by six vulnerabilities (including CVE-2026-87985, CVE-2026-87983, CVE-2026-87988, and others, max CVSS 10.0) that enable arbitrary code execution through multiple bypass techniques. The lead issue involves ANSI-C quoted arguments that evade command permission checks, allowing crafted inputs to execute arbitrary code on the user’s system without approval. The breadth of these findings indicates systemic weaknesses in the command sandboxing and input validation mechanisms.

Teams using Mistral Vibe should treat this as an urgent priority and review the HiddenLayer security advisory immediately. Suspend use of affected versions until patches are available, restrict access to trusted users only, and monitor systems for any signs of unauthorized command execution that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] spip/spip

3 CVEs | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* (< 4.4.18)

SPIP CMS — Multiple Critical Vulnerabilities Including Remote Code Execution

SPIP versions before 4.4.18 are affected by three critical vulnerabilities (CVE-2026-72710, CVE-2026-72709, and CVE-2026-72708, max CVSS 9.3) including a remote code execution flaw in the editer_objet action. The lead issue allows attackers with a valid nonce to inject malicious rows into the spip_jobs table by exploiting unrestricted SQL table name resolution, leading to arbitrary PHP function execution when the cron job queue processes the crafted entries.

Organizations running SPIP should upgrade to version 4.4.18 or later immediately. Review the detailed technical analysis at the Lexfo advisory for indicators of compromise, audit cron job tables for suspicious entries, and ensure all SPIP instances are patched across production environments without delay.

Vendor Advisory

🟠 [HIGH] net-snmp/net-snmp

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:net-snmp:net-snmp:*:*:*:*:*:*:*:*

Net-SNMP — Denial of Service via SMUX Module Blocking Read

Net-SNMP versions through 5.9.5.2 are affected by one high-severity vulnerability (CVE-2026-89147, CVSS 8.7) in which the SMUX module performs an unauthenticated blocking read without a timeout on newly accepted connections. An unauthenticated remote attacker can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and halting all SNMP processing on the affected host.

Organizations using Net-SNMP with the SMUX module enabled should review the vendor advisory immediately and apply any available patches. As an interim mitigation, restrict network access to the SMUX listener port to trusted hosts only, and monitor for hung snmpd processes that may indicate active exploitation.

Vendor Advisory

🟠 [HIGH] dolibarr/dolibarr

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:* (>= 23.0.4, < 24.0.1)

Dolibarr ERP/CRM — Unauthenticated Arbitrary File Read via Authorization Bypass

Dolibarr versions 23.0.4 through those before 24.0.1 are affected by one high-severity vulnerability (CVE-2026-89013, CVSS 8.7) that allows unauthenticated attackers to read arbitrary files through the document storage endpoints. By supplying a crafted hashp parameter value, attackers can bypass token validation in document.php and viewimage.php, gaining access to application logs, uploaded business documents, database backups containing password hashes, and other sensitive files.

Organizations running affected versions of Dolibarr should upgrade to version 24.0.1 or later immediately. Review the referenced commit for patch details, audit access logs for suspicious requests to document.php or viewimage.php with unusual hashp values, and assess whether sensitive files such as database backups may have been exposed.

Vendor Advisory