10 vulnerabilities across 3 products scored HIGH or above on September 11, 2026.

  • 🟠 HIGH: 10

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-48273 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.1 → 15.1 (CRITICAL → CRITICAL). Originally in 2026-09-08 bulletin.
  • [UPGRADED] CVE-2026-75650 (adobe/commerce) — F1: exploitable → itw, AAS: 14.1 → 17.1 (CRITICAL → EMERGENCY). Originally in 2026-09-07 bulletin.

🟠 [HIGH] gohugoio/hugo

2 CVEs | CVSS 4.0: 9.3 | AAS 10.7

  • cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:* (>= 0.161.0)
  • cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:* (>= 0.123.0, < 0.165.0)

Hugo, the popular static site generator by gohugoio, is affected by two high-severity vulnerabilities (CVE-2026-89259 and CVE-2026-89258) with a CVSS 4.0 score of 9.3. These flaws allow Node-based tools invoked during Hugo builds, particularly TailwindCSS, to bypass the intended permission model restrictions introduced in earlier security fixes. An attacker who can influence build inputs, such as through a malicious theme or template, could exploit these issues to read and write arbitrary files outside the project directory during the build process.

Teams using Hugo v0.161.0 or later with Node-based tooling such as TailwindCSS in their build pipelines should treat this as a priority update. CI/CD environments and shared build infrastructure are especially at risk. Review the vendor advisory at the link above, upgrade to the patched Hugo release as soon as it is available, and audit any third-party themes or modules used in your build configurations.

Vendor Advisory

🟠 [HIGH] wwbn/avideo

7 CVEs | CVSS 4.0: 9.3 | AAS 10.5

  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

AVideo, the open-source video platform by WWBN, is affected by seven vulnerabilities including multiple with a CVSS 4.0 score of 9.3. Among these are stored cross-site scripting flaws, such as one in the YPTWallet plugin where attacker-controlled input is rendered unsanitized in administrator views, enabling full administrative session hijack through same-origin requests. The remaining CVEs cover additional injection and input validation issues across the platform.

Organizations self-hosting AVideo instances should treat this as a high-priority remediation. Apply the latest patches from the WWBN GitHub repository immediately, review the vendor advisory linked above for each CVE, and audit any internet-facing deployments for signs of exploitation. Until patched, consider restricting access to administrative panels and disabling affected plugins where feasible.

Vendor Advisory

🟠 [HIGH] net-snmp/net-snmp

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:net-snmp:net-snmp:*:*:*:*:*:*:*:*

Net-SNMP through version 5.9.5.2 is affected by a high-severity denial of service vulnerability (CVE-2026-89147, CVSS 4.0 8.7) in the SMUX module. An unauthenticated remote attacker can connect to the SMUX listener and simply send no data, causing the single-threaded snmpd main loop to block indefinitely and halt all SNMP processing on the host. This requires no credentials and is trivially exploitable from the network.

Any organization running Net-SNMP with the SMUX module enabled should act immediately. As a mitigation, restrict network access to the SMUX port using firewall rules to trusted hosts only, and monitor for patches from the Net-SNMP project. Review the vendor advisory linked above for full details and disable the SMUX module entirely if it is not operationally required.

Vendor Advisory