2 vulnerabilities across 1 product scored HIGH or above on September 12, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 1

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-48273 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.1 → 15.1 (CRITICAL → CRITICAL). Originally in 2026-09-08 bulletin.
  • [UPGRADED] CVE-2026-75650 (adobe/commerce) — F1: exploitable → itw, AAS: 14.1 → 17.1 (CRITICAL → EMERGENCY). Originally in 2026-09-07 bulletin.

🔴 [CRITICAL] gitlab/gitlab

2 CVEs | CVSS 3.1: 10.0 | AAS 15.6

  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

GitLab CE/EE contains two critical vulnerabilities, including at least one rated CVSS 10.0, affecting all versions from 18.7 through unpatched releases of 19.1, 19.2, and 19.3. The most severe issue allows unauthenticated attackers to read arbitrary files from the GitLab server by exploiting improper path confinement and missing authentication in the repository commits API, and exploitation has been observed in the wild. Security teams running self-managed GitLab instances should treat this as an emergency and upgrade immediately to 19.1.8, 19.2.6, or 19.3.2, referring to the vendor advisory for full details.

Vendor Advisory