8 vulnerabilities across 6 products scored HIGH or above on September 12, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 7

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-48273 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.1 → 15.1 (CRITICAL → CRITICAL). Originally in 2026-09-08 bulletin.
  • [UPGRADED] CVE-2026-75650 (adobe/commerce) — F1: exploitable → itw, AAS: 14.1 → 17.1 (CRITICAL → EMERGENCY). Originally in 2026-09-07 bulletin.

🔴 [CRITICAL] gitlab/gitlab

2 CVEs | CVSS 3.1: 10.0 | AAS 15.6

  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

GitLab CE/EE contains two critical vulnerabilities, including at least one with a maximum CVSS score of 10.0, affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The most severe issue allows unauthenticated attackers to read arbitrary files from the GitLab server by exploiting improper path confinement and missing authentication in the repository commits API, and exploitation has been observed in the wild.

All organizations running self-managed GitLab instances should treat this as an emergency update. Upgrade immediately to 19.1.8, 19.2.6, or 19.3.2, and review server logs for signs of unauthorized file access. See the vendor advisory at https://gitlab.com/gitlab-org/gitlab/-/work_items/627748 for full details.

Vendor Advisory

🟠 [HIGH] stellarwp/the_events_calendar

2 CVEs | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:*:*:* (< 6.17.5)

The Events Calendar plugin for WordPress by StellarWP is affected by two vulnerabilities with a maximum CVSS score of 9.8, including at least one that enables unauthenticated remote code execution in all versions up to and including 6.17.4. The most critical flaw exploits a bypass in the is_safe_widget_instance function, where PHP magic methods fire during pre-parsing and allow attackers to forge valid integrity attributes before reaching an unsafe unserialize call.

Any WordPress site running The Events Calendar should update immediately to a patched version. Given the unauthenticated attack vector and the plugin’s widespread use across WordPress installations, this should be prioritized as a high-urgency update. Review the vendor advisory at the WordPress plugin repository for patch details and indicators of compromise.

Vendor Advisory

🟠 [HIGH] irontec/sngrep

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:irontec:sngrep:*:*:*:*:*:*:*:* (< 1.8.5)

sngrep, a popular command-line SIP traffic capture and analysis tool by Irontec, has a critical stack buffer overflow vulnerability (CVSS 9.3) in all versions through 1.8.4. Attackers can send crafted SIP packets with oversized header values such as Call-ID or X-Call-ID that exceed the 255-byte buffer limit, potentially causing crashes or enabling arbitrary code execution during packet parsing.

Teams using sngrep to monitor or debug SIP traffic on VoIP infrastructure should update to a patched version as soon as one is available and avoid running affected versions against untrusted network traffic in the interim. Monitor the project repository at https://github.com/irontec/sngrep for release updates.

Vendor Advisory

🟠 [HIGH] freeciv/freeciv

1 CVE | CVSS 4.0: 8.5 | AAS 9.3

  • cpe:2.3:a:freeciv:freeciv:*:*:*:*:*:*:*:* (< 3.2.6)

Freeciv, the open-source strategy game, has a heap buffer overflow vulnerability (CVSS 8.5) in all versions before 3.2.6. The flaw exists in the worklist_load() function, where loading a crafted savegame file with a declared worklist length exceeding the 64-element array bound can corrupt adjacent heap memory, potentially enabling code execution when a user or server operator opens a malicious savegame.

While this primarily affects gaming environments, organizations that host multiplayer Freeciv servers or allow savegame file sharing should update to version 3.2.6 or later immediately and avoid loading savegames from untrusted sources. See the project repository at https://github.com/freeciv/freeciv for patch details.

Vendor Advisory

🟠 [HIGH] themeum/tutor_lms_–_elearning_and_online_course_solution

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:themeum:tutor_lms_elearning_and_online_course_solution:*:*:*:*:*:*:*:* (< 4.0.8)

Tutor LMS, a widely used eLearning and online course plugin for WordPress by Themeum, has a PHP Object Injection vulnerability (CVSS 8.8) affecting all versions up to and including 4.0.7. The flaw exists in the tutor_save_withdraw_account AJAX handler, which lacks proper capability or role checks and relies solely on a nonce, allowing authenticated attackers to inject malicious PHP objects through the withdraw_method_field parameter.

Any WordPress site running Tutor LMS should update beyond version 4.0.7 immediately, as this vulnerability could lead to further exploitation depending on available gadget chains within the application. Review the vendor advisory at the WordPress plugin repository for patch and remediation details.

Vendor Advisory

🟠 [HIGH] xerial/snappy-java

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*

snappy-java, a widely used Java compression library by Xerial, has an out-of-bounds write vulnerability (CVSS 8.7) in all versions through 1.1.10.8. The flaw occurs in the Snappy.uncompress(ByteBuffer, ByteBuffer) method, which fails to validate destination buffer capacity against decompressed data size, allowing attackers to supply crafted compressed payloads that write past buffer boundaries and crash the JVM.

Any Java application using snappy-java for data decompression, particularly those processing untrusted input such as messaging systems, databases, or data pipelines, should update to a patched version as soon as one is available. Monitor the project repository at https://github.com/xerial/snappy-java for release updates and consider input validation as a temporary mitigation.

Vendor Advisory