2 vulnerabilities across 2 products scored HIGH or above on September 14, 2026.

  • 🟠 HIGH: 2

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-48273 (adobe/coldfusion_2025) — F1: exploitable → functional, AAS: 12.1 → 15.1 (CRITICAL → CRITICAL). Originally in 2026-09-08 bulletin.
  • [UPGRADED] CVE-2026-75650 (adobe/commerce) — F1: exploitable → itw, AAS: 14.1 → 17.1 (CRITICAL → EMERGENCY). Originally in 2026-09-07 bulletin.

🟠 [HIGH] modeltc/lightllm

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:modeltc:lightllm:*:*:*:*:*:*:*:*

LightLLM by ModelTC through version 1.2.0 is affected by one HIGH-severity vulnerability (CVE-2026-90919, CVSS 9.3) involving unsafe deserialization in the Config Server’s /visual_register WebSocket endpoint. The endpoint passes untrusted client input directly to pickle.loads() without authentication, allowing a remote attacker to execute arbitrary code with the privileges of the Config Server process. Organizations running LightLLM in any capacity, particularly those exposing the Config Server port to untrusted networks, should treat this as urgent. No patched release has been confirmed at this time; teams should restrict network access to the Config Server port immediately, monitor for exploitation attempts, and watch the vendor’s GitHub repository for an updated release.

Vendor Advisory

🟠 [HIGH] maximhq/bifrost

1 CVE | CVSS 3.1: 9.8 | AAS 9.6

  • cpe:2.3:a:maximhq:bifrost:*:*:*:*:*:*:*:*

Bifrost by MaximHQ is affected by one HIGH-severity vulnerability (CVE-2026-90898, CVSS 9.8) that allows unauthenticated remote code execution through the management API. Because authentication is disabled by default, any unauthenticated caller can register a stdio MCP client via a single POST to /api/mcp/client, causing Bifrost to immediately execute an arbitrary command as the gateway process user without requiring an MCP handshake. Organizations running Bifrost should immediately enable authentication by setting governance.auth_config.is_enabled to true, restrict network access to the management API, and upgrade to transports v2.1.0 or later, which refuses unauthenticated stdio client registrations.

Vendor Advisory