42 vulnerabilities across 15 products scored HIGH or above on September 15, 2026.

  • 🔴 CRITICAL: 9
  • 🟠 HIGH: 33

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-48273 (adobe/coldfusion) — F1: exploitable → functional, AAS: 12.1 → 15.6 (CRITICAL → CRITICAL). Originally in 2026-09-08 bulletin.

🔴 [CRITICAL] oracle_corporation/oracle_weblogic_server

5 CVEs | CVSS 3.1: 10.0 | AAS 13.9

  • cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 12.2.1.4.0)
  • cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 14.1.1.0.0)
  • cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 14.1.2.0.0)
  • cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 15.1.1.0.0)
  • cpe:2.3:a:oracle:oracle_weblogic_server:*:*:*:*:*:*:*:* (>= 12.2.1.4.0, < 12.2.1.4.0)

Oracle WebLogic Server is affected by five vulnerabilities, including at least one rated CRITICAL with a CVSS score of 10.0. The most severe issue resides in the Core component and allows an unauthenticated attacker with network access via T3 or IIOP protocols to achieve full takeover of the server without any user interaction. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Organizations running Oracle WebLogic Server in any capacity should treat this as an urgent priority. WebLogic is widely deployed as middleware in enterprise environments, and the attack vector — unauthenticated, network-accessible, and easily exploitable — makes this a prime target for opportunistic and targeted exploitation. Security teams should apply the patches referenced in Oracle’s September 2026 Critical Patch Update advisory immediately, and where patching is not feasible, restrict network access to T3 and IIOP listeners as an interim mitigation.

Vendor Advisory

🔴 [CRITICAL] designcomputer/mysql_mcp_server

1 CVE | CVSS 3.1: 10.0 | AAS 13.8

  • cpe:2.3:a:designcomputer:mysql_mcp_server:*:*:*:*:*:*:*:*

MySQL MCP Server, a Model Context Protocol server used to interact with MySQL databases, is affected by one CRITICAL vulnerability with a CVSS score of 10.0. In versions prior to 0.4.2, when configured with SSE transport, the server binds to all network interfaces with no authentication on its endpoints and no DNS rebinding protection, allowing a network attacker to directly execute arbitrary SQL queries against the connected database or leverage DNS rebinding to exploit the service through a victim’s browser.

Teams using MySQL MCP Server in any environment should immediately upgrade to version 0.4.2 or later. Given the unauthenticated remote access to database operations, this vulnerability poses a severe data confidentiality, integrity, and availability risk to any connected MySQL instance.

Vendor Advisory

🔴 [CRITICAL] motioneye-project/motioneye

1 CVE | CVSS 4.0: 9.1 | AAS 13.3

  • cpe:2.3:a:motioneye-project:motioneye:*:*:*:*:*:*:*:*

motionEye, an open-source web interface for the motion video surveillance software, is affected by one CRITICAL vulnerability with a CVSS 4.0 score of 9.1 that is being exploited in the wild. In versions prior to 0.44.0, the application relies on client-controlled cookies for authentication without server-side session validation, allowing an unauthenticated attacker who knows or obtains a target username and password hash to forge credentials and gain unauthorized access to the surveillance system.

Anyone running motionEye for video surveillance should upgrade to version 0.44.0 or later immediately. Given confirmed in-the-wild exploitation and the internet-facing nature of many motionEye deployments, organizations should also audit access logs for signs of compromise and restrict network exposure to the web interface until patching is complete.

Vendor Advisory

🔴 [CRITICAL] oracle_corporation/oracle_access_manager

11 CVEs | CVSS 3.1: 10.0 | AAS 12.2

  • cpe:2.3:a:oracle:oracle_access_manager:*:*:*:*:*:*:*:* (>= 12.2.1.4.0)
  • cpe:2.3:a:oracle:oracle_access_manager:*:*:*:*:*:*:*:* (>= 14.1.2.1.0)
  • cpe:2.3:a:oracle:oracle_access_manager:*:*:*:*:*:*:*:* (>= 14.1.2.0.0)
  • cpe:2.3:a:oracle:oracle_access_manager:*:*:*:*:*:*:*:* (>= 12.2.1.4.0, < 12.2.1.4.1)
  • cpe:2.3:a:oracle:oracle_access_manager:*:*:*:*:*:*:*:* (>= 14.1.2.1.0, < 14.1.2.1.1)

Oracle Access Manager, a core component of Oracle Fusion Middleware used for enterprise authentication and single sign-on, is affected by eleven vulnerabilities, including at least one rated CRITICAL with a CVSS score of 10.0. The most severe issue in the Authentication Engine allows an unauthenticated attacker with network access via HTTP to fully compromise Oracle Access Manager, with scope change indicating that successful exploitation can significantly impact additional products beyond the vulnerable component. Affected versions include 12.2.1.4.0 and 14.1.2.1.0.

Organizations using Oracle Access Manager should treat this as a top-priority patching effort given its role as a centralized authentication gateway — compromise here can cascade across all systems that rely on it for access control. Apply the fixes from Oracle’s September 2026 Critical Patch Update immediately, and review authentication logs for any anomalous activity while patching is underway.

Vendor Advisory

🔴 [CRITICAL] shaneisrael/fireshare

1 CVE | CVSS 3.1: 9.8 | AAS 12.1

  • cpe:2.3:a:shaneisrael:fireshare:*:*:*:*:*:*:*:* (< 1.6.14)

Fireshare, a self-hosted media and link sharing application, is affected by one CRITICAL vulnerability with a CVSS score of 9.8. An argument injection flaw in the video upload function allows an unauthenticated attacker to write or overwrite arbitrary system files, which can lead to full server compromise. A public proof-of-concept exploit is available, increasing the likelihood of active exploitation.

Anyone running Fireshare prior to version 1.6.14 should upgrade immediately. Given the unauthenticated attack vector and the availability of a public PoC, exposed instances are at high risk and should be taken offline or restricted at the network level until the update is applied.

Vendor Advisory

🟠 [HIGH] oracle_corporation/oracle_jdeveloper

3 CVEs | CVSS 3.1: 9.8 | AAS 11.9

  • cpe:2.3:a:oracle:oracle_jdeveloper:*:*:*:*:*:*:*:* (>= 12.2.1.4.0)
  • cpe:2.3:a:oracle:oracle_jdeveloper:*:*:*:*:*:*:*:* (>= 14.1.2.0.0)

Oracle JDeveloper, a development environment within Oracle Fusion Middleware, is affected by three vulnerabilities, including at least one with a CVSS score of 9.8. The most severe issue resides in the ADF Faces component and allows an unauthenticated attacker with network access via HTTP to achieve full takeover of Oracle JDeveloper with no user interaction required. Affected versions are 12.2.1.4.0 and 14.1.2.0.0.

Organizations with Oracle JDeveloper deployments, particularly those with ADF Faces components exposed to the network, should apply the patches from Oracle’s September 2026 Critical Patch Update without delay. Any JDeveloper instances accessible beyond trusted development networks should be immediately restricted while patching is in progress.

Vendor Advisory

🟠 [HIGH] docker/mcp-gateway

1 CVE | CVSS 4.0: 8.7 | AAS 11.8

  • cpe:2.3:a:docker:mcp-gateway:*:*:*:*:*:*:*:*

Docker MCP Gateway, a tool for running and deploying MCP servers, is affected by one HIGH vulnerability with a CVSS 4.0 score of 8.7. In versions 0.21.0 through 0.42.1, attacker-controlled OCI image label metadata is deserialized into runtime configuration without proper validation, allowing a malicious container image to inject arbitrary docker run parameters including volume mounts, user overrides, and extra host entries — effectively enabling container escape and host compromise. A functional exploit is available, elevating the urgency of remediation.

Teams using Docker MCP Gateway should upgrade to version 0.42.2 or later immediately. Until patching is complete, organizations should restrict which container images can be referenced through the gateway and audit any recently pulled images from untrusted sources for malicious metadata labels.

Vendor Advisory

🟠 [HIGH] openidentityplatform/opendj

1 CVE | CVSS 4.0: 9.2 | AAS 11.5

  • cpe:2.3:a:openidentityplatform:opendj:*:*:*:*:*:*:*:*

OpenDJ, an open-source LDAPv3 compliant directory service from Open Identity Platform, is affected by one HIGH vulnerability with a CVSS 4.0 score of 9.2 that is being exploited in the wild. The JMX RMI connector processes attacker-controlled credential objects before authentication without proper deserialization filtering, allowing an unauthenticated attacker to achieve remote code execution via crafted Java objects sent to the JMX endpoint.

Organizations running OpenDJ prior to version 5.1.1 should upgrade immediately given confirmed in-the-wild exploitation. As an interim mitigation, restrict network access to the JMX RMI port to trusted management hosts only, and audit systems for signs of compromise such as unexpected processes or outbound connections originating from the OpenDJ service.

Vendor Advisory

🟠 [HIGH] zereight/gitlab-mcp

1 CVE | CVSS 3.1: 9.6 | AAS 11.5

  • cpe:2.3:a:zereight:gitlab-mcp:*:*:*:*:*:*:*:*

The @zereight/mcp-gitlab package, a Model Context Protocol server for GitLab, is affected by one HIGH vulnerability with a CVSS score of 9.6. When configured with dynamic API URL support enabled, the server accepts an attacker-controlled HTTP header to redirect all outbound GitLab API calls to an arbitrary URL without hostname restrictions, causing the server to forward its authentication token to an attacker-controlled endpoint — resulting in full GitLab API credential theft and potential server-side request forgery.

Teams using @zereight/mcp-gitlab versions 0.0.1 through 2.1.26, particularly those with the ENABLE_DYNAMIC_API_URL environment variable set to true, should upgrade to version 2.1.27 immediately. As an interim measure, disable the dynamic API URL feature and rotate any GitLab API tokens that may have been exposed through this server.

Vendor Advisory

🟠 [HIGH] oracle_corporation/oracle_identity_manager

2 CVEs | CVSS 3.1: 9.8 | AAS 11.4

  • cpe:2.3:a:oracle:oracle_identity_manager:*:*:*:*:*:*:*:* (>= 12.2.1.4.0)
  • cpe:2.3:a:oracle:oracle_identity_manager:*:*:*:*:*:*:*:* (>= 14.1.2.1.0)

Oracle Identity Manager, a core identity governance component of Oracle Fusion Middleware, is affected by two vulnerabilities, including at least one with a CVSS score of 9.8. The most severe issue in the Core component allows an unauthenticated attacker with network access via HTTP to achieve complete takeover of Oracle Identity Manager with no user interaction required. Affected versions are 12.2.1.4.0 and 14.1.2.1.0.

Organizations running Oracle Identity Manager should treat this as a critical priority given its central role in managing user identities, provisioning, and access governance across the enterprise — compromise of this system can grant attackers broad control over user accounts and entitlements. Apply the patches from Oracle’s September 2026 Critical Patch Update immediately and restrict network access to the Identity Manager console while remediation is underway.

Vendor Advisory

🟠 [HIGH] openidentityplatform/openam

2 CVEs | CVSS 3.1: 9.8 | AAS 11.1

  • cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*

OpenAM, an open-source access management solution from Open Identity Platform, is affected by two vulnerabilities, including at least one with a CVSS score of 9.8. The most severe issue allows an unauthenticated attacker to achieve remote code execution through the pre-authentication /authservice endpoint by supplying a crafted XML element that triggers arbitrary Java class instantiation and unsafe deserialization, with no authentication required in default configurations. A functional exploit is available, significantly increasing the risk of active exploitation.

Organizations running OpenAM prior to version 16.1.2 should upgrade immediately. Given the pre-authentication attack surface and the availability of a working exploit, any internet-exposed OpenAM instances should be restricted at the network level or taken offline until patching is complete, and systems should be examined for indicators of compromise.

Vendor Advisory

🟠 [HIGH] kimai/kimai

1 CVE | CVSS 4.0: 9.1 | AAS 11.0

  • cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*

Kimai, an open-source time tracking application, is affected by one HIGH vulnerability with a CVSS 4.0 score of 9.1. The official Docker image ships with a publicly known default APP_SECRET value that is not rejected at startup, allowing an unauthenticated attacker to forge Symfony security tokens and compromise user accounts that do not have two-factor authentication enabled. A public proof-of-concept exploit is available.

Organizations running Kimai via Docker should immediately verify that the APP_SECRET environment variable has been overridden with a unique, randomly generated value, and upgrade to version 2.58.0 or later which addresses this issue. Any deployment that has been running with the default secret should be treated as potentially compromised — rotate the secret, invalidate all sessions, and enforce two-factor authentication on all accounts.

Vendor Advisory

🟠 [HIGH] mervinpraison/praisonai

7 CVEs | CVSS 3.1: 9.9 | AAS 10.8

  • cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*

PraisonAI, a multi-agent teams framework, is affected by seven vulnerabilities, including at least one with a CVSS score of 9.9. The most severe issue involves a sandbox escape in the codeMode tool, where model-generated JavaScript executed via new Function() can bypass the regular-expression blocklist to recover the global object, access the host filesystem, read environment variables and secrets, and execute arbitrary system commands through dynamically constructed module references.

Organizations using PraisonAI prior to version 1.7.2 should upgrade immediately, as these vulnerabilities allow any attacker who can influence LLM-generated code to achieve full host compromise. Given that multiple distinct flaws were identified across the platform, teams should also review their deployment for any signs of unauthorized file access or command execution and rotate any credentials or API keys that may have been accessible to the PraisonAI process.

Vendor Advisory

🟠 [HIGH] diracgrid/dirac

2 CVEs | CVSS 3.1: 9.9 | AAS 10.7

  • cpe:2.3:a:diracgrid:dirac:*:*:*:*:*:*:*:*

DIRAC, a distributed computing framework used in scientific grid environments, is affected by two vulnerabilities, including at least one with a CVSS score of 9.9. The most severe issue allows an authenticated user to achieve remote code execution by supplying a crafted attribute expression to the Request Management System, which is resolved and evaluated as Python code on the server without proper sanitization. A public proof-of-concept exploit is available.

Organizations running DIRAC should upgrade to versions 8.0.79, 9.0.22, or 9.1.10 or later immediately. While authentication is required, any user with legitimate access to the Request Management Service can exploit this flaw to execute arbitrary code on the server, making it critical to patch promptly and audit logs for any anomalous attribute queries against the affected endpoint.

Vendor Advisory

🟠 [HIGH] mozilla/firefox

3 CVEs | CVSS 3.1: 8.8 | AAS 10.6

  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Mozilla Firefox is affected by three vulnerabilities, including at least one with a CVSS score of 8.8. The most severe issue is a privilege escalation flaw in the DevTools component that could allow an attacker to elevate privileges within the browser. These vulnerabilities also affect Thunderbird.

Organizations and users should update to Firefox 156, Firefox ESR 153.3, or Thunderbird 156 or later as soon as possible. Enterprise environments managing browser deployments should prioritize pushing these updates through their patch management systems, particularly for users who regularly utilize browser developer tools.

Vendor Advisory