27 vulnerabilities across 15 products scored HIGH or above on September 16, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 26

🔴 [CRITICAL] cisco/cisco_identity_services_engine_software

1 CVE | CVSS 3.1: 10.0 | AAS 13.3

  • cpe:2.3:a:cisco:cisco_identity_services_engine_software:*:*:*:*:*:*:*:*

Cisco Identity Services Engine (ISE) is affected by a critical authentication bypass vulnerability (CVE-2026-76460, CVSS 10.0) in an API endpoint that allows unauthenticated remote attackers to gain unauthorized access to the web-based management interface. This vulnerability is confirmed exploited in the wild, making immediate action essential for any organization running Cisco ISE for network access control and policy enforcement.

Security teams should consult the vendor advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5 and apply available patches immediately. Given active exploitation and the ability for unauthenticated attackers to fully bypass authentication, organizations should also review ISE logs for signs of compromise and restrict API access to trusted networks as an interim mitigation.

Vendor Advisory

🟠 [HIGH] nlnet_labs/unbound

2 CVEs | CVSS 4.0: 9.1 | AAS 11.1

  • cpe:2.3:a:nlnet_labs:unbound:*:*:*:*:*:*:*:*

NLnet Labs Unbound versions up to and including 1.26.0 are affected by two vulnerabilities, including at least one critical flaw in the DNSSEC validator (CVSS 9.1) where a maliciously crafted DNSKEY record can trigger a buffer overflow, potentially enabling remote code execution. Any organization running Unbound as a recursive DNS resolver should treat this as high priority, as an attacker only needs to control a malicious zone and trigger a query to exploit the vulnerability.

Administrators should review the vendor advisory at https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt and upgrade Unbound to the latest patched version immediately. Until patching is complete, consider restricting queries to trusted sources and monitoring DNS infrastructure for anomalous DNSKEY responses.

Vendor Advisory

🟠 [HIGH] internlm/lmdeploy

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:* (>= 0.9.1, < 0.10.2)

LMDeploy versions 0.9.1 through 0.10.1 are affected by a critical remote code execution vulnerability (CVE-2025-59953, CVSS 9.8) in the AsyncRPCServer component, where unsanitized use of Python pickle deserialization allows an attacker to execute arbitrary code by sending crafted messages to the RPC server. Any organization deploying LMDeploy for large language model inference serving should act immediately, particularly if the RPC server is network-accessible.

Teams should upgrade to LMDeploy version 0.10.2 or later, which addresses this issue. Until patching is complete, restrict network access to the RPC server to trusted hosts only and monitor for unexpected inbound connections to the ZMQ RPC endpoint.

Vendor Advisory

🟠 [HIGH] checkpoint/quantum_security_management

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:checkpoint:quantum_security_management:*:*:*:*:*:*:*:*

Check Point Quantum Security Management is affected by a critical stack overflow vulnerability (CVE-2026-91843, CVSS 9.8) in the unauthenticated login process that could allow a remote attacker to execute arbitrary code with root privileges. Any organization using Check Point Quantum Security Management for centralized firewall and security policy administration should treat this as an emergency, given that no authentication is required for exploitation and the attacker gains full root access.

Administrators should immediately consult the vendor advisory at https://support.checkpoint.com/results/sk/sk1000155 and apply the available hotfix or upgrade. As an interim measure, restrict management interface access to trusted networks and monitor for unusual login activity or unexpected process execution on management servers.

Vendor Advisory

🟠 [HIGH] altium/altium_enterprise_server

1 CVE | CVSS 4.0: 10.0 | AAS 10.8

  • cpe:2.3:a:altium:altium_enterprise_server:*:*:*:*:*:*:*:*

Altium Enterprise Server is affected by a critical server-side request forgery vulnerability (CVE-2026-92808, CVSS 10.0) in the UnifiedLogin service that allows an unauthenticated remote attacker to force the server to issue arbitrary outbound HTTP requests, including to internal services that expose configuration data and credentials without authentication. Any organization running Altium Enterprise Server for electronic design and data management should treat this as an emergency, as exploitation requires no credentials and can lead to full exposure of sensitive server secrets.

Teams should review the vendor advisory at https://www.altium.com/platform/security-compliance/security-advisories and apply the latest available patch immediately. Until patched, restrict network access to the UnifiedLogin endpoint and audit logs for unexpected outbound requests originating from the server.

Vendor Advisory

🟠 [HIGH] wwbn/avideo

3 CVEs | CVSS 4.0: 9.2 | AAS 10.7

  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

WWBN AVideo through version 29.0 is affected by three vulnerabilities (CVSS up to 9.2), including at least one critical authentication bypass where stored password hashes are accepted as valid login credentials through multiple code paths, allowing an attacker who obtains a hash to authenticate as any user without knowing the actual password. Any organization self-hosting AVideo for video streaming or content management should act urgently, as these flaws fundamentally undermine the platform’s authentication model.

Administrators should review the vendor advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-fq38-jp6c-q4cx and upgrade to the latest patched release as soon as possible. Until patched, restrict public access to login endpoints, rotate all user credentials, and audit authentication logs for signs of hash-based login abuse.

Vendor Advisory

🟠 [HIGH] arista_networks/eos

4 CVEs | CVSS 4.0: 9.5 | AAS 10.6

  • cpe:2.3:a:arista:eos:*:*:*:*:*:*:*:*

Arista EOS is affected by four vulnerabilities (CVSS up to 9.5), including at least one critical flaw that allows an unauthenticated attacker to achieve arbitrary code execution and gain complete administrative control over affected switches by sending a crafted packet during P4Runtime session initiation. While P4Runtime is disabled by default, any organization running Arista EOS with P4Runtime enabled in their network infrastructure should treat this as a high-priority issue.

Network teams should review the vendor advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174 and apply the recommended patches immediately. Organizations that have P4Runtime enabled should also verify whether it is operationally required and disable it where possible as an interim mitigation until patching is complete.

Vendor Advisory

🟠 [HIGH] craftcms/cms

4 CVEs | CVSS 4.0: 8.7 | AAS 10.3

  • cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:* (>= 4.8.0, < 4.18.6)
  • cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:* (>= 5.0.0, < 5.10.13)
  • cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:* (>= 5.10.0, < 5.10.13)
  • cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:* (>= 5.0.0-RC1, < 5.11.0)

Craft CMS versions 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 are affected by four vulnerabilities (CVSS up to 8.7), including at least one high-severity flaw where an authenticated non-administrator user can exploit a shared HMAC signing key between cookie validation and signed request parameters to forge trusted redirects and escalate privileges. Any organization running Craft CMS within these version ranges should prioritize remediation, as exploitation requires only a low-privileged authenticated account with no Control Panel access needed.

Teams should review the vendor advisory at https://github.com/craftcms/cms/security/advisories/GHSA-5r92-75j8-c534 and upgrade to Craft CMS 4.18.6 or 5.10.13 or later immediately. Until patched, audit user accounts for unnecessary access and monitor for suspicious cookie manipulation or unexpected redirect behavior.

Vendor Advisory

🟠 [HIGH] cisco/cisco_secure_firewall_management_center_(fmc)

2 CVEs | CVSS 3.1: 9.9 | AAS 10.1

  • cpe:2.3:a:cisco:cisco_secure_firewall_management_center_fmc:*:*:*:*:*:*:*:*

Cisco Secure Firewall Management Center (FMC) Software is affected by two vulnerabilities (CVSS up to 9.9), including at least one critical insecure deserialization flaw in the External Database Access feature that allows an unauthenticated remote attacker to execute arbitrary commands as root by sending a crafted serialized Java byte stream. Any organization using Cisco FMC for centralized firewall management should treat this as an emergency, particularly if the External Database Access feature is enabled with configured access lists.

Administrators should immediately review the vendor advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-javarce-y2NypXwk and apply available patches. As an interim measure, restrict or disable the External Database Access feature where operationally feasible and audit the configured access lists to minimize exposure.

Vendor Advisory

🟠 [HIGH] jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:jetmonsters:jetformbuilder_dynamic_blocks_form_builder:*:*:*:*:*:*:*:*

The JetFormBuilder plugin for WordPress in all versions up to and including 3.6.2 is affected by a critical privilege escalation vulnerability (CVE-2026-12793, CVSS 9.8) that allows unauthenticated attackers to create administrator-level user accounts by submitting a crafted form ID that bypasses validation and triggers server-side callback execution. Any WordPress site running JetFormBuilder should treat this as an emergency, as exploitation requires no authentication and results in full administrative takeover.

Site administrators should update JetFormBuilder beyond version 3.6.2 immediately by reviewing the patch at https://plugins.trac.wordpress.org/changeset/3575346/jetformbuilder. Until patched, audit existing user accounts for any unauthorized administrators, and consider temporarily deactivating the plugin if it is not business-critical.

Vendor Advisory

🟠 [HIGH] rabbitmq/amqp091-go

3 CVEs | CVSS 4.0: 9.5 | AAS 9.9

  • cpe:2.3:a:rabbitmq:amqp091-go:*:*:*:*:*:*:*:* (< 1.13.0)

RabbitMQ amqp091-go, the Go AMQP 0.9.1 client library, prior to version 1.13.0 is affected by three vulnerabilities (CVSS up to 9.5), including at least one high-severity flaw where oversized AMQP shortstr property values silently truncate due to an unchecked uint8 cast, causing metadata corruption that can be exploited to manipulate message routing, bypass security controls, or cause denial of service. Any development team or organization using the amqp091-go library in Go applications that process user-controlled AMQP message properties should assess their exposure immediately.

Teams should upgrade to amqp091-go version 1.13.0 or later, which adds proper length validation. The fix is available at https://github.com/rabbitmq/amqp091-go/commit/6959423aa2784a1971e399175dfb2065dea0f3b0, and all dependent applications should be rebuilt against the patched library.

Vendor Advisory

🟠 [HIGH] hkuds/nanobot

1 CVE | CVSS 4.0: 9.2 | AAS 9.8

  • cpe:2.3:a:hkuds:nanobot:*:*:*:*:*:*:*:* (< 0.3.0)

HKUDS nanobot before version 0.3.0 is affected by a high-severity server-side request forgery vulnerability (CVE-2026-92576, CVSS 9.2) in the WebFetchTool component where insufficient URL validation allows attackers to instruct the bot to fetch internal resources including cloud metadata endpoints, localhost services, and private network addresses, potentially exposing IAM credentials and sensitive internal data. Any organization deploying nanobot, particularly in cloud environments, should treat this as urgent given the risk of credential theft via metadata service access.

Teams should upgrade to nanobot version 0.3.0 or later immediately by reviewing the advisory at https://github.com/HKUDS/nanobot/security/advisories/GHSA-vc5v-6vwm-wf9m. Until patched, restrict the bot’s outbound network access using firewall rules that block requests to internal IP ranges, link-local metadata endpoints, and RFC 1918 addresses.

Vendor Advisory

🟠 [HIGH] gitlab/gitlab

1 CVE | CVSS 3.1: 8.5 | AAS 9.7

  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

GitLab EE versions 19.0 through 19.1.7, 19.2 through 19.2.5, and 19.3 through 19.3.1 are affected by a high-severity privilege escalation vulnerability (CVE-2026-79708, CVSS 8.5) where an authenticated user with developer permissions can exploit insufficient scope validation in policy test pipelines to access protected CI/CD variables restricted to higher-privileged roles. Any organization running self-managed or dedicated GitLab EE instances within these version ranges should prioritize remediation, as compromised CI/CD variables could expose secrets such as deployment credentials, API keys, and service tokens.

Administrators should upgrade to GitLab 19.1.8, 19.2.6, or 19.3.2 or later as detailed in the vendor advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/. Until patched, review and audit protected CI/CD variable access logs for unauthorized retrieval and consider rotating any sensitive credentials stored as protected variables.

Vendor Advisory

🟠 [HIGH] cobbr/covenant

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:cobbr:covenant:*:*:*:*:*:*:*:*

Covenant through version 0.6, the open-source command-and-control framework, is affected by a high-severity authentication bypass vulnerability (CVE-2026-92717, CVSS 9.3) where the CovenantHub SignalR hub lacks an Authorize attribute, allowing unauthenticated attackers to invoke listener creation, obtain a signed JWT token, and gain full access to the operator API including grunts, credentials, binaries, and the operator roster. Any red team or security organization running Covenant should treat this as critical, as exploitation grants an external attacker complete control over the C2 infrastructure and all connected implants.

Teams should review the advisory at https://github.com/cobbr/Covenant and apply any available patches or restrict network access to the Covenant server immediately. Until remediated, ensure Covenant instances are not exposed to untrusted networks, place them behind VPN or firewall controls, and audit access logs for unauthorized SignalR hub connections or unexpected listener creation.

Vendor Advisory

🟠 [HIGH] kubero-dev/kubero

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:kubero-dev:kubero:*:*:*:*:*:*:*:*

Kubero through version 3.1.1 is affected by a high-severity authentication bypass vulnerability (CVE-2026-92720, CVSS 9.3) where the notifications API endpoints lack authentication guards, allowing unauthenticated attackers to read webhook secrets and service URLs, register malicious webhooks to intercept pipeline events, or delete existing configurations to suppress alerting. Any organization using Kubero for Kubernetes application deployment should act immediately, as exposed webhook credentials and the ability to manipulate notification pipelines could enable supply chain attacks and blind defenders to malicious activity.

Teams should review the advisory at https://github.com/kubero-dev/kubero and upgrade beyond version 3.1.1 as soon as a fix is available. Until patched, restrict network access to the Kubero API to trusted sources only, rotate any webhook secrets that may have been exposed, and audit notification configurations for unauthorized changes.

Vendor Advisory