43 vulnerabilities across 15 products scored HIGH or above on September 17, 2026.

  • 🔴 CRITICAL: 4
  • 🟠 HIGH: 39

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin.

🔴 [CRITICAL] chamilo/chamilo-lms

2 CVEs | CVSS 3.1: 9.8 | AAS 13.4

  • cpe:2.3:a:chamilo:chamilo-lms:*:*:*:*:*:*:*:* (< 2.0.1)
  • cpe:2.3:a:chamilo:chamilo-lms:*:*:*:*:*:*:*:* (>= 2.0.0)

Chamilo LMS versions prior to 2.0.1 are affected by 2 critical vulnerabilities, including at least one that allows an unauthenticated remote attacker to execute arbitrary code on the server (CVSS 9.8). Organizations running Chamilo LMS in educational or training environments should treat this as an urgent priority, as the flaw requires no authentication and exploitation is considered feasible. Upgrade to Chamilo LMS 2.0.1 immediately and review the vendor advisory at the Chamilo GitHub security page for additional details.

Vendor Advisory

🔴 [CRITICAL] patriksimek/vm2

23 CVEs | CVSS 4.0: 10.0 | AAS 12.7

  • cpe:2.3:a:patriksimek:vm2:*:*:*:*:*:*:*:* (>= 3.11.3)
  • cpe:2.3:a:patriksimek:vm2:*:*:*:*:*:*:*:* (< 3.11.7)
  • cpe:2.3:a:patriksimek:vm2:*:*:*:*:*:*:*:* (>= 3.11.0, < 3.11.8)
  • cpe:2.3:a:patriksimek:vm2:*:*:*:*:*:*:*:* (>= 3.10.2)
  • cpe:2.3:a:patriksimek:vm2:*:*:*:*:*:*:*:* (>= 3.10.0, < 3.11.8)

The vm2 JavaScript sandbox library (version 3.11.6 and earlier) is affected by 23 critical vulnerabilities, including multiple sandbox escape flaws that allow remote code execution in the host Node.js process (CVSS 10.0). Any application relying on vm2 to isolate untrusted code is at serious risk, as attackers can break out of the sandbox entirely. The vm2 project has been deprecated by its maintainer; teams should migrate immediately to a supported alternative such as isolated-vm and audit any deployments still using vm2 in production.

Vendor Advisory

🔴 [CRITICAL] prebid/prebid-server-java

1 CVE | CVSS 3.1: 10.0 | AAS 12.3

  • cpe:2.3:a:prebid:prebid-server-java:*:*:*:*:*:*:*:* (< 3.43.0)

Prebid Server Java prior to version 3.43.0 contains a critical server-side request forgery vulnerability (CVSS 10.0) in which certain bidder adapters fail to validate user-supplied parameters, allowing attackers to redirect outbound HTTP requests to internal network services, cloud metadata endpoints, or other sensitive destinations. Organizations running Prebid Server Java for programmatic advertising header bidding should treat this as high priority, as exploitation requires only the ability to submit bid-request parameters. Upgrade to Prebid Server Java 3.43.0 or later immediately and review network-level controls to restrict outbound requests from the Prebid Server host.

Vendor Advisory

🟠 [HIGH] b2evolution/b2evolution_cms

1 CVE | CVSS 4.0: 9.2 | AAS 10.7

  • cpe:2.3:a:b2evolution:b2evolution_cms:*:*:*:*:*:*:*:* (>= 6.7.8, < 7.2.6)

b2evolution CMS versions 6.7.8 through 7.2.5 contain a critical PHP object injection vulnerability (CVSS 9.2) stemming from an incomplete fix for a prior CVE, where unauthenticated attackers can submit crafted serialized PHP payloads via htsrv/call_plugin.php to bypass validation and potentially achieve remote code execution. Any organization running b2evolution in this version range should act immediately, as no authentication is required for exploitation. Note that b2evolution has reached end of life; site operators should migrate to a supported CMS platform or apply any available patches and restrict public access to the affected endpoint as an interim mitigation.

Vendor Advisory

🟠 [HIGH] netbox-community/devicetype-library

2 CVEs | CVSS 3.1: 9.6 | AAS 10.4

  • cpe:2.3:a:netbox-community:devicetype-library:*:*:*:*:*:*:*:*

The NetBox Device Type Library, a community-sourced collection of device type definitions used with NetBox, is affected by 2 vulnerabilities including at least one critical unsafe deserialization flaw (CVSS 9.6) in its test harness that allows an unauthenticated contributor to achieve arbitrary code execution by supplying crafted pickle files through a pull request. Teams that maintain forks of this repository, run its CI/CD test suite against external contributions, or automatically merge community pull requests should treat this as high priority. Apply the vendor-provided commit fix immediately, review recent pull requests for suspicious pickle or test configuration file changes, and ensure CI pipelines run in isolated environments with restricted permissions.

Vendor Advisory

🟠 [HIGH] umbraco/umbraco-cms

1 CVE | CVSS 4.0: 8.7 | AAS 10.3

  • cpe:2.3:a:umbraco:umbraco-cms:*:*:*:*:*:*:*:*

Umbraco CMS versions prior to 13.15.1, 17.5.3, and 18.0.2 contain an access control bypass vulnerability (CVSS 8.7) in the Content Delivery API where member and Public Access restrictions are not enforced on referenced nodes returned through Content Picker, Multi-Node Tree Picker, Block List, Block Grid, or Rich Text Editor properties, allowing anonymous attackers to retrieve protected content details. Organizations using Umbraco with the Delivery API and Public Access features enabled should prioritize remediation, as exploitation requires no authentication. Upgrade to Umbraco CMS 13.15.1, 17.5.3, or 18.0.2 depending on your release branch, and audit whether any sensitive content may have been exposed through unprotected referencing nodes.

Vendor Advisory

🟠 [HIGH] microsoft/azure_logic_apps

2 CVEs | CVSS 3.1: 10.0 | AAS 10.3

  • cpe:2.3:a:microsoft:azure_logic_apps:*:*:*:*:*:*:*:*

Microsoft Azure Logic Apps is affected by 2 vulnerabilities including at least one critical improper access control flaw (CVSS 10.0) that allows an unauthorized attacker to elevate privileges over a network without authentication. Any organization using Azure Logic Apps for workflow automation should treat this as an urgent priority given the maximum severity rating and network-exploitable attack vector. Review the Microsoft Security Response Center advisory immediately, apply any available patches or mitigations, and audit Azure Logic Apps deployments for signs of unauthorized access or privilege escalation.

Vendor Advisory

🟠 [HIGH] microsoft/azure_ai_foundry

1 CVE | CVSS 3.1: 10.0 | AAS 10.3

  • cpe:2.3:a:microsoft:azure_ai_foundry:*:*:*:*:*:*:*:*

Microsoft Azure AI Foundry contains a critical missing authentication vulnerability (CVSS 10.0) that allows an unauthorized attacker to elevate privileges over a network without any credentials. Organizations using Azure AI Foundry for AI model development and deployment should treat this as the highest priority, as the maximum severity rating reflects both the ease of exploitation and the potential for full compromise. Review the Microsoft Security Response Center advisory immediately, apply any available patches or platform updates, and audit Azure AI Foundry environments for unauthorized access or anomalous activity.

Vendor Advisory

🟠 [HIGH] appwrite/appwrite

1 CVE | CVSS 4.0: 8.7 | AAS 10.3

  • cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*

Appwrite prior to version 2.0.0 contains a command injection vulnerability (CVSS 8.7) that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands on the server by injecting TAB characters into the providerRootDirectory parameter, bypassing shell sanitization in GNU tar command construction. Organizations self-hosting Appwrite for backend-as-a-service should act promptly, as any user with function or site deployment permissions can escalate to full server-level command execution. Upgrade to Appwrite 2.0.0 or later immediately and review audit logs for unusual function or site deployment activity that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] mapserver/mapserver

1 CVE | CVSS 3.1: 8.2 | AAS 10.2

  • cpe:2.3:a:mapserver:mapserver:*:*:*:*:*:*:*:* (< 8.6.4)

MapServer prior to version 8.6.4 contains a SQL injection vulnerability (CVSS 8.2) in the PostGIS runtime filter translation where attacker-controlled CGI query string or OGC API Features input is concatenated directly into PostgreSQL queries without numeric validation, potentially allowing unauthorized database access or manipulation. Organizations running MapServer with PostGIS connection types for web-based GIS applications should treat this as high priority, as exploitation requires no authentication and targets publicly accessible map service endpoints. Upgrade to MapServer 8.6.4 immediately and review database access logs for anomalous queries against PostGIS-backed layers.

Vendor Advisory

🟠 [HIGH] solarwinds/access_rights_manager

1 CVE | CVSS 3.1: 8.8 | AAS 10.1

  • cpe:2.3:a:solarwinds:access_rights_manager:*:*:*:*:*:*:*:* (< 2024.3.1)

SolarWinds Access Rights Manager contains a critical remote code execution vulnerability (CVSS 8.8) stemming from a hardcoded static key that allows unauthenticated attackers to execute arbitrary code on affected systems. Organizations using Access Rights Manager for Active Directory and file server permissions management should treat this as urgent, given that no authentication is required and SolarWinds products are historically high-value targets for attackers. Review the SolarWinds security advisory immediately, apply any available patches or updates, and follow the vendor’s guidance on securing your Access Rights Manager deployment.

Vendor Advisory

🟠 [HIGH] itflow-org/itflow

2 CVEs | CVSS 3.1: 8.3 | AAS 10.1

  • cpe:2.3:a:itflow-org:itflow:*:*:*:*:*:*:*:* (< 26.07)

ITFlow, an IT documentation, ticketing, and accounting system used by managed service providers, is affected by 2 vulnerabilities prior to version 26.07, including at least one time-based blind SQL injection flaw (CVSS 8.3) that allows authenticated users with support module write permissions to extract database contents through crafted input in the credential sharing handler. MSPs running ITFlow should prioritize remediation, as proof-of-concept exploit code is available and the application likely stores sensitive client credentials and documentation. Upgrade to ITFlow version 26.07 or later immediately and audit database access logs for signs of abnormal query patterns or data exfiltration.

Vendor Advisory

🟠 [HIGH] labredescefetrj/wegia

2 CVEs | CVSS 3.1: 9.1 | AAS 10.0

  • cpe:2.3:a:labredescefetrj:wegia:*:*:*:*:*:*:*:* (< 3.8.5)

WeGIA, a web management system for charitable institutions, is affected by 2 vulnerabilities prior to version 3.8.5, including at least one critical authentication bypass flaw (CVSS 9.1) where an unauthenticated attacker can invoke a GET endpoint to truncate core database tables containing member and personal records using a hardcoded key exposed in the public source repository. Organizations running WeGIA to manage donor, member, or beneficiary data face a severe risk of complete data destruction with no recovery path if backups are not in place. Upgrade to WeGIA 3.8.5 or later immediately, restrict public access to the application where possible, and verify that current database backups are available and tested.

Vendor Advisory

🟠 [HIGH] vendurehq/vendure

2 CVEs | CVSS 3.1: 9.1 | AAS 9.9

  • cpe:2.3:a:vendurehq:vendure:*:*:*:*:*:*:*:*

Vendure, an open-source headless commerce platform, is affected by 2 vulnerabilities prior to version 3.7.0, including at least one critical authentication bypass flaw (CVSS 9.1) where the external authentication service attaches new authentication methods to existing customer accounts based solely on email address without requiring email ownership verification, enabling account takeover. Organizations running Vendure storefronts with custom external authentication strategies such as social login or SSO should treat this as high priority, as attackers can hijack customer accounts and access order history, payment details, and personal information. Upgrade to Vendure 3.7.0 or later immediately and review authentication logs for suspicious external login activity linked to existing customer accounts.

Vendor Advisory

🟠 [HIGH] sgl-project/sglang

1 CVE | CVSS 4.0: 8.8 | AAS 9.7

  • cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*

SGLang through version 0.5.19, when running in prefill/decode disaggregation mode, contains an unauthenticated route poisoning vulnerability (CVSS 8.8) where attackers can manipulate the KV transfer routing table via an unprotected PUT endpoint to redirect decode workers to attacker-controlled servers, enabling denial of service or disclosure of session identifiers and internal topology metadata. Organizations deploying SGLang for large language model inference at scale should act immediately, as the endpoint requires no authentication and is accessible to any network-adjacent attacker. Upgrade beyond SGLang 0.5.19 when a fix is available, and in the interim restrict network access to the prefill bootstrap service to trusted internal hosts only.

Vendor Advisory