33 vulnerabilities across 15 products scored HIGH or above on September 18, 2026.

  • 🔴 CRITICAL: 3
  • 🟠 HIGH: 30

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin.

🔴 [CRITICAL] patriksimek/vm2

3 CVEs | CVSS 4.0: 10.0 | AAS 12.7

  • cpe:2.3:a:patriksimek:vm2:*:*:*:*:*:*:*:* (< 3.12.1)

vm2 by patriksimek — 3 Critical Vulnerabilities Including Sandbox Escape

vm2 versions through 3.12.0 are affected by three critical vulnerabilities, including multiple sandbox escape flaws rated CVSS 10.0. The most severe issue involves incorrect handling of a nullish receiver in the bridge proxy’s apply trap, allowing sandboxed code to obtain a reference to the host realm’s global object and achieve full sandbox escape with arbitrary code execution on the host. Any application relying on vm2 to isolate untrusted JavaScript — including template engines, plugin systems, and server-side code evaluation — should treat this as an immediate priority. Teams should upgrade to vm2 3.12.1 or later without delay and review the vendor advisory at the linked GitHub Security Advisory for full details on all three CVEs.

Vendor Advisory

🔴 [CRITICAL] icinga/icinga2

2 CVEs | CVSS 3.1: 9.8 | AAS 12.3

  • cpe:2.3:a:icinga:icinga2:*:*:*:*:*:*:*:* (>= 2.8, < 2.14.9)
  • cpe:2.3:a:icinga:icinga2:*:*:*:*:*:*:*:* (>= 2.15.0, < 2.15.4)
  • cpe:2.3:a:icinga:icinga2:*:*:*:*:*:*:*:* (>= 2.16.0, < 2.16.2)

Icinga 2 — 2 Critical Vulnerabilities Including Certificate Trust Bypass

Icinga 2 versions 2.8 through 2.14.8, 2.15.0 through 2.15.3, and 2.16.0 through 2.16.1 are affected by two critical vulnerabilities, including at least one rated CVSS 9.8, that allow an unauthenticated attacker with network access to TCP port 5665 to replace node and CA certificates via unvalidated JSON-RPC messages, enabling full node impersonation and takeover. Organizations running Icinga 2 for infrastructure monitoring should treat this as an urgent priority, as exploitation requires no authentication and grants an attacker control over monitored nodes. Upgrade immediately to Icinga 2 versions 2.14.9, 2.15.4, or 2.16.2, and restrict network access to port 5665 to trusted hosts as an interim mitigation.

Vendor Advisory

🟠 [HIGH] agronholm/anyio

1 CVE | CVSS 3.1: 9.5 | AAS 11.3

  • cpe:2.3:a:agronholm:anyio:*:*:*:*:*:*:*:* (>= 3.0.0, < 4.10.0)

AnyIO — 1 High-Severity Vulnerability in TLS Certificate Validation

AnyIO’s connect_tcp() and TLSStream.wrap() functions are affected by a TLS certificate validation flaw (CVE-2026-63374, CVSS 9.5) where services using internationalized (non-ASCII) domain names can be spoofed by an attacker who obtains a legitimate certificate under the IDNA 2003 encoding of the target domain. Any Python application using AnyIO for TLS connections to internationalized domain names should evaluate exposure, particularly in environments where DNS hijacking or network-level redirection is a concern. Review the vendor advisory at the linked GitHub Security Advisory and upgrade to the patched version of AnyIO as soon as it is available.

Vendor Advisory

🟠 [HIGH] ibm/guardium_data_protection

13 CVEs | CVSS 3.1: 9.9 | AAS 11.1

  • cpe:2.3:a:ibm:guardium_data_protection:*:*:*:*:*:*:*:* (>= 12.2)

IBM Guardium Data Protection — 13 Vulnerabilities Including Authentication Bypass

IBM Guardium Data Protection version 12.2 is affected by 13 vulnerabilities, including multiple critical issues rated up to CVSS 9.9, with the most severe allowing a remote attacker to bypass authentication entirely via the exposed ChangeTrackerServlet. Organizations using Guardium Data Protection for database security and compliance monitoring should treat this as an urgent priority, as successful exploitation could undermine the integrity of the very platform responsible for safeguarding sensitive data. Apply the fixes documented in IBM’s support advisory at the linked URL immediately, and audit Guardium appliance access logs for any signs of unauthorized servlet access.

Vendor Advisory

🟠 [HIGH] internlm/lmdeploy

2 CVEs | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*

LMDeploy — 2 High-Severity Vulnerabilities Including Remote Code Execution via Pickle Deserialization

LMDeploy versions 0.9.2 through 0.15.x are affected by two critical vulnerabilities, including at least one rated CVSS 9.8, where the PyTorch DistServe control plane deserializes untrusted messages via Python pickle over a ZeroMQ PULL socket, enabling an attacker to achieve arbitrary code execution on the serving infrastructure. Any organization deploying LMDeploy for large language model inference, particularly in distributed or disaggregated serving configurations, should treat this as an immediate priority given the ease of exploitation and full system compromise potential. Upgrade to LMDeploy version 0.16.0 or later without delay, and restrict network access to DistServe control plane endpoints as an interim mitigation.

Vendor Advisory

🟠 [HIGH] strukturag/libheif

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:strukturag:libheif:*:*:*:*:*:*:*:* (>= 1.22.0, < 1.23.2)

libheif — 1 Critical Vulnerability in HEIF/AVIF Image Processing

libheif versions 1.22.0 through 1.23.1 are affected by a critical heap buffer overflow vulnerability (CVE-2026-84383, CVSS 9.8) where a crafted HEIF, HEIC, or AVIF file with nested item references can cause a bit-depth mismatch during Alpha plane scaling, resulting in an out-of-bounds write. Any application or system that processes user-supplied HEIF or AVIF images using libheif should treat this as an urgent priority, including image viewers, media pipelines, content management systems, and mobile platforms, as exploitation requires only that a victim open a malicious image file. Upgrade to libheif version 1.23.2 or later immediately, and consider restricting HEIF/AVIF processing of untrusted content until the patch is deployed.

Vendor Advisory

🟠 [HIGH] fluidsynth/fluidsynth

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:fluidsynth:fluidsynth:*:*:*:*:*:*:*:* (>= 1.1.2, < 2.5.6)

FluidSynth — 1 Critical Vulnerability in Command Handler

FluidSynth versions 1.1.2 through 2.5.5 are affected by a critical heap-based out-of-bounds write vulnerability (CVE-2026-58264, CVSS 9.8) where the pitch_bend_range command handler fails to validate the channel argument, allowing an attacker to write arbitrary values to out-of-bounds heap memory, potentially achieving remote code execution. The issue is remotely exploitable when FluidSynth’s TCP command server is enabled, making any deployment exposing this interface to untrusted networks an immediate target. Upgrade to FluidSynth version 2.5.6 or later without delay, and disable the TCP server interface on any instance where it is not strictly required.

Vendor Advisory

🟠 [HIGH] kcp-dev/kcp

1 CVE | CVSS 3.1: 9.9 | AAS 10.2

  • cpe:2.3:a:kcp-dev:kcp:*:*:*:*:*:*:*:* (< 0.31.4)
  • cpe:2.3:a:kcp-dev:kcp:*:*:*:*:*:*:*:* (>= 0.32.0, < 0.32.2)

kcp — 1 Critical Privilege Escalation via Identity Header Injection

kcp versions prior to 0.31.4 and 0.32.2 are affected by a critical privilege escalation vulnerability (CVE-2026-61682, CVSS 9.9) where the front-proxy fails to strip inbound X-Remote-User, X-Remote-Group, and X-Remote-Extra-* identity headers before forwarding requests to backend shards, allowing any authenticated tenant to inject headers such as X-Remote-Group: system:masters and gain full cluster-admin privileges. Organizations using kcp as a multi-tenant Kubernetes-like control plane should treat this as an immediate priority, as any authenticated user can trivially escalate to unrestricted administrative access across all workspaces. Upgrade to kcp version 0.31.4 or 0.32.2 immediately, and review audit logs for any requests containing unexpected X-Remote-Group or X-Remote-Extra headers that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] pgpartman/pg_partman

1 CVE | CVSS 3.1: 9.9 | AAS 10.2

  • cpe:2.3:a:pgpartman:pg_partman:*:*:*:*:*:*:*:* (< 5.5.0)

pg_partman — 1 Critical SQL Injection Leading to Privilege Escalation

pg_partman versions prior to 5.5.0 are affected by a critical SQL injection vulnerability (CVE-2026-61781, CVSS 9.9) where the time_encoder configuration value in part_config is interpolated into dynamically executed SQL without proper identifier quoting, allowing any role with standard partman_user privileges to inject arbitrary SQL that is later executed by the pg_partman background worker under its elevated privileges. Any PostgreSQL deployment using pg_partman for automated time-based or ID-based table partitioning should treat this as an immediate priority, as exploitation enables full privilege escalation through a routine operational role. Upgrade to pg_partman version 5.5.0 or later without delay, and audit the part_config table for any suspicious time_encoder values that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] mojolicious/mojo

1 CVE | CVSS 4.0: 8.7 | AAS 10.1

  • cpe:2.3:a:mojolicious:mojo:*:*:*:*:*:*:*:* (< 9.47)

Mojolicious — 1 High-Severity Denial of Service via JSON Parsing

Mojolicious versions prior to 9.47 are affected by a denial-of-service vulnerability (CVE-2026-68914, CVSS 8.7) where the pure-Perl Mojo::JSON implementation does not enforce nesting depth limits when parsing untrusted JSON input, allowing an attacker to submit deeply nested arrays or objects that trigger unbounded recursion, memory exhaustion, and process crashes. Any Perl web application using Mojolicious without the Cpanel::JSON::XS backend — including those with MOJO_NO_JSON_XS enabled — is vulnerable wherever untrusted JSON is accepted via decode_json, from_json, or the j helper. Upgrade to Mojolicious version 9.47 or later, or ensure the Cpanel::JSON::XS backend is installed and active as an immediate mitigation.

Vendor Advisory

🟠 [HIGH] arnasdon/wacrm

1 CVE | CVSS 3.1: 9.9 | AAS 10.1

  • cpe:2.3:a:wacrm:wacrm:*:*:*:*:*:*:*:* (< 0.7.1)

WACRM — 1 Critical Privilege Escalation and Cross-Tenant Access Vulnerability

WACRM versions 0.7.0 and earlier are affected by a critical vulnerability (CVE-2026-77240, CVSS 9.9) involving a flawed row-level security policy that allows any authenticated user to modify their own account role and tenant association, enabling self-promotion from viewer to administrator and unauthorized access to other tenants’ data, compounded by SECURITY DEFINER functions that accept unsanitized input for cross-tenant data extraction. Any organization self-hosting WACRM as a WhatsApp CRM should treat this as an immediate priority, as exploitation trivially breaks tenant isolation and grants full administrative control over the platform. Apply the fix from the referenced commit as soon as possible, and audit user account roles and tenant assignments for any unauthorized changes that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] 1panel-dev/cordyscrm

1 CVE | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:* (< 1.7.2)

CordysCRM — 1 High-Severity Unauthenticated SSE Event Hijacking Vulnerability

CordysCRM versions prior to 1.7.2 are affected by a high-severity vulnerability (CVE-2026-63647, CVSS 9.3) where the SSE endpoints for subscribe, broadcast, and close are publicly accessible without authentication and trust a caller-controlled userId parameter, allowing an unauthenticated attacker to subscribe to any user’s event stream and intercept workflow events, approval notifications, and other sensitive real-time data. Organizations using CordysCRM for customer relationship management should treat this as an immediate priority, as exploitation requires no credentials and can expose confidential business communications across all users. Upgrade to CordysCRM version 1.7.2 or later without delay, and review access logs for any unusual activity against the /sse/ endpoints.

Vendor Advisory

🟠 [HIGH] mongodb_inc./mongoid

3 CVEs | CVSS 4.0: 9.2 | AAS 9.7

  • cpe:2.3:a:mongodb:mongoid:*:*:*:*:*:*:*:*

Mongoid — 3 High-Severity Vulnerabilities Including Server-Side JavaScript Injection

Mongoid, the official MongoDB ODM for Ruby, is affected by three high-severity vulnerabilities rated up to CVSS 9.2, including multiple issues where string-typed query criteria are passed directly to the database as server-side JavaScript expressions without neutralization, allowing an unauthenticated attacker who can influence query parameters to execute arbitrary code within the database engine, leading to data disclosure, unauthorized document manipulation, and denial of service. Any Ruby application using Mongoid to interact with MongoDB should treat this as an urgent priority, particularly web applications that incorporate user input into database queries. Review the vendor advisory at the linked MongoDB JIRA ticket, apply the latest Mongoid patches immediately, and audit application code for any query paths where untrusted input may reach Mongoid’s query builder.

Vendor Advisory

🟠 [HIGH] modeltc/lightllm

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:modeltc:lightllm:*:*:*:*:*:*:*:*

LightLLM — 1 High-Severity Authentication Bypass in Node Registration

LightLLM versions through 1.2.0 are affected by a high-severity authentication bypass vulnerability (CVE-2026-93839, CVSS 9.3) where the /pd_register WebSocket endpoint accepts unauthenticated node registration requests without validating peer addresses, allowing an attacker to register rogue nodes that intercept user prompts in transit, replace legitimate serving nodes to cause denial of service, or abuse the PD Master to issue server-side requests to internal network addresses. Any organization deploying LightLLM for large language model inference should treat this as an immediate priority, as exploitation requires no credentials and can compromise both the confidentiality of user inputs and the availability of the serving infrastructure. Restrict network access to the /pd_register endpoint to trusted hosts immediately, monitor the vendor repository for a patched release, and audit node registration logs for any unauthorized entries.

Vendor Advisory

🟠 [HIGH] stacklok/toolhive

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:stacklok:toolhive:*:*:*:*:*:*:*:* (< 0.38.0)

ToolHive — 1 High-Severity Container Network Isolation Bypass

ToolHive CLI versions prior to 0.30.1 and ToolHive Studio versions prior to 0.38.0 are affected by a high-severity vulnerability (CVE-2026-58197, CVSS 8.8) where locally run MCP server containers operate without network isolation by default, enabling a malicious or compromised container to access host-local services via host.docker.internal and reach unauthenticated ToolHive API and MCP proxy endpoints, potentially allowing lateral movement, data exfiltration, or control of other managed MCP servers. Any team using ToolHive to deploy and manage Model Context Protocol servers should treat this as a high priority, as the lack of network segmentation and authentication means a single compromised container can pivot across the host environment. Upgrade to ToolHive CLI 0.30.1 or ToolHive Studio 0.38.0 immediately, and review running container configurations to ensure proper network isolation is enforced.

Vendor Advisory