3 vulnerabilities across 2 products scored HIGH or above on September 20, 2026.

  • 🟠 HIGH: 3

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin.

🟠 [HIGH] oisf/suricata

2 CVEs | CVSS 3.1: 9.4 | AAS 10.9

  • cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:* (>= 8.0.0, < 8.0.7)

OISF Suricata versions prior to 8.0.7 are affected by two vulnerabilities, including at least one rated CVSS 9.4 (HIGH), which involves a use-after-free condition in the HTTP/2 multi-buffer handling triggered when transactions are inspected by specific rule combinations using http.response_header with and without a transform. These flaws are exploitable and pose a serious risk to any organization running Suricata as a network intrusion detection or prevention system, as successful exploitation could compromise the integrity of traffic inspection or lead to denial of service.

Security teams deploying Suricata should upgrade to version 8.0.7 or later immediately and review the vendor advisory at forum.suricata.io for full details on affected configurations and any required rule adjustments.

Vendor Advisory

🟠 [HIGH] comfast/cf-n1-s

1 CVE | CVSS 4.0: 9.3 | AAS 9.1

  • cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*

Comfast CF-N1-S firmware version 2.6.0.1 is affected by one vulnerability rated CVSS 9.3 (HIGH), a remotely exploitable stack-based buffer overflow in the web management interface’s mbox-config CGI handler. Exploit code has been publicly disclosed, making this an immediate concern for any organization deploying these devices, particularly in network edge or access point roles.

Administrators should restrict remote access to the device’s web management interface, monitor for vendor firmware updates, and apply network segmentation to limit exposure until a patch is available.

Vendor Advisory