32 vulnerabilities across 15 products scored HIGH or above on September 22, 2026.

  • 🔴 CRITICAL: 2
  • 🟠 HIGH: 30

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin.
  • [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin.

🔴 [CRITICAL] adobe/aem_6.5_forms_jee

1 CVE | CVSS 3.1: 10.0 | AAS 13.8

  • cpe:2.3:a:adobe:aem_6.5_forms_jee:*:*:*:*:*:*:*:*

Adobe Experience Manager 6.5 Forms JEE is affected by one critical vulnerability (CVE-2026-75745, CVSS 10.0) involving incorrect authorization that allows an attacker to execute arbitrary code in the context of the current user without any user interaction, with impact extending beyond the vulnerable component. Organizations running AEM Forms on JEE should treat this as an urgent priority given the maximum severity rating and the fact that the vulnerability is considered exploitable. Administrators should review Adobe’s advisory (APSB26-151) immediately and apply the available patches without delay.

Vendor Advisory

🔴 [CRITICAL] solarwinds/observability_self-hosted

2 CVEs | CVSS 3.1: 9.8 | AAS 12.9

  • cpe:2.3:a:solarwinds:observability_self-hosted:*:*:*:*:*:*:*:*

SolarWinds Observability Self-Hosted is affected by two critical vulnerabilities (max CVSS 9.8), including at least one unauthenticated remote code execution flaw stemming from insufficient integrity checks that impacts installations running in non-default, non-secure configurations. Functional exploit code is available, making this an immediate concern for any organization running self-hosted SolarWinds Observability deployments. Administrators should urgently review their deployment configurations against SolarWinds’ secure configuration guidance and apply all available patches to eliminate exposure.

Vendor Advisory

🟠 [HIGH] checkpoint/multi-domain_security_management

1 CVE | CVSS 3.1: 9.8 | AAS 11.9

  • cpe:2.3:a:checkpoint:multi-domain_security_management:*:*:*:*:*:*:*:* (>= r80, < r81.10)
  • cpe:2.3:a:checkpoint:quantum_security_management:*:*:*:*:*:*:*:* (>= r80, < r81.10)

Check Point Multi-Domain Security Management is affected by one high-severity vulnerability (CVE-2026-93616, CVSS 9.8) that allows an unauthenticated attacker to upload and execute arbitrary scripts on the Management Server via a directory traversal flaw. Functional exploit code is available, making this an immediate threat to any organization exposing Check Point management infrastructure. Administrators should apply the vendor-provided fix from Check Point’s support advisory (sk1000171) as a matter of urgency and verify that management interfaces are not accessible from untrusted networks.

Vendor Advisory

🟠 [HIGH] agronholm/anyio

1 CVE | CVSS 4.0: 9.3 | AAS 11.3

  • cpe:2.3:a:agronholm:anyio:*:*:*:*:*:*:*:*

AnyIO, a popular Python asynchronous concurrency and networking framework, is affected by one high-severity vulnerability (CVE-2026-63374, CVSS 9.3) in which connect_tcp() and TLSStream.wrap() improperly validate internationalized hostnames using IDNA 2003 instead of IDNA 2008, potentially allowing an attacker to bypass TLS certificate verification when connections to non-ASCII domains are hijacked or redirected. Teams using AnyIO in applications that connect to internationalized domain names should assess their exposure, particularly in environments where network-level redirection is a plausible threat. Update to AnyIO version 4.14.2 or later, which corrects the hostname validation behavior.

Vendor Advisory

🟠 [HIGH] qualcomm,_inc./snapdragon

1 CVE | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:qualcomm:snapdragon:*:*:*:*:*:*:*:*

Qualcomm Snapdragon chipsets are affected by one high-severity vulnerability (CVE-2026-25254, CVSS 9.8) involving improper authorization in the SocketIO interface that enables remote code execution without authentication. Given the massive footprint of Snapdragon across mobile devices, IoT hardware, and embedded systems, this vulnerability is relevant to a broad range of organizations and device manufacturers. Review Qualcomm’s May 2026 security bulletin for affected chipset models and apply the latest firmware updates from your device OEM as soon as they become available.

Vendor Advisory

🟠 [HIGH] adobe/campaign

12 CVEs | CVSS 3.1: 10.0 | AAS 10.8

  • cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:* (<= 7.4.3)

Adobe Campaign Classic is affected by 12 vulnerabilities (max CVSS 10.0), including at least one code injection flaw that allows an attacker to execute arbitrary code without user interaction, with impact extending beyond the vulnerable component. The volume and severity of these issues, combined with their exploitable status, make this a critical priority for any organization running Adobe Campaign for marketing automation and customer engagement workflows. Administrators should immediately consult Adobe’s advisory (APSB26-142) and apply all available patches across their Campaign Classic deployments.

Vendor Advisory

🟠 [HIGH] adobe/adobe_campaign_classic

3 CVEs | CVSS 3.1: 10.0 | AAS 10.8

  • cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:*

Adobe Campaign Classic is affected by three vulnerabilities (max CVSS 10.0), including at least one code injection flaw that enables arbitrary code execution without user interaction, with impact extending beyond the vulnerable component. These exploitable issues pose a serious risk to organizations relying on Campaign Classic for enterprise marketing operations and customer data management. Review Adobe’s advisory (APSB26-142) immediately and apply all available patches to affected Campaign Classic installations without delay.

Vendor Advisory

🟠 [HIGH] erlang/otp

2 CVEs | CVSS 4.0: 9.3 | AAS 10.6

  • cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:*

Erlang/OTP’s SSL library is affected by two high-severity vulnerabilities (max CVSS 9.3), including at least one TLS 1.3 authentication bypass where a malicious server can inject an unsolicited pre_shared_key extension in the ServerHello, causing the client to complete the handshake without validating the server’s certificate, effectively enabling server impersonation without any credentials. Any system built on Erlang/OTP that establishes outbound TLS 1.3 connections is potentially at risk, including messaging platforms, telecom infrastructure, and distributed databases such as RabbitMQ and CouchDB. Review the Erlang security advisories and update to a patched OTP release as soon as possible to restore proper entity authentication during key exchange.

Vendor Advisory

🟠 [HIGH] home-assistant/core

1 CVE | CVSS 4.0: 9.3 | AAS 10.4

  • cpe:2.3:a:home-assistant:core:*:*:*:*:*:*:*:*

Home Assistant Core prior to version 2026.7.0 is affected by one high-severity vulnerability (CVE-2026-91130, CVSS 9.3) in which the Statistics Graph card fails to sanitize entity names before rendering them as HTML in ECharts tooltips, allowing an authenticated user or a malicious integration to execute arbitrary scripts when a viewer hovers over a data point. This stored cross-site scripting flaw is particularly concerning in shared or multi-user Home Assistant environments and in deployments that incorporate third-party integrations with untrusted entity naming. Update to Home Assistant Core 2026.7.0 or later immediately to remediate this issue.

Vendor Advisory

🟠 [HIGH] github/enterprise_server

1 CVE | CVSS 4.0: 9.3 | AAS 10.4

  • cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*

GitHub Enterprise Server is affected by one high-severity vulnerability (CVE-2026-77987, CVSS 9.3) in the notebook viewer, where insufficient URL port validation enables a server-side request forgery that allows an attacker to direct requests to internal services on the appliance and extract instance secrets character by character using response timing as a side channel. This exploitable flaw is a serious concern for any organization running self-hosted GitHub Enterprise Server, as extracted secrets could be leveraged for further compromise of the appliance and connected infrastructure. Update to GitHub Enterprise Server 3.17.21 or the latest patched release for your version branch immediately and review appliance logs for signs of anomalous internal requests originating from the notebook viewer.

Vendor Advisory

🟠 [HIGH] wordpress/wordpress

1 CVE | CVSS 3.1: 8.1 | AAS 10.2

  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

WordPress core is affected by one high-severity vulnerability (CVE-2026-87902, CVSS 8.1) that allows an unauthenticated attacker to manipulate page template resolution to include arbitrary local PHP files outside the active theme directories, potentially leading to remote code execution when certain server and theme preconditions are met. Given WordPress’s massive install base and the unauthenticated, exploitable nature of this flaw, all WordPress site operators should treat this as an urgent priority. Apply the latest WordPress core update immediately and review your hosting environment and active theme for configurations that may satisfy the exploitation preconditions.

Vendor Advisory

🟠 [HIGH] ibm/financial_transaction_manager_(ftm) for_redhat_openshift

3 CVEs | CVSS 3.1: 9.9 | AAS 10.1

  • cpe:2.3:a:ibm:financial_transaction_manager_ftm_for_redhat_openshift:*:*:*:*:*:*:*:*

IBM Financial Transaction Manager (FTM) for Red Hat OpenShift is affected by three vulnerabilities (max CVSS 9.9), including at least one insecure deserialization flaw that allows a remote attacker to execute arbitrary code on affected systems. Financial institutions and enterprises running FTM on OpenShift should treat this as a critical priority given the near-maximum severity rating, exploitable status, and the sensitive nature of transaction processing workloads. Consult IBM’s support advisory (node 7288641) immediately and apply all available fixes across your FTM deployments.

Vendor Advisory

🟠 [HIGH] hkuds/lightrag

1 CVE | CVSS 3.1: 9.1 | AAS 9.9

  • cpe:2.3:a:hkuds:lightrag:*:*:*:*:*:*:*:*

LightRAG, an open-source retrieval-augmented generation framework, is affected by one high-severity vulnerability (CVE-2026-85734, CVSS 9.1) in which the login endpoint lacks rate limiting, account lockout, or any brute-force protection, allowing an attacker to guess credentials at full network speed and gain authenticated access to documents, the knowledge graph, and administrative functions. Teams deploying LightRAG as part of AI or RAG pipelines should assess their exposure immediately, particularly if the API server is network-accessible. Update to LightRAG version 1.5.5 or later to remediate this issue.

Vendor Advisory

🟠 [HIGH] gitroomhq/postiz-app

1 CVE | CVSS 3.1: 9.1 | AAS 9.9

  • cpe:2.3:a:gitroomhq:postiz-app:*:*:*:*:*:*:*:*

Postiz, an open-source social media scheduling application, is affected by one high-severity vulnerability (CVE-2026-94456, CVSS 9.1) in which all security-sensitive credentials including OAuth tokens, authorization codes, client secrets, API keys, and PKCE verifiers are generated using the predictable Math.random() function rather than a cryptographically secure source, allowing an attacker to reconstruct the PRNG state via the unauthenticated OAuth client registration endpoint and predict all generated secrets. Organizations self-hosting Postiz for social media management should consider this a serious risk, as successful exploitation could compromise all OAuth flows and API authentication across the platform. Review the vendor advisory and update to a patched version immediately, then rotate all existing OAuth credentials, API keys, and client secrets that were generated by affected installations.

Vendor Advisory

🟠 [HIGH] dokploy/dokploy

1 CVE | CVSS 3.1: 9.6 | AAS 9.7

  • cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*

Dokploy, a self-hostable Platform as a Service, is affected by one high-severity vulnerability (CVE-2026-86059, CVSS 9.6) in which organization members without Git provider access can retrieve plaintext credentials for GitHub, GitLab, Gitea, and Bitbucket integrations through unprotected API routes that return full provider records without proper authorization checks. This exploitable flaw is a significant risk for any team running Dokploy in multi-user or organization environments, as compromised Git provider credentials could grant attackers access to source code repositories and CI/CD pipelines. Update to Dokploy version 0.29.13 or later immediately and rotate all Git provider credentials that were configured in affected installations.

Vendor Advisory