7 vulnerabilities across 6 products scored HIGH or above on September 24, 2026.

  • 🟠 HIGH: 7

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin.
  • [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin.
  • [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-82340 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-28326 (solarwinds/access_rights_manager) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-17 bulletin.

🟠 [HIGH] gitlab/gitlab

2 CVEs | CVSS 3.1: 9.9 | AAS 11.9

  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*

GitLab CE/EE versions 19.2 through 19.2.6, 19.3 through 19.3.2, and 19.4.0 are affected by 2 vulnerabilities, including at least one critical-severity flaw rated CVSS 9.9 that allows an authenticated user to achieve arbitrary code execution on the GitLab server by exploiting a double free condition when parsing crafted regular expressions in CI/CD configuration. These issues are considered exploitable and pose serious risk to any organization running self-managed GitLab instances. Security teams should upgrade immediately to GitLab 19.4.1, 19.3.3, or 19.2.7 per the vendor advisory at docs.gitlab.com.

Vendor Advisory

🟠 [HIGH] visualcomposer/visual_composer_website_builder

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:visualcomposer:visual_composer_website_builder:*:*:*:*:*:*:*:*

The Visual Composer Website Builder plugin for WordPress versions up to and including 45.16.0 is affected by a critical local file inclusion vulnerability rated CVSS 9.8 that allows unauthenticated attackers to include and execute arbitrary PHP files on the server via the vcv-template parameter, potentially leading to full site compromise, sensitive data exposure, and remote code execution. Any WordPress site running this plugin is at immediate risk, as no authentication is required to exploit this flaw. Site administrators should update the Visual Composer Website Builder plugin to version 45.17.0 or later immediately and review server logs for signs of exploitation.

Vendor Advisory

🟠 [HIGH] dokploy/dokploy

1 CVE | CVSS 3.1: 9.9 | AAS 10.1

  • cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:*

Dokploy, a self-hostable Platform as a Service, versions prior to 0.29.13 are affected by a critical command injection vulnerability rated CVSS 9.9 that allows an authenticated organization member with service read permission to execute arbitrary commands as root on the server by injecting shell metacharacters into the repoPath parameter. This is a severe risk for any organization running Dokploy, as exploitation requires only low-privilege authenticated access and results in full system compromise. Administrators should upgrade to Dokploy version 0.29.13 or later immediately and audit logs for unexpected command execution or unauthorized access.

Vendor Advisory

🟠 [HIGH] signoz/signoz

1 CVE | CVSS 4.0: 9.2 | AAS 9.5

  • cpe:2.3:a:signoz:signoz:*:*:*:*:*:*:*:*

SigNoz versions 0.8.0 through 0.142.x are affected by a critical authentication bypass vulnerability rated CVSS 9.2 in which the JWT signing secret defaults to an empty string and is not rejected during configuration validation, allowing an unauthenticated attacker to forge valid session tokens and gain full access to the observability platform. Any SigNoz deployment that has not explicitly configured the SIGNOZ_TOKENIZER_JWT_SECRET environment variable is vulnerable. Administrators should upgrade to SigNoz version 0.143.0 or later immediately, ensure a strong JWT secret is explicitly set, and review access logs for unauthorized activity.

Vendor Advisory

🟠 [HIGH] bittersecurity/decepticon

1 CVE | CVSS 3.1: 10.0 | AAS 9.3

  • cpe:2.3:a:bittersecurity:decepticon:*:*:*:*:*:*:*:* (< 1.1.17)

Bitter Security’s Decepticon autonomous red team agent versions prior to 1.1.17 is affected by a maximum-severity prompt injection vulnerability rated CVSS 10.0 in which unsanitized web crawl results containing ChatML special tokens are passed directly into LLM messages, allowing a hostile target to hijack the agent’s behavior and execute arbitrary actions with the agent’s full privileges. This is particularly dangerous under BYOK deployments using open-source model providers such as vLLM, Ollama, and LM Studio that do not filter special tokens, meaning any target being scanned can turn the red team tool against its operator. Red teams using Decepticon should upgrade to version 1.1.17 or later immediately and review past engagement logs for signs of prompt injection from scanned targets.

Vendor Advisory

🟠 [HIGH] termix-ssh/termix

1 CVE | CVSS 3.1: 9.1 | AAS 9.0

  • cpe:2.3:a:termix-ssh:termix:*:*:*:*:*:*:*:* (>= 2.4.1, < 2.5.1)

Termix, a web-based server management platform with SSH terminal and tunneling capabilities, versions 2.4.1 through 2.5.0 are affected by a critical command injection vulnerability rated CVSS 9.1 in which an authenticated administrator can inject arbitrary shell commands through the ACME SSL certificate request flow by storing malicious domain or email values that are unsafely interpolated into a certbot shell command via child_process.execSync. While exploitation requires administrator-level access, compromised admin credentials or a malicious insider could leverage this to execute arbitrary commands on the underlying server. Administrators should upgrade Termix to version 2.5.1 or later immediately and audit ACME SSL settings for any unexpected domain or email values.

Vendor Advisory