8 vulnerabilities across 6 products scored HIGH or above on September 25, 2026.

  • 🟠 HIGH: 8

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin.
  • [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin.
  • [UPGRADED] CVE-2026-92229 (wpmudev/forminator) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-09-19 bulletin.
  • [UPGRADED] CVE-2026-89274 (bootstrapped_ventures/wp_recipe_maker) — F1: exploitable → functional, AAS: 9.4 → 11.4 (HIGH → HIGH). Originally in 2026-09-19 bulletin.
  • [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-82340 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.

🟠 [HIGH] gestsup/gestsup

1 CVE | CVSS 4.0: 9.2 | AAS 10.2

  • cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:* (< 3.2.61)

GestSup versions prior to 3.2.61 are affected by one high-severity vulnerability (CVSS 9.2) involving remote code execution through the basic IMAP connector. The flaw allows unauthenticated attackers to send crafted emails with PHP file attachments to monitored mailboxes, bypassing blocked extension checks, resulting in the malicious files being written to a web-accessible directory where they can be directly executed. Organizations running GestSup with IMAP-based ticket intake should treat this as an urgent priority and update to version 3.2.61 or later immediately by referring to the vendor changelog at gestsup.fr.

Vendor Advisory

🟠 [HIGH] zammad/zammad

2 CVEs | CVSS 4.0: 9.1 | AAS 9.9

  • cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:* (< 7.1.2)

Zammad versions prior to 7.1.2 are affected by two high-severity vulnerabilities (max CVSS 9.1), including at least one that allows account takeover through the SSO automatic account linking feature. When automatic account linking is enabled, an attacker controlling any identity at a configured provider can bind to an existing local account by spoofing an unverified email address, effectively hijacking user accounts without ownership confirmation. Organizations using Zammad with SSO integration should upgrade to version 7.1.2 or later immediately and review SSO account linking settings as referenced in the vendor’s GitHub advisory.

Vendor Advisory

🟠 [HIGH] kovid_goyal/kitty

1 CVE | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:kovid_goyal:kitty:*:*:*:*:*:*:*:*

Kitty terminal emulator versions 0.47.3 through 0.48.x are affected by one high-severity vulnerability (CVSS 9.3) that enables arbitrary command execution in the user’s shell. The flaw exists in the colour control escape code handler, which reflects unrecognised field names back into terminal reply sequences without sanitization, allowing a malicious program or content writing to the terminal to inject and execute arbitrary shell commands. Developers and system administrators using Kitty should upgrade to version 0.49.0 or later immediately, as referenced in the vendor’s GitHub commit.

Vendor Advisory

🟠 [HIGH] mhdzumair/mediaflow-proxy

1 CVE | CVSS 4.0: 8.8 | AAS 9.5

  • cpe:2.3:a:mhdzumair:mediaflow-proxy:*:*:*:*:*:*:*:* (< 2.4.10)

MediaFlow Proxy versions through 2.4.9 are affected by one high-severity vulnerability (CVSS 8.8) involving server-side request forgery in the proxy routes. Due to missing and incomplete validation of the destination query parameter, remote attackers can force the proxy to make requests to arbitrary internal URLs including loopback addresses and cloud metadata endpoints, potentially exposing sensitive infrastructure credentials and configuration data. Organizations running MediaFlow Proxy, particularly in cloud environments, should update to a patched version as soon as one is available and review the vendor’s GitHub repository for remediation guidance.

Vendor Advisory

🟠 [HIGH] netgate/pfsense_plus

1 CVE | CVSS 3.1: 8.5 | AAS 9.5

  • cpe:2.3:a:netgate:pfsense_plus:*:*:*:*:*:*:*:* (< 26.07)

Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0 are affected by one high-severity vulnerability (CVSS 8.5) involving local file inclusion in the Dashboard widget handling. An authenticated attacker with privileges to modify Dashboard settings and write files to the system can exploit path traversal in the widget sequence parameter to include and execute arbitrary PHP code on the firewall. Network administrators running affected pfSense installations should upgrade to pfSense Plus 26.07 or pfSense CE 2.9.0 immediately and review the vendor’s security advisory at docs.netgate.com for full details.

Vendor Advisory

🟠 [HIGH] rabbitmq/rabbitmq-server

2 CVEs | CVSS 4.0: 7.6 | AAS 9.2

  • cpe:2.3:a:rabbitmq:rabbitmq-server:*:*:*:*:*:*:*:* (>= 3.13.0, < 3.13.18)
  • cpe:2.3:a:rabbitmq:rabbitmq-server:*:*:*:*:*:*:*:* (>= 4.0.0, < 4.0.23)
  • cpe:2.3:a:rabbitmq:rabbitmq-server:*:*:*:*:*:*:*:* (>= 4.1.0, < 4.1.14)
  • cpe:2.3:a:rabbitmq:rabbitmq-server:*:*:*:*:*:*:*:* (>= 4.2.0, < 4.2.9)
  • cpe:2.3:a:rabbitmq:rabbitmq-server:*:*:*:*:*:*:*:* (>= 4.3.0, < 4.3.3)

RabbitMQ Server versions 4.2.0 through 4.2.7 and 4.3.0 through 4.3.1 are affected by two high-severity vulnerabilities (max CVSS 7.6), including at least one that enables cross-site scripting through the OAuth bootstrap flow in the management UI. When OAuth is enabled, attacker-controlled token content from the Authorization header or access token cookie is inserted into JavaScript without escaping, allowing arbitrary script execution in the management UI context. Teams running RabbitMQ with OAuth-enabled management interfaces should upgrade to version 4.2.8 or 4.3.2 immediately, as referenced in the vendor’s GitHub advisory.

Vendor Advisory