1 vulnerability across 1 product scored HIGH or above on September 25, 2026.

  • 🟠 HIGH: 1

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin.
  • [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin.
  • [UPGRADED] CVE-2026-93603 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93605 (patriksimek/vm2) — F1: exploitable → functional, AAS: 12.7 → 14.7 (CRITICAL → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-93606 (patriksimek/vm2) — F1: theoretical → functional, AAS: 11.7 → 14.7 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-82340 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-81657 (ibm/guardium_data_protection) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.

🟠 [HIGH] netgate/pfsense_plus

1 CVE | CVSS 3.1: 8.5 | AAS 9.5

  • cpe:2.3:a:netgate:pfsense_plus:*:*:*:*:*:*:*:* (< 26.07)

Netgate pfSense Plus (before 26.07) and pfSense CE (before 2.9.0) are affected by one high-severity vulnerability (CVE-2026-97730, CVSS 8.5) involving a local file inclusion flaw in the web GUI Dashboard. An authenticated attacker who can modify Dashboard widget settings and write files to the system can exploit path traversal in the widget sequence handler to achieve arbitrary PHP code execution, potentially leading to full firewall compromise.

Network and security teams running pfSense in any capacity should prioritize this update immediately, as pfSense appliances typically sit at critical network boundaries. Upgrade to pfSense Plus 26.07 or pfSense CE 2.9.0 or later, and review the vendor advisory at docs.netgate.com for additional details.

Vendor Advisory