27 vulnerabilities across 10 products scored HIGH or above on September 26, 2026.

  • 🟠 HIGH: 27

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin.
  • [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin.
  • [UPGRADED] CVE-2026-92229 (wpmudev/forminator) — F1: exploitable → functional, AAS: 9.9 → 11.9 (HIGH → HIGH). Originally in 2026-09-19 bulletin.
  • [UPGRADED] CVE-2026-89274 (bootstrapped_ventures/wp_recipe_maker) — F1: exploitable → functional, AAS: 9.4 → 11.4 (HIGH → HIGH). Originally in 2026-09-19 bulletin.

🟠 [HIGH] flowiseai/flowise

3 CVEs | CVSS 4.0: 9.2 | AAS 11.3

  • cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

Flowise — SSO Authentication Bypass and Related Vulnerabilities

Flowise versions through 3.1.4, when running in Enterprise or platform mode with SSO enabled, are affected by three vulnerabilities, including at least one critical authentication bypass rated CVSS 9.2 HIGH. The most severe issue allows an attacker to exploit the SSO login path to bypass authentication entirely by leveraging how the system handles invited user accounts during SSO callbacks, trivially passing token and email verification checks that should prevent unauthorized access. Organizations running Flowise with SSO enabled in enterprise deployments should treat this as an urgent priority.

Security teams deploying Flowise in production should immediately review the vendor advisory at the GitHub Security Advisory linked above, upgrade to a patched version as soon as one is available, and audit SSO login activity for any signs of unauthorized account registration or access. Until a fix is applied, consider restricting SSO access or disabling the invitation workflow as a temporary mitigation.

Vendor Advisory

🟠 [HIGH] lomart.fr/up_plugin_for_joomla

4 CVEs | CVSS 4.0: 10.0 | AAS 10.9

  • cpe:2.3:a:lomart.fr:up_plugin_for_joomla:*:*:*:*:*:*:*:*

UP Plugin for Joomla (lomart.fr) — Unauthenticated Remote Code Installation

The UP plugin extension for Joomla by lomart.fr is affected by four vulnerabilities, including at least one critical unauthenticated remote code installation flaw rated CVSS 10.0 HIGH. Affected versions span 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, and the issues allow a remote attacker with no authentication to install arbitrary code on the target Joomla site. Any organization running Joomla with this extension should consider this an immediate priority.

Administrators should visit the vendor advisory at up.lomart.fr to obtain patched versions and upgrade without delay. If an immediate update is not possible, consider disabling or removing the UP plugin entirely until a fix can be applied, and review server logs for any signs of unauthorized code installation or suspicious activity.

Vendor Advisory

🟠 [HIGH] froxlor/froxlor

3 CVEs | CVSS 4.0: 9.4 | AAS 10.7

  • cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:* (< 2.3.11)

Froxlor Server Administration Panel — Path Traversal and Related Vulnerabilities

Froxlor versions 2.3.10 and earlier are affected by three vulnerabilities, including multiple high-severity issues with the most critical rated CVSS 9.4 HIGH. The lead vulnerability is a path traversal flaw in the customer data-export (DataDump) cron, where insufficient validation of intermediate path components allows an authenticated customer with the export feature enabled to schedule exports targeting arbitrary locations outside their home directory. Hosting providers and administrators running Froxlor to manage shared or multi-tenant server environments should treat this as urgent, as exploitation could compromise data belonging to other tenants or the server itself.

Administrators should review the vendor advisory on GitHub and upgrade Froxlor to a patched version as soon as one is available. As an interim mitigation, consider disabling the customer data-export feature and auditing scheduled export jobs for any suspicious destination paths.

Vendor Advisory

🟠 [HIGH] netty/netty

8 CVEs | CVSS 4.0: 8.7 | AAS 10.6

  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

Netty — HTTP/3 Codec Denial-of-Service and Related Vulnerabilities

Netty versions 4.2.0.Final through 4.2.17.Final are affected by eight vulnerabilities, including multiple high-severity issues with the most critical rated CVSS 8.7 HIGH. The lead vulnerability is a denial-of-service flaw in the HTTP/3 QPACK prefixed-integer decoder, where unbounded processing of continuation bytes allows a remote unauthenticated attacker to exhaust server resources by sending specially crafted data on a QPACK unidirectional stream. Any organization using Netty’s HTTP/3 codec in internet-facing services, including Java-based API gateways, microservices, and proxy infrastructure, should prioritize remediation.

Teams should upgrade Netty to a version beyond 4.2.17.Final that addresses these issues, consulting the vendor advisory on GitHub for patch details. Given the breadth of eight distinct vulnerabilities in this release cycle, a thorough review of all advisories is recommended to ensure full coverage, and organizations should monitor for updated releases addressing the complete set of reported flaws.

Vendor Advisory

🟠 [HIGH] themefic/ultra_addons_for_contact_form_7

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:themefic:ultra_addons_for_contact_form_7:*:*:*:*:*:*:*:*

Ultra Addons for Contact Form 7 (WordPress) — Unauthenticated Arbitrary File Upload

The Ultra Addons for Contact Form 7 plugin for WordPress versions up to and including 3.5.50 is affected by a critical arbitrary file upload vulnerability rated CVSS 9.8 HIGH. Insufficient file type validation in the PDF Generator module allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. While the vulnerable PDF Generator module is disabled by default, any site that has enabled it is immediately at risk.

WordPress administrators using this plugin should check whether the PDF Generator module is active and disable it immediately as a temporary mitigation. Update to a patched version as soon as one becomes available, and review server file systems for any unexpected or suspicious uploads that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] gohugoio/hugo

3 CVEs | CVSS 4.0: 8.7 | AAS 10.1

  • cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:* (>= 0.123.0, < 0.166.0)
  • cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:* (>= 0.161.0, < 0.166.0)
  • cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:* (>= 0.162.0, < 0.166.0)

Hugo Static Site Generator — Symlink Confinement Bypass and Related Vulnerabilities

Hugo versions after v0.123.0 and before v0.166.0 are affected by three vulnerabilities, including multiple high-severity issues with the most critical rated CVSS 8.7 HIGH. The lead vulnerability is a symlink confinement bypass where themes or modules could place a symlink at a mount root pointing to arbitrary directories outside the project, allowing files to be read during builds and potentially published to the output directory. Organizations using Hugo in CI/CD pipelines, automated build environments, or any context where untrusted or third-party themes and modules are used should treat this as a priority.

Teams should upgrade Hugo to version v0.166.0 or later, which addresses these issues. Additionally, audit any third-party themes and vendored modules for unexpected symlinks, particularly at mount root boundaries, and review published output for any files that should not have been included in prior builds.

Vendor Advisory

🟠 [HIGH] parse-community/parse-server

1 CVE | CVSS 4.0: 8.7 | AAS 9.8

  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (< 8.6.90)
  • cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (>= 9.0.0, < 9.10.1-alpha.9)

Parse Server — Query Operator Injection via Installation Record Deduplication

Parse Server versions prior to 8.6.90 and versions 9.0.0 through 9.10.1-alpha.8 are affected by a query operator injection vulnerability rated CVSS 8.7 HIGH. The device token deduplication logic for installation records fails to validate the type of client-supplied fields before building database queries, allowing an unauthenticated remote attacker who knows only the public application ID to inject query operators that can cause unintended mass deletion or modification of installation records. Any organization running Parse Server as a backend, particularly for mobile applications relying on push notification infrastructure, should assess their exposure promptly.

Teams should upgrade to Parse Server version 8.6.90 or 9.10.1-alpha.9 or later, as referenced in the vendor advisory on GitHub. As an interim measure, consider implementing input validation or request filtering at the API gateway level to reject non-string values in installation record fields.

Vendor Advisory

🟠 [HIGH] joomlaboat.com/youtube_gallery_extension_for_joomla

1 CVE | CVSS 4.0: 9.3 | AAS 9.7

  • cpe:2.3:a:joomlaboat.com:youtube_gallery_extension_for_joomla:*:*:*:*:*:*:*:*

YouTube Gallery Extension for Joomla (joomlaboat.com) — Unauthenticated SQL Injection

The YouTube Gallery extension for Joomla versions prior to 5.7.3 is affected by a critical unauthenticated SQL injection vulnerability rated CVSS 9.3 HIGH. The flaw exists in the video search and sorting functionality, allowing remote attackers without any authentication to inject SQL commands into read queries, potentially exposing sensitive database contents including user credentials and site configuration data. Any Joomla site running this extension should treat this as an immediate priority.

Administrators should upgrade the YouTube Gallery extension to version 5.7.3 or later as soon as possible by visiting the vendor site at joomlaboat.com. Sites that cannot update immediately should consider disabling the extension entirely, and all affected sites should audit database logs for signs of exploitation or unauthorized data access.

Vendor Advisory

🟠 [HIGH] kyverno/kyverno

1 CVE | CVSS 4.0: 9.4 | AAS 9.3

  • cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*

Kyverno — API Call URL Path Traversal Leading to Cluster-Wide Privilege Escalation

Kyverno versions prior to 1.19.1 are affected by a critical path traversal vulnerability rated CVSS 9.4 HIGH. Insufficient validation of URL-encoded path segments in Policy apiCall urlPath allows namespace tenants to bypass per-namespace restrictions and create objects in other namespaces using the admission-controller ServiceAccount’s privileges. An attacker can leverage percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, escalating privileges to full cluster admin. Any organization using Kyverno for Kubernetes policy enforcement in multi-tenant environments should treat this as an urgent priority.

Teams should upgrade Kyverno to version 1.19.1 or later immediately, as detailed in the vendor advisory on GitHub. Until the upgrade is applied, audit existing policies that use apiCall for suspicious URL-encoded path segments, and review cluster audit logs for unexpected object creation in the kyverno namespace or any MutatingWebhookConfiguration changes that may indicate prior exploitation.

Vendor Advisory

🟠 [HIGH] openclaw/openclaw

2 CVEs | CVSS 4.0: 8.9 | AAS 9.3

  • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* (>= 2026.4.5, < 2026.8.1)

OpenClaw Agent Gateway — DNS Rebinding Bypass via CDP Transport

OpenClaw versions 2026.4.5 through 2026.8.0 are affected by two vulnerabilities, including at least one high-severity DNS rebinding flaw rated CVSS 8.9 HIGH. The gateway validated DNS resolution for configured Chrome DevTools Protocol hostnames at check time, but WebSocket and Playwright transports performed independent DNS resolution afterward, creating a check-then-use gap that discards DNS pinning. An attacker who controls an approved CDP hostname or its DNS responses can exploit this window to rebind the hostname to an internal address, potentially gaining access to internal services or sensitive resources behind the gateway.

Teams using OpenClaw as an agent gateway with remote CDP connections should upgrade to version 2026.8.1 or later immediately, as detailed in the vendor advisory on GitHub. Until patched, restrict approved CDP hostnames to static IP addresses where possible, and monitor DNS resolution logs and CDP connection activity for anomalous rebinding patterns that may indicate exploitation attempts.

Vendor Advisory