8 vulnerabilities across 6 products scored HIGH or above on September 27, 2026.

  • 🟠 HIGH: 8

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin.
  • [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin.

🟠 [HIGH] progressive_robot_ltd/hmailserver

1 CVE | CVSS 3.1: 9.8 | AAS 11.9

  • cpe:2.3:a:progressive_robot:hmailserver:*:*:*:*:*:*:*:* (>= 6.0.0, < 6.3.4)

Progressive Robot Ltd hMailServer — Critical Remote Code Execution

A critical vulnerability (CVE-2026-100741, CVSS 9.8) affects Progressive Robot Ltd’s hMailServer versions 6.0.0 through 6.3.3 on Windows. A remote, unauthenticated attacker can achieve arbitrary code execution within the hMailServer service process by sending a specially crafted password containing escape sequences during any standard logon attempt (SMTP AUTH, POP3, or IMAP), exploiting an eval injection flaw in the JScript event-script dispatcher. While exploitation requires that event scripting be enabled (a non-default configuration), any organization running affected versions with this feature active is at immediate risk of full service-account-level compromise.

Administrators running hMailServer 6.0 through 6.3.3 should immediately check whether event scripting is enabled and, if so, disable it as a temporary mitigation. Apply the vendor’s fix referenced in the GitLab commit advisory as soon as possible, and audit service account privileges to limit potential blast radius.

Vendor Advisory

🟠 [HIGH] patriksimek/vm2

2 CVEs | CVSS 4.0: 9.5 | AAS 11.3

  • cpe:2.3:a:patriksimek:vm2:*:*:*:*:*:*:*:*

patriksimek vm2 — Sandbox Escape via Module Resolution Bypass

Two vulnerabilities (CVE-2026-100721, CVE-2026-100722, max CVSS 9.5) affect vm2 prior to version 3.12.2, including at least one authorization bypass in the NodeVM external-module resolver. When a custom resolver is configured with host context, a missing path-separator boundary in the allowlist regex allows untrusted guest code to escape the sandbox by requiring modules from directories that share a prefix with an allowlisted path, potentially gaining access to host-level resources.

Teams running vm2 in any application that sandboxes untrusted JavaScript, particularly with custom external module resolution enabled, should upgrade to version 3.12.2 or later immediately. Note that vm2 has been broadly deprecated by its maintainer; organizations still relying on it should evaluate migration to actively maintained alternatives such as isolated-vm.

Vendor Advisory

🟠 [HIGH] nezhahq/nezha

1 CVE | CVSS 4.0: 9.3 | AAS 11.0

  • cpe:2.3:a:nezhahq:nezha:*:*:*:*:*:*:*:* (>= 2.2.3)

nezhahq Nezha — OAuth2 Redirect Hijack via Host Header Injection

A critical vulnerability (CVE-2026-101090, CVSS 9.3) affects Nezha server monitoring dashboard version 2.2.3 and earlier. When the optional dashboard_host setting is left empty, the OAuth2 redirect endpoint reflects an attacker-supplied Host header into the redirect_uri sent to the identity provider, enabling an attacker to hijack OAuth2 login flows and potentially capture authorization codes or session tokens from victims who initiate authentication through a crafted link.

Organizations running Nezha with OAuth2 authentication should upgrade beyond version 2.2.3 as soon as a fix is available. As an immediate mitigation, ensure the dashboard_host configuration value is explicitly set rather than left empty, and configure your reverse proxy to enforce a trusted Host header on all requests reaching the Nezha dashboard.

Vendor Advisory

🟠 [HIGH] wolfssl/wolfssl

2 CVEs | CVSS 4.0: 8.3 | AAS 9.5

  • cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:* (>= 5.6.6, < 5.7.6)

wolfSSL — TLS Certificate Verification Bypass via Trusted Peer Forgery

Two vulnerabilities (CVE-2026-93302, CVE-2026-89136, max CVSS 8.3) affect wolfSSL builds that enable the WOLFSSL_TRUST_PEER_CERT macro, including at least one flaw where the MatchTrustedPeer function ignores the actual public key during verification, allowing an attacker who knows the loaded CA certificates to forge clones that pass peer trust checks. The impact widens significantly when OPENSSL_COMPATIBLE_DEFAULTS is also defined, extending the vulnerable code path to all CA certificate loading functions. Successful exploitation undermines TLS mutual authentication guarantees and could allow man-in-the-middle attacks.

Teams embedding wolfSSL in IoT firmware, embedded devices, or server applications should review whether their builds enable the affected macros and apply the vendor’s fix immediately. Given that wolfSSL is widely used in resource-constrained environments where updates are difficult to deploy, organizations should prioritize firmware update planning and audit any systems relying on peer certificate trust for authentication.

Vendor Advisory

🟠 [HIGH] pnpm/pnpm

1 CVE | CVSS 4.0: 8.3 | AAS 9.5

  • cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:*:*:*

pnpm — Environment Variable Exfiltration via Malicious Workspace Configuration

A high-severity vulnerability (CVE-2026-101043, CVSS 8.3) affects pnpm versions 11.0.0 through 11.10.x and 10.7.0 through 10.34.4. The proxy configuration keys (httpProxy, httpsProxy, noProxy) in pnpm-workspace.yaml were not included in the safeguard that suppresses environment variable placeholder expansion for untrusted manifests, allowing an attacker who controls a repository to craft a workspace file that exfiltrates sensitive environment variables such as credentials and API tokens to an attacker-controlled proxy server when a developer runs pnpm install.

Development teams and CI/CD pipeline operators using affected pnpm versions should upgrade immediately to version 11.11.0 or 10.34.5 or later. Until patched, exercise caution when running pnpm install on untrusted or newly cloned repositories, and audit CI environments for sensitive variables that could be exposed through proxy redirection.

Vendor Advisory

🟠 [HIGH] project-monai/monai

1 CVE | CVSS 4.0: 8.6 | AAS 9.0

  • cpe:2.3:a:project-monai:monai:*:*:*:*:*:*:*:*

Project MONAI — OS Command Injection via Crafted Configuration Files

A high-severity vulnerability (CVE-2026-100844, CVSS 8.6) affects MONAI versions prior to 1.6.0, the open-source medical AI framework. The nnUNetV2Runner component passes user-controlled values from YAML configuration files and CLI arguments directly into shell commands without sanitization, allowing an attacker to achieve arbitrary OS command execution on both Linux and Windows systems by embedding shell metacharacters in fields such as dataset_name_or_id.

Research teams, healthcare organizations, and data scientists using MONAI for medical imaging workflows should upgrade to version 1.6.0 or later immediately. Until patched, avoid loading nnUNet configuration files from untrusted sources, and audit any shared or externally provided YAML configurations for unexpected values in dataset parameters.

Vendor Advisory