18 vulnerabilities across 9 products scored HIGH or above on September 28, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 17

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-82901 (themefic/ultra_addons_for_contact_form_7) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-26 bulletin.
  • [UPGRADED] CVE-2026-93577 (gitlab/gitlab) — F1: exploitable → functional, AAS: 11.9 → 13.9 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-12227 (visualcomposer/visual_composer_website_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-24 bulletin.
  • [UPGRADED] CVE-2026-28325 (solarwinds/observability_self-hosted) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-09-22 bulletin.
  • [UPGRADED] CVE-2026-77521 (1panel-dev/maxkb) — F1: exploitable → functional, AAS: 11.2 → 13.2 (HIGH → CRITICAL). Originally in 2026-09-21 bulletin.

🔴 [CRITICAL] apache_software_foundation/apache_roller

5 CVEs | CVSS 3.1: 9.9 | AAS 13.4

  • cpe:2.3:a:apache:apache_roller:*:*:*:*:*:*:*:*

Apache Roller is affected by five vulnerabilities, including at least one critical-severity issue (CVSS 9.9) involving deserialization of untrusted data at the XML-RPC endpoint, which allows unauthenticated remote code execution without any non-default configuration. A functional exploit exists for this cluster, making active exploitation highly likely. Organizations running Apache Roller 6.1.5 or earlier should review the vendor advisory at the linked GitHub pull request immediately, apply available patches or mitigations, and consider disabling or restricting access to the XML-RPC servlet as an interim measure.

Vendor Advisory

🟠 [HIGH] apple/ios_and_ipados

1 CVE | CVSS 3.1: 8.8 | AAS 11.1

  • cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*

Apple iOS, iPadOS, and macOS are affected by a high-severity out-of-bounds write vulnerability (CVSS 8.8) that allows arbitrary code execution when a user processes a maliciously crafted file. Apple has confirmed this flaw has been exploited in the wild as part of an extremely sophisticated targeted attack against specific individuals running iOS versions prior to iOS 27. All organizations and individuals running affected Apple devices should immediately update to iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, or macOS Tahoe 26.7.1 by reviewing the vendor advisory at the linked Apple support page.

Vendor Advisory

🟠 [HIGH] canonical/lxd

3 CVEs | CVSS 3.1: 9.9 | AAS 11.1

  • cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*

Canonical LXD versions 4.0 and later are affected by three vulnerabilities, including at least one critical-severity flaw (CVSS 9.9) that allows an authenticated client with instance or storage volume creation privileges to exploit improper symlink resolution in the migration receive path, writing attacker-controlled files to arbitrary host paths as root and achieving full host compromise. These issues are considered exploitable and affect any Linux environment running vulnerable LXD versions. Administrators should immediately upgrade to LXD 4.0.14, 5.0.10, 5.21.8, or 6.10 and review the vendor security advisory on GitHub for additional mitigation guidance.

Vendor Advisory

🟠 [HIGH] rancher/rancher

1 CVE | CVSS 3.1: 9.6 | AAS 10.7

  • cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*

SUSE Rancher is affected by a high-severity vulnerability (CVSS 9.6) that allows unauthenticated remote attackers to modify public UI settings and execute a stored cross-site scripting attack through the Rancher management console. This flaw impacts Rancher versions 2.11 through 2.15 across multiple release branches and could allow attackers to compromise administrator sessions or gain control of managed Kubernetes clusters. Organizations running affected versions should upgrade immediately to Rancher 2.15.2, 2.14.6, 2.13.10, 2.12.14, or 2.11.18 and review the vendor security advisory on GitHub for further details.

Vendor Advisory

🟠 [HIGH] axios/axios

4 CVEs | CVSS 4.0: 8.3 | AAS 10.4

  • cpe:2.3:a:axios:axios:*:*:*:*:*:*:*:*

Axios, the widely used promise-based HTTP client for browsers and Node.js, is affected by four vulnerabilities, including at least one high-severity flaw (CVSS 8.3) involving prototype pollution that allows attackers to manipulate serialization options in the toFormData function, potentially altering request behavior, forcing request failures, or enabling further exploitation. These issues affect Axios versions 0.28.0 through 0.34.0 and 1.15.1 through 1.20.0, and are considered exploitable, making them a concern for any application relying on Axios for HTTP requests. Development and security teams should update to patched versions immediately and review the linked commit on GitHub for remediation details.

Vendor Advisory

🟠 [HIGH] nestjs/nest

1 CVE | CVSS 3.1: 7.5 | AAS 9.3

  • cpe:2.3:a:nestjs:nest:*:*:*:*:*:*:*:* (< 11.2.4)
  • cpe:2.3:a:nestjs:nest:*:*:*:*:*:*:*:* (>= 12.0.0, < 12.0.2)

NestJS, a popular framework for building server-side Node.js applications, is affected by a high-severity denial-of-service vulnerability (CVSS 7.5) in which a single message containing a deeply nested object pattern can crash microservices using the TCP or RabbitMQ transport by triggering an unhandled stack overflow in JSON.stringify during handler lookup. This flaw is considered exploitable and requires no authentication, meaning any attacker able to send messages to an exposed NestJS microservice can terminate it. Teams running NestJS microservices on TCP or RabbitMQ transports should upgrade immediately to version 11.2.4 or 12.0.2 and review the linked commit on GitHub for patch details.

Vendor Advisory

🟠 [HIGH] ordasoft.com/real_estate_manager_(free)_extension_for_joomla

1 CVE | CVSS 4.0: 9.3 | AAS 9.2

  • cpe:2.3:a:ordasoft.com:real_estate_manager_free_extension_for_joomla:*:*:*:*:*:*:*:* (< 6.7.9)

The Real Estate Manager (Free) extension for Joomla by OrdaSoft is affected by a high-severity unauthenticated SQL injection vulnerability (CVSS 9.3) in which the order_field request parameter is concatenated directly into ORDER BY clauses across multiple frontend property-listing queries without any input validation or allow-listing. This flaw is exploitable by any unauthenticated remote attacker and could allow full database extraction or further compromise of the underlying Joomla installation. Site administrators running Real Estate Manager (Free) versions prior to 6.7.9 should update immediately and review their environments for signs of exploitation.

Vendor Advisory

🟠 [HIGH] suse/rancher

1 CVE | CVSS 3.1: 8.8 | AAS 9.1

  • cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*

SUSE Rancher Manager is affected by a high-severity vulnerability (CVSS 8.8) in which the Fleet agent writes resources to downstream clusters using its own cluster-admin credentials rather than the scoped ServiceAccount pinned to the deployment, allowing tenants in shared multi-cluster environments to overwrite configuration files belonging to other teams. This privilege escalation flaw is particularly concerning for organizations running multi-tenancy setups where privileged or untrusted teams share the same downstream Kubernetes clusters. Administrators running affected versions of SUSE Rancher Fleet 0.16 and related branches should review the vendor security advisory on GitHub and upgrade to patched releases immediately.

Vendor Advisory

🟠 [HIGH] nginxproxymanager/nginx-proxy-manager

1 CVE | CVSS 4.0: 9.1 | AAS 9.0

  • cpe:2.3:a:nginxproxymanager:nginx-proxy-manager:*:*:*:*:*:*:*:*

Nginx Proxy Manager through version 2.16.0 is affected by a high-severity vulnerability (CVSS 9.1) in which authentication endpoints lack rate limiting, allowing unauthenticated attackers to perform unlimited brute-force attempts against login credentials and even TOTP two-factor codes to gain full administrative control. This flaw is especially dangerous for internet-exposed instances, as no special access is required to begin an attack. Administrators should restrict network access to the management interface immediately, monitor authentication logs for brute-force activity, and watch the vendor’s GitHub repository for a patched release.

Vendor Advisory