Live feed All digests
← 2026-06-21 2026-09-18

Security Digest — 2026-09-18

14099
Total vulnerabilities
948
Critical
5294
High
8
Actively exploited

Top vulnerabilities

CVE / IDTitleSeverityCVSSSourceDate
CVE-2026-14560The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a clCRITICAL10.0NVD2026-09-11
CVE-2026-80462A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gainCRITICAL10.0NVD2026-09-11
CVE-2026-87985An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ACRITICAL10.0NVD2026-09-11
CVE-2026-87986An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using sCRITICAL10.0NVD2026-09-11
CVE-2026-87987An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using eCRITICAL10.0NVD2026-09-11
CVE-2026-87988An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commaCRITICAL10.0NVD2026-09-11
CVE-2026-82617The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDCRITICAL10.0NVD2026-09-11
CVE-2026-85706GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 1CRITICAL10.0NVD2026-09-12
CVE-2026-81648The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX CRITICAL10.0NVD2026-09-13
CVE-2026-82434Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.paylCRITICAL10.0NVD2026-09-14
CVE-2026-65381A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the proCRITICAL10.0NVD2026-09-14
CVE-2026-59971MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2CRITICAL10.0NVD2026-09-15
CVE-2026-53710MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_saCRITICAL10.0NVD2026-09-15
CVE-2026-71133Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). SuppCRITICAL10.0NVD2026-09-15
CVE-2026-83020Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized ThirdCRITICAL10.0NVD2026-09-15
CVE-2026-83021Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported vCRITICAL10.0NVD2026-09-15
CVE-2026-83059Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). SupporCRITICAL10.0NVD2026-09-15
CVE-2026-83099Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). SuppoCRITICAL10.0NVD2026-09-15
CVE-2026-87230Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supporCRITICAL10.0NVD2026-09-15
CVE-2026-70416Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticaCRITICAL10.0NVD2026-09-16
CVE-2026-20130As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISECRITICAL10.0NVD2026-09-16
CVE-2026-20192As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISECRITICAL10.0NVD2026-09-16
CVE-2026-76423A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain aCRITICAL10.0NVD2026-09-16
CVE-2026-92808A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unCRITICAL10.0NVD2026-09-16
CVE-2026-76460A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypCRITICAL10.0NVD2026-09-16
CVE-2026-62104Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.CRITICAL10.0NVD2026-09-17
CVE-2026-92937vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GCRITICAL10.0NVD2026-09-17
CVE-2026-92940vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is eCRITICAL10.0NVD2026-09-17
CVE-2026-92941vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tlsCRITICAL10.0NVD2026-09-17
CVE-2026-92946vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit reCRITICAL10.0NVD2026-09-17
CVE-2026-92947vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by BufferCRITICAL10.0NVD2026-09-17
CVE-2026-92955vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ gCRITICAL10.0NVD2026-09-17
CVE-2026-92956vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on CRITICAL10.0NVD2026-09-17
CVE-2026-92960vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbCRITICAL10.0NVD2026-09-17
CVE-2026-54734Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplCRITICAL10.0NVD2026-09-17
CVE-2026-69399Azure Arc Elevation of Privilege VulnerabilityCRITICAL10.0NVD2026-09-17
CVE-2026-69865Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevCRITICAL10.0NVD2026-09-17
CVE-2026-70200Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorizeCRITICAL10.0NVD2026-09-17
CVE-2026-83944Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.CRITICAL10.0NVD2026-09-17
CVE-2026-85889Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges oCRITICAL10.0NVD2026-09-17