Vulnerability Advisories

Latest release roundups

Apple · 29 October 2026Apple iOS, iPadOS, macOS and visionOS September 2026 security updates: exploited file-processing flaw fixedOpen-source business platforms · 25 October 2026Open-source business platforms, week 43 of 2026: Frappe blind SQL injection leads four vulnerabilitiesIBM · 25 October 2026IBM vulnerabilities, week 43 2026: MQ Operator and QRadar flaws lead 21 CVEsCisco · 25 October 2026Cisco week 43 2026: Splunk, Expressway and UC hardening lead 65 CVEsOracle · 21 October 2026Oracle Critical Patch Update, October 2026: unauthenticated flaws in Workflow, Access Manager and SOA Suite lead 426 fixesSAP · 18 October 2026SAP security week 42 2026: four critical vulnerabilities lead 20 CVEsMicrosoft · 11 October 2026Microsoft week 41 2026: command injection and certificate validation lead 11 CVEsPalo Alto Networks · 4 October 2026Palo Alto Networks week 40: medium-severity credential flaw in Itron MV-90 xiFortinet · 13 September 2026Fortinet week 37 2026: critical FortiMonitorOnSight authentication bypass leads 10 CVEs

• High 8.1 CVE-2026-119977 WordPress 31 October 2026

  WordPress Core unauthenticated remote code execution during upgrade window (CVE-2026-119977)

  WordPress Core 4.7 through 7.1.3 is vulnerable to unauthenticated remote code execution during full-package upgrades because staging paths are predictable and web-accessible. No fixed version is listed yet; limit exposure during upgrade windows.

• Critical 9.8 CVE-2026-76529 Cisco 31 October 2026

  Splunk SOAR improper alternate path protection allows unauthenticated network compromise (CVE-2026-76529)

  Splunk SOAR before 8.7.0 has a critical improper alternate path protection flaw (CVE-2026-76529, CVSS 9.8). An unauthenticated network attacker can compromise confidentiality, integrity and availability. Upgrade to Splunk SOAR 8.7.0.

• Critical 9.8 CVE-2026-76408 Cisco 31 October 2026

  Splunk SOAR resource lifetime flaw allows unauthenticated total compromise (CVE-2026-76408)

  Splunk SOAR before 8.7.0 has a critical resource-lifetime flaw (CVE-2026-76408). An unauthenticated network attacker can achieve full confidentiality, integrity and availability impact. Upgrade to Splunk SOAR 8.7.0; no workaround is published.

• High 8.7 CVE-2026-119144 Frappe / ERPNext 30 October 2026

  Frappe Framework server-side template injection through message fields enables server compromise (CVE-2026-119144)

  Frappe Framework before 15.111.0 and 16.x before 16.21.0 has a server-side template injection flaw in message fields. An authenticated user with a common operational role can cause high-impact server compromise. Fixed: frappe 15.111.0 or 16.21.0.

• Critical 9.8 CVE-2026-76527 Cisco 30 October 2026

  Splunk SOAR unauthenticated critical exception handling flaw (CVE-2026-76527)

  A critical vulnerability in Splunk SOAR before 8.7.0 lets a remote, unauthenticated attacker compromise confidentiality, integrity and availability through improper exception handling. Upgrade to Splunk SOAR 8.7.0.

• Critical 10.0 KEV CVE-2026-97229 29 October 2026

  GitLab CI/CD regular expression integer overflow allows unauthenticated remote code execution (CVE-2026-97229)

  GitLab CE/EE 19.2, 19.3 and 19.4 before the patch releases allow unauthenticated remote code execution via a crafted CI/CD regular expression. CISA KEV lists CVE-2026-97229 as actively exploited. Upgrade to GitLab 19.2.8, 19.3.5 or 19.4.2.

• Release roundup High 8.8 KEV 2 CVEs in scope Apple 29 October 2026

  Apple iOS, iPadOS, macOS and visionOS September 2026 security updates: exploited file-processing flaw fixed

  Apple fixed two CVEs across iOS, iPadOS, macOS and visionOS. CVE-2026-86950, an exploited out-of-bounds write, can lead to arbitrary code execution through a crafted file and is in CISA KEV with a due date of 13 October 2026. Prioritise iOS and iPadOS patching.

• Release roundup Not scored 1 CVE in scope Apple 29 October 2026

  Apple security updates for macOS, October 2026: one denial-of-service fix for macOS Sequoia

  Apple's October 2026 macOS update resolves CVE-2026-112601, an integer overflow that could let an app cause a denial-of-service. No CVSS score or active exploitation is reported. Update to macOS Sequoia 15.8.2.

• Critical 9.4 CVE-2026-119145 Frappe / ERPNext 29 October 2026

  Frappe path traversal in file upload enables remote code execution for authenticated users (CVE-2026-119145)

  Frappe before 15.121.0 and 16.x before 16.34.0 has a path traversal flaw in file upload handling. An authenticated attacker can place files outside the intended storage directory and achieve remote code execution. Upgrade to frappe 15.121.0 or 16.34.0.

• High 8.6 KEV CVE-2026-76418 Cisco 28 October 2026

  Cisco ASA and FTD Remote Access SSL VPN denial of service actively exploited (CVE-2026-76418)

  High-severity Cisco ASA and FTD Remote Access SSL VPN denial of service (CVE-2026-76418). An unauthenticated remote attacker can cause a device reload when secondary authentication is configured. Cisco, CISA and ENISA report active exploitation. Upgrade to a fixed release or apply the mitigation.

• Release roundup Not scored 1 CVE in scope Apple 28 October 2026

  Apple security updates for macOS, October 2026: one out-of-bounds write fixed in Sequoia and Tahoe

  Apple's October 2026 macOS security update addresses one CVE: an out-of-bounds write that could allow an app to cause an unexpected system termination or write kernel memory. Fixed in macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2; no exploitation is reported.

• Critical 9.2 CVE-2026-118633 Sophos 28 October 2026

  Sophos UTM path traversal allows unauthenticated root code execution (CVE-2026-118633)

  Sophos SG UTM up to and including 9.724 is affected by a remote unauthenticated path traversal that can lead to root code execution when email proxy scanning is enabled. No fixed version is listed; Sophos says the patch must be installed manually.

• Critical 9.8 CVE-2026-76301 Cisco 28 October 2026

  Splunk Enterprise protection mechanism failure allows unauthenticated remote compromise (CVE-2026-76301)

  Splunk Enterprise 9.4, 10.0, 10.2 and 10.4 before the fixed releases are affected by a critical protection mechanism failure (CVE-2026-76301, CVSS 9.8). Upgrade to 9.4.16, 10.0.11, 10.2.8 or 10.4.4.

• Critical 9.3 KEV CVE-2026-48356, CVE-2026-48358, CVE-2026-47994 … Adobe Commerce / Magento 27 October 2026

  Adobe Commerce APSB26-73 fixes exploited file upload flaw CVE-2026-48356 and related issues

  Adobe's APSB26-73 fixes multiple Adobe Commerce, Magento Open Source, B2B and Commerce Events vulnerabilities, including CVE-2026-48356, a critical unrestricted file upload flaw listed in CISA KEV as exploited. CISA's due date is 10 November 2026. Apply the 2026-jul releases.

• Critical 9.2 KEV CVE-2026-111497 Microsoft 27 October 2026

  Google Brotli decoder out-of-bounds write can allow remote code execution (CVE-2026-111497)

  A critical out-of-bounds write in Google Brotli 1.0.3 through 1.2.0 allows remote unauthenticated attackers to corrupt memory, disclose data, crash services or possibly execute code via crafted compressed streams. Update to 1.0.10, 1.1.1 or 1.2.1; CISA KEV due date is 2026-11-10.

• Release roundup High 8.8 39 CVEs in scope Apple 27 October 2026

  Apple security updates for iOS and iPadOS, macOS and visionOS, October 2026: one high-severity Safari flaw among 39 CVEs

  Apple's October 2026 updates cover 39 CVEs across iOS and iPadOS, macOS and visionOS. One high-severity Safari flaw can allow arbitrary code execution through malicious web content; no CVE is listed as exploited or in CISA KEV. Prioritise this fix, then network and kernel-memory issues.

• Release roundup High 8.8 119 CVEs in scope Apple 27 October 2026

  Apple October 2026 security updates: 119 CVEs led by five high-severity WebKit flaws

  Apple's October 2026 updates for iOS, iPadOS, macOS and visionOS address 119 CVEs, led by five high-severity WebKit flaws that can allow arbitrary code execution from malicious web content. None is listed in CISA KEV or reported exploited. Patch Safari 27.2 and the matching OS updates first.

• Release roundup High 8.8 123 CVEs in scope Apple 27 October 2026

  Apple security updates for macOS, tvOS and visionOS, October 2026: six high-severity macOS flaws lead 123 CVEs

  Apple's October 2026 updates for macOS, tvOS and visionOS include 123 macOS CVEs, six rated high. None are listed as exploited or in CISA KEV. Prioritise the network-reachable code execution and privilege escalation flaws, then apply the relevant macOS update: 15.8.2, 26.7.2 or 27.2.

• Critical 9.2 KEV CVE-2026-109619 Palo Alto Networks 27 October 2026

  PHP stale global state vulnerability allows remote code execution (CVE-2026-109619)

  PHP 8.2 through 8.5 before fixed releases has a critical stale global state flaw allowing remote code execution. CISA KEV lists it as exploited; fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

• Critical 9.2 KEV CVE-2026-109618 Palo Alto Networks 27 October 2026

  Palo Alto Networks Prisma Access and SD-WAN affected by PHP out-of-memory code execution (CVE-2026-109618)

  PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 has an out-of-memory memory-corruption flaw enabling remote code execution. Palo Alto Networks Prisma Access and Prisma SD-WAN ION are affected; fixed releases are listed. CISA KEV lists it as exploited.

• High 8.6 CVE-2026-116219 Dolibarr 26 October 2026

  Dolibarr ERP CRM OS command injection lets authenticated admins execute commands (CVE-2026-116219)

  Dolibarr ERP CRM before 24.0.0 has a high-severity OS command injection in the export tool. An authenticated administrator can bypass the allowed command list and run OS commands as the web server user. Upgrade to dolibarr 24.0.0.

• Critical 9.6 CVE-2026-107656 Fortinet 26 October 2026

  FortiSandbox and FortiSandbox PaaS authentication bypass allows unauthenticated code execution (CVE-2026-107656)

  Authentication bypass in FortiSandbox and FortiSandbox PaaS web management interface lets an unauthenticated attacker run code via crafted HTTP requests. Rated 9.6 critical. No fixed version is listed yet; restrict access and monitor.

• Weekly roundup High 7.1 4 advisories in scope Open-source business platforms 25 October 2026

  Open-source business platforms, week 43 of 2026: Frappe blind SQL injection leads four vulnerabilities

  Open-source business platforms, week 43 of 2026: four vulnerabilities across Frappe, Dolibarr and WordPress — one high-severity Frappe SQL injection, one Frappe access-control flaw, one Dolibarr CSP issue and one unfixed WordPress stored XSS. None is in CISA KEV. Patch Frappe first.

• Weekly roundup High 8.8 21 CVEs in scope IBM 25 October 2026

  IBM vulnerabilities, week 43 2026: MQ Operator and QRadar flaws lead 21 CVEs

  IBM's week 43 2026 release covers 21 CVEs: 10 high, 9 medium, 2 low. None are in CISA KEV or exploited. Fifteen affect MQ Operator, including a pre-auth TLS stack overflow; QRadar has two remote flaws. Patch MQ Operator 3.4.0 first, then QRadar, identity and Sterling.

• Weekly roundup Critical 9.9 65 CVEs in scope Cisco 25 October 2026

  Cisco week 43 2026: Splunk, Expressway and UC hardening lead 65 CVEs

  Cisco published 65 CVEs for week 43 of 2026, including 8 critical and 25 high-severity flaws. Hardening releases cover Splunk Enterprise, Splunk SOAR, Expressway Series and Unified Communications; an unauthenticated Expressway RCE leads priorities. None are listed as exploited or in CISA KEV.

• Critical 9.1 CVE-2026-91403 Oracle 25 October 2026

  Oracle Java SE and GraalVM JSSE flaw lets unauthenticated attackers read and modify data (CVE-2026-91403)

  Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition are affected by CVE-2026-91403, a critical JSSE flaw reachable over the network without authentication. An attacker can read and modify data. Oracle has published an alert; fixes are available.

• Critical 9.1 CVE-2026-114820 Oracle 25 October 2026

  Oracle Java SE and GraalVM JSSE vulnerability allows unauthenticated data access and modification (CVE-2026-114820)

  Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition have a critical JSSE vulnerability (CVE-2026-114820). An unauthenticated attacker with network access can read, create, delete or modify critical data. Apply the fixes in Oracle's security alert.

• Critical 9.2 KEV CVE-2026-110447 23 October 2026

  Collabora Online Built-in CODE Server OS command injection allows remote code execution (CVE-2026-110447)

  Critical OS command injection in Collabora Online Built-in CODE Server before 26.4.303, a Nextcloud app, gives unauthenticated attackers remote code execution when the CODE server isn't running. Exploited in the wild; CISA KEV due date is 26 October 2026. Update to 26.4.303.

• Critical 9.4 KEV CVE-2026-114625 23 October 2026

  VeloCloud Orchestrator authenticated privilege escalation allows access to internal superuser operator functions (CVE-2026-114625)

  VeloCloud Orchestrator on-prem lets any authenticated user escalate to superuser operator and access internal functionality, risking orchestrator and managed data. CISA KEV reports active exploitation. Fixed versions: 5.2.3.18, 6.1.3.10, 6.4.2.12. Patch immediately.

• Release roundup Medium 5.5 1 CVE in scope Apple 22 October 2026

  Apple iOS, iPadOS and macOS security updates, October 2026: one out-of-bounds write fixed

  Apple's October 2026 iOS, iPadOS and macOS update addresses one CVE: an out-of-bounds write that could allow an app to cause unexpected system termination. Not exploited or in CISA KEV. Fixed in iOS/iPadOS 26.7, macOS Sequoia 15.8 and macOS Tahoe 26.7.

• Critical 9.9 CVE-2026-76531 Cisco 22 October 2026

  Splunk SOAR exposes files or directories to external parties, letting authenticated attackers impact other resources (CVE-2026-76531)

  Critical flaw in Splunk SOAR before 8.7.0 exposes files or directories to external parties (CVE-2026-76531). An authenticated attacker can impact other resources. Upgrade to Splunk SOAR 8.7.0.

• Critical 9.9 CVE-2026-76302 Cisco 22 October 2026

  Splunk Enterprise security hardening fixes multiple improper neutralization flaws (CVE-2026-76302)

  Splunk Enterprise 9.4, 10.0, 10.2 and 10.4 before fixed builds are affected. A low-privileged network attacker can exploit multiple improper neutralization flaws for high impact on confidentiality, integrity and availability. Update to Splunk Enterprise 9.4.16, 10.0.11, 10.2.8 or 10.4.4.

• Critical 9.9 CVE-2026-76299 Cisco 22 October 2026

  Splunk Enterprise improper access control allows low-privileged remote compromise (CVE-2026-76299)

  Splunk Enterprise 9.4, 10.0, 10.2 and 10.4 are affected by improper access control (CVE-2026-76299, CVSS 9.9). A low-privileged remote attacker may compromise confidentiality, integrity and availability. Upgrade to 9.4.16, 10.0.11, 10.2.8 or 10.4.4.

• Release roundup Critical 10.0 426 CVEs in scope Oracle 21 October 2026

  Oracle Critical Patch Update, October 2026: unauthenticated flaws in Workflow, Access Manager and SOA Suite lead 426 fixes

  Oracle’s October 2026 Critical Patch Update fixes 426 CVEs across E-Business Suite, Fusion Middleware, Java SE, Database and PeopleSoft. No CVE is listed in CISA KEV. Prioritise unauthenticated network flaws in Workflow, Oracle Access Manager and SOA Suite.

• Critical 9.0 CVE-2026-20043, CVE-2026-20291, CVE-2026-20236 … Cisco 21 October 2026

  Cisco Snort 3 October 2026 security hardening release fixes critical out-of-bounds write and three high-severity flaws

  Cisco's October 2026 Snort 3 security hardening release addresses four vulnerabilities in Cyber Vision, Open Source Snort 3, Firewall Threat Defense and UTD SNORT IPS. The most severe is a critical out-of-bounds write. Cisco has released fixes; apply the hardening release.

• Critical 9.8 CVE-2026-76474, CVE-2026-76473, CVE-2026-76475 … Cisco 21 October 2026

  Cisco Unified Communications Products October 2026 security hardening release fixes critical authentication, injection and XSS flaws

  Cisco's October 2026 security hardening release for Emergency Responder, Unified CM, IM and Presence Service and Unity Connection fixes critical and high severity flaws, including unauthenticated access, injection and cross-site scripting. No workarounds are available; apply the update promptly.

• Critical 9.8 CVE-2026-76466 Cisco 21 October 2026

  Cisco Expressway Series database service flaw enables unauthenticated root command execution (CVE-2026-76466)

  Unauthenticated attackers can run commands as root on Cisco Expressway-C and Expressway-E via the database service. Cisco has issued a fix; no workarounds are listed and no active exploitation is known.

• High 8.1 CVE-2026-104937 Shopware 21 October 2026

  Shopware 6.7 stored XSS lets attackers steal admin tokens and install malicious plugins (CVE-2026-104937)

  Shopware 6.7 allows stored XSS via uploaded HTML files. If an administrator views one, their authentication token can be stolen and used for the Administration API; with extension-management privileges, an attacker can install malicious plugins to execute PHP code. No fixed version is listed.

• Release roundup Medium 5.4 1 CVE in scope Apple 20 October 2026

  Apple security updates for Safari, visionOS and watchOS, October 2026: one medium-severity logic issue

  Apple's October 2026 update for Safari, visionOS and watchOS addresses one medium-severity logic issue (CVE-2026-86872) in processing maliciously crafted web content. It is not known to be exploited and is not in CISA KEV. Apply Safari 27, visionOS 27 and watchOS 27 through normal patching.

• Release roundup High 7.8 3 CVEs in scope Apple 20 October 2026

  Apple macOS security updates, October 2026: privilege escalation and System Keychain issue fixed in Sequoia and Tahoe

  Apple's October 2026 macOS security update covers 3 CVEs in macOS Sequoia and Tahoe. None appear in CISA KEV. The highest-rated issue, CVE-2026-28853, is a local privilege escalation with CVSS 7.8. Apply macOS 15.8 or 26.7.

• Weekly roundup Critical 10.0 20 CVEs in scope SAP 18 October 2026

  SAP security week 42 2026: four critical vulnerabilities lead 20 CVEs

  SAP's week 42 release lists 20 CVEs: 4 critical, 3 high, 12 medium and 1 low. None appear in CISA KEV. Prioritise the critical SSRF, code-injection and access-control flaws, then the unauthenticated NetWeaver/Web Dispatcher denial-of-service.

• Weekly roundup Critical 9.9 30 CVEs in scope IBM 18 October 2026

  IBM week 42 2026: WebSphere and Db2 access-control flaws headline 30 CVEs

  IBM's week 42 2026 release covers 30 CVEs: 3 critical, 11 high, 14 medium and 2 low. None are listed in CISA's KEV catalogue. Critical access-control issues affect WebSphere Liberty gRPC and SAML; Db2 Mirror for i has a 9.9 privilege-escalation flaw. Patch internet-facing WebSphere first.

• Weekly roundup Critical 10.0 115 advisories in scope Open-source business platforms 18 October 2026

  Open-source business platforms, week 42 2026: critical updates for Adobe Commerce, Frappe and SuiteCRM

  Open-source business platforms week 42 2026: 115 vulnerabilities, 104 with a CVE id. Seven critical, 65 high; no CISA KEV or active exploitation stated. Prioritise Adobe Commerce, Magento, SuiteCRM and Frappe Framework updates.

• Critical 9.3 KEV CVE-2026-102764 16 October 2026

  BeyondTrust Remote Support improper origin validation allows unauthenticated file operations (CVE-2026-102764)

  BeyondTrust Remote Support up to 26.2.3 improperly validates internal message origins, allowing unauthenticated network attackers to perform file operations. Actively exploited per CISA KEV and ENISA EUVD. No fixed version has been published; restrict exposure or discontinue use by 2026-10-19.

• High 8.6 KEV CVE-2026-0322 Palo Alto Networks 15 October 2026

  PAN-OS management interface authenticated remote code execution exploited (CVE-2026-0322)

  PAN-OS management interface has an authenticated remote code execution flaw (CVE-2026-0322), scored 8.6 High, with active exploitation confirmed by CISA KEV and the vendor. Upgrade affected PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 to fixed builds by 17 October 2026.

• Critical 9.9 GHSA-9pp9-wgp9-3p3j Frappe / ERPNext 15 October 2026

  Frappe Framework path traversal in file upload enables remote code execution (GHSA-9pp9-wgp9-3p3j)

  A path traversal flaw in Frappe Framework's file-upload handling allows an authenticated user to write files outside the intended storage directory and achieve remote code execution. Fixed in Frappe Framework 16.34.0 and 15.121.0; no workaround is available.

• Critical 9.1 CVE-2026-96252 Microsoft 14 October 2026

  Active Directory Federation Services spoofing allows unauthorised network attackers to forge identity (CVE-2026-96252)

  Microsoft has fixed CVE-2026-96252, a critical (CVSS 9.1) spoofing flaw in Active Directory Federation Services. An unauthorised attacker on the network can bypass signature verification. Patch the affected Windows Server and Windows 10 builds listed.

• Critical 9.3 CVE-2026-70279 Microsoft 14 October 2026

  Microsoft Exchange Server cross-site scripting enables network spoofing (CVE-2026-70279)

  Microsoft has patched a cross-site scripting flaw in Exchange Server that allows an unauthorised attacker to spoof content over the network. Affected builds include Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Subscription Edition RTM. Apply the October 2026 update.

• Critical 9.1 CVE-2026-93909 IBM 14 October 2026

  IBM WebSphere Application Server Liberty SAML 2.0 authentication bypass (CVE-2026-93909)

  IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 with the samlWeb-2.0 feature enabled has a critical authentication bypass (CVSS 9.1) reachable over the network without credentials. Apply IBM's fix and restrict access until patched.

• Critical 9.8 CVE-2026-97749 Microsoft 14 October 2026

  Microsoft Office Outlook double free allows unauthenticated remote code execution (CVE-2026-97749)

  Microsoft Office Outlook has a critical double free vulnerability (CVE-2026-97749, CVSS 9.8) that allows an unauthenticated attacker to execute code over the network. Apply the Microsoft 365 Apps update or Office LTSC 2021 16.0.14334.20974 / LTSC 2024 16.0.17932.21056.

• Critical 9.8 CVE-2026-97016 Microsoft 14 October 2026

  Microsoft Outlook heap buffer overflow enables unauthenticated remote code execution (CVE-2026-97016)

  Critical heap-based buffer overflow in Microsoft Outlook (CVE-2026-97016) can be exploited over the network without authentication to execute code. Update Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024 to the fixed builds below.

• Critical 9.8 CVE-2026-96934 Microsoft 14 October 2026

  Windows DHCP Server use-after-free allows unauthenticated remote code execution (CVE-2026-96934)

  Windows DHCP Server has a critical use-after-free (CVE-2026-96934) allowing unauthenticated, network-based remote code execution. Microsoft has fixed builds for Windows Server 2012 through 2025 and affected Windows 10 editions. Apply the October 2026 update promptly.

• Critical 9.8 CVE-2026-96320 Microsoft 14 October 2026

  Windows DHCP Server heap-based buffer overflow allows unauthorised remote code execution (CVE-2026-96320)

  Microsoft Windows DHCP Server has a critical heap-based buffer overflow. An unauthorised attacker can execute code over the network without credentials or user interaction. Apply the Microsoft security update matching your affected Windows Server or Windows 10 build.

• Critical 9.8 CVE-2026-96113 Microsoft 14 October 2026

  Windows DNS Server heap-based buffer overflow allows remote code execution (CVE-2026-96113)

  Windows DNS Server has a heap-based buffer overflow that lets an unauthenticated attacker execute code over the network with no user action. Affected are Windows Server 2012–2025 and Windows 10 1607/1809; Microsoft's October 2026 update fixes it.

• Critical 9.8 CVE-2026-88178 Microsoft 14 October 2026

  Microsoft Office PowerPoint use-after-free lets unauthenticated attackers execute code (CVE-2026-88178)

  Microsoft Office PowerPoint has a critical use-after-free flaw (CVE-2026-88178), rated CVSS 9.8. An unauthorised attacker can execute code over a network with no privileges or user interaction. Fixed releases are available for Microsoft 365 Apps and Office LTSC 2021/2024, including Mac; patch now.

• Critical 9.8 CVE-2026-88156 Microsoft 14 October 2026

  Microsoft Office Outlook stack-based buffer overflow lets unauthenticated attackers run code (CVE-2026-88156)

  Microsoft Office Outlook has a critical stack-based buffer overflow (CVE-2026-88156) exploitable over a network by an unauthenticated attacker with no user interaction, allowing code execution. Apply Microsoft's October 2026 security release and the listed fixed builds.

• High 8.5 CVE-2026-109612 Frappe / ERPNext 13 October 2026

  Frappe ERPNext stored XSS in report view lets authenticated users run script (CVE-2026-109612)

  Stored XSS in Frappe ERPNext report views lets an authenticated user who can create records run script in other users' sessions. Affected: before 15.120.0 and 16.0.0-beta.1 to before 16.33.0; fixed in 15.120.0 and 16.33.0.

• High 8.5 CVE-2026-109604 Frappe / ERPNext 13 October 2026

  ERPNext stored XSS lets authenticated users execute scripts via tool view record names (CVE-2026-109604)

  ERPNext before 15.112.0 and 16.x before 16.23.0 has a stored XSS flaw in tool views. An authenticated user can craft record names that execute script when others open the tool. Upgrade to 15.112.0 or 16.23.0.

• High 8.7 CVE-2026-109652 Frappe / ERPNext 13 October 2026

  Frappe ERPNext server-side template injection lets authenticated users read and alter data (CVE-2026-109652)

  Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 has a server-side template injection flaw. Authenticated users with a common operational role can read or change database data, delete documents, send outbound requests and send site mail. Fixed in ERPNext 15.119.1 and 16.32.0.

• High 8.7 CVE-2026-109608 Frappe / ERPNext 13 October 2026

  Frappe ERPNext SQL injection allows any authenticated user to read sensitive information and escalate privileges (CVE-2026-109608)

  Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 has SQL injection in endpoints lacking validation. Any authenticated user, even with no roles, can read sensitive information and escalate to a privileged account. Update to 15.121.0 or 16.34.0.

• High 8.7 CVE-2026-109667 Frappe / ERPNext 13 October 2026

  ERPNext privilege escalation lets any authenticated user create privileged accounts (CVE-2026-109667)

  ERPNext before 15.111.0 and 16.x before 16.22.0 has a privilege escalation flaw: any authenticated user can create privileged accounts and take full control of the site. Fixed in ERPNext 15.111.0 and 16.22.0.

• High 8.7 CVE-2024-58390 Frappe / ERPNext 13 October 2026

  Frappe privilege escalation grants Website Users System Manager access (CVE-2024-58390)

  Frappe before 14.81.4 and 15.x before 15.41.0 allows an authenticated Website User to escalate to System Manager through a document action. Update to 14.81.4 or 15.41.0 to close the flaw.

• High 8.2 CVE-2023-54411 Frappe / ERPNext 13 October 2026

  Frappe print view key weakness allows unauthenticated document access (CVE-2023-54411)

  Frappe before 13.32.0 uses weak print view authentication. An unauthenticated attacker can derive the key from whitelisted API data and view documents without permissions. Upgrade to Frappe 13.32.0.

• High 8.6 CVE-2026-109633 Frappe / ERPNext 13 October 2026

  Frappe ERPNext stored XSS via public booking page can let unauthenticated attackers take over accounts (CVE-2026-109633)

  ERPNext before 15.119.1 and 16.x before 16.32.0 has a stored XSS flaw in the public booking page. An unauthenticated attacker can submit crafted HTML that runs in a privileged user's session, enabling account takeover. Upgrade to 15.119.1 or 16.32.0.

• High 8.6 CVE-2025-71432 Frappe / ERPNext 13 October 2026

  Frappe ERPNext reflected cross-site scripting allows account takeover (CVE-2025-71432)

  Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 has a reflected cross-site scripting flaw. An attacker can lure a logged-in user to a crafted URL, run script in the authenticated session and take over the account. Upgrade to ERPNext 14.92.1 or 15.83.0.

• Critical 10.0 CVE-2026-89111 SAP 13 October 2026

  SAP Cloud SDK for Python OAuth2 SSRF exfiltrates client credentials (CVE-2026-89111)

  SAP Cloud SDK for Python has an OAuth2 SSRF flaw in multi-tenant BTP apps. An attacker controlling tenant_subdomain can redirect token requests over the network with no credentials or user action, exfiltrating client credentials. Update to SAP Cloud 0.55.1.

• Critical 9.9 CVE-2026-96012 IBM 12 October 2026

  IBM Db2 Mirror for i privilege escalation lets authenticated attackers gain elevated privileges (CVE-2026-96012)

  IBM Db2 Mirror for i 7.4, 7.5 and 7.6 has a critical privilege-escalation flaw. An authenticated attacker with low privileges can bypass checks to execute code and gain elevated rights. Apply IBM's fix and restrict access until patched.

• Weekly roundup Critical 9.1 11 CVEs in scope Microsoft 11 October 2026

  Microsoft week 41 2026: command injection and certificate validation lead 11 CVEs

  Microsoft week 41 2026 covers 11 CVEs in UFO, MsQuic, Kiota and SimpleChat (two critical, five high); none is exploited or in CISA KEV. Prioritise MsQuic certificate validation, UFO and SimpleChat command injection; verify release availability first.

• Weekly roundup Critical 9.8 22 CVEs in scope IBM 11 October 2026

  IBM Security Verify Access, week 41 2026: unauthenticated RCE and auth bypass lead 22 fixes

  IBM's week 41 2026 release covers 22 CVEs in Security Verify Access and Verify Identity Access: 5 critical, 5 high, 10 medium, 2 low. None are in CISA KEV or exploited. Prioritise unauthenticated deserialisation and auth-bypass flaws; patch to 10.0.9.3 / 11.0.3.1.

• Weekly roundup Critical 10.0 59 CVEs in scope Cisco 11 October 2026

  Cisco vulnerabilities, week 41 of 2026: 18 critical pre-auth flaws lead 59 CVEs

  Cisco's week 41 release covers 59 CVEs across Splunk Enterprise, NX-OS, License On-Prem, Campus Gateway and APIC, including 18 critical and 15 high. No CVEs are in CISA KEV. Prioritise pre-authentication RCEs in NX-OS, Splunk and License On-Prem.

• Critical 9.8 CVE-2026-76284 Cisco 10 October 2026

  Splunk Enterprise improper neutralization allows unauthenticated network compromise (CVE-2026-76284)

  Affected releases: Splunk Enterprise 9.4 to before 9.4.15, 10.0 to before 10.0.10, 10.2 to before 10.2.7 and 10.4 to before 10.4.3. CVE-2026-76284 is a critical improper neutralization flaw (CVSS 9.8) reachable over the network without credentials. Upgrade to the matching fixed release.

• Critical 9.1 CVE-2026-16916 IBM 9 October 2026

  IBM Verify Identity Access and Security Verify Access protection mechanism failure allows code execution (CVE-2026-16916)

  IBM Security Verify Access 10.0–10.0.9.2 and Verify Identity Access 11.0–11.0.3 (and container editions) allow a remote authenticated high-privileged attacker to execute arbitrary code. CVSS 3.1: 9.1 critical. IBM has published a fix.

• Critical 9.1 CVE-2026-16823 IBM 9 October 2026

  IBM Security Verify Access and Verify Identity Access authentication bypass (CVE-2026-16823)

  IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 have an authentication bypass (CVE-2026-16823). A remote, unauthenticated attacker can read or alter protected data. Apply IBM's update and restrict network exposure.

• Critical 9.1 CVE-2026-19491 IBM 9 October 2026

  IBM Verify Identity Access and Security Verify Access authentication bypass allows unauthenticated remote access (CVE-2026-19491)

  IBM Security Verify Access 10.0 to 10.0.9.2 and Verify Identity Access 11.0 to 11.0.3 are affected by an authentication bypass (CVE-2026-19491). A remote, unauthenticated attacker can gain high-impact access. Apply IBM's update; no fixed release is named.

• Critical 9.8 CVE-2026-78406 IBM 9 October 2026

  IBM Verify Identity Access deserialization allows unauthenticated remote code execution (CVE-2026-78406)

  IBM Security Verify Access and IBM Verify Identity Access, including container editions, have a critical deserialization flaw (CVSS 9.8) allowing unauthenticated remote code execution. IBM has released a fix; apply it promptly and restrict exposure until patched.

• Critical 9.8 CVE-2026-78401 IBM 9 October 2026

  IBM Security Verify Access and IBM Verify Identity Access unsafe deserialisation allows remote code execution (CVE-2026-78401)

  IBM Security Verify Access 10.0–10.0.9.2 and IBM Verify Identity Access 11.0–11.0.3 are affected by unsafe deserialisation that lets an unauthenticated remote attacker run arbitrary code. Apply IBM's fix; no exploitation is currently confirmed.

• Critical 9.8 CVE-2026-76268 Cisco 8 October 2026

  Splunk Enterprise Patroni REST API missing authentication permits remote command execution (CVE-2026-76268)

  Unauthenticated network access to the Patroni REST API on Splunk Enterprise search head cluster members can allow OS command execution (CVE-2026-76268, CVSS 9.8). Update to 10.4.3 or 10.2.7.

• Critical 9.6 CVE-2026-76464, CVE-2026-76463, CVE-2026-76470 … Cisco 7 October 2026

  Cisco Meraki MR, MV, MX and Campus Gateway October 2026 hardening release addresses multiple flaws

  Cisco's October 2026 hardening release covers Meraki MR, MV, MX and Campus Gateway. It addresses a critical adjacent-network buffer management flaw (CVSS 9.6) and high-severity access control, input validation and availability issues. Apply the release; no workarounds exist.

• Critical 9.1 CVE-2026-20328, CVE-2026-76454, CVE-2026-76437 … Cisco 7 October 2026

  Cisco License On-Prem vulnerabilities allow unauthenticated access and file writes (CVE-2026-20328, CVE-2026-76454)

  Four flaws affect Cisco License On-Prem (formerly SSM On-Prem). Two critical unauthenticated flaws allow account takeover and arbitrary file writes or DoS. Two authenticated flaws allow root command execution and database reads. Cisco has fixes; no workarounds.

• Critical 9.8 CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 Cisco 7 October 2026

  Cisco APIC October 2026 hardening release addresses critical pre-auth vulnerabilities (CVE-2026-76498, CVE-2026-76499, CVE-2026-76500)

  Cisco's October 2026 APIC hardening release fixes three critical vulnerabilities in Cisco APIC: improper access control, improper neutralisation, and improper resource lifetime control (CVE-2026-76498, CVE-2026-76499, CVE-2026-76500). No workaround; apply the update.

• Critical 9.8 CVE-2026-76455, CVE-2026-76459, CVE-2026-76453 … Cisco 7 October 2026

  Cisco NX-OS October 2026 security hardening release fixes six vulnerabilities

  Cisco's October 2026 NX-OS security hardening release fixes six vulnerabilities affecting NX-OS, ACI mode and UCS (Managed). Two are CVSS 9.8, network-reachable without credentials. No workarounds; apply the release.

• Critical 10.0 CVE-2026-76480, CVE-2026-76482, CVE-2026-76483 … Cisco 7 October 2026

  Cisco License On-Prem security hardening release fixes critical authentication, injection and credential flaws

  Cisco's October 2026 security hardening release for License On-Prem fixes four critical flaws in authentication, input verification, credential protection and code injection. Network attackers can achieve high impact without credentials. Apply the hardening release; no workarounds exist.

• Critical 9.8 CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 Cisco 7 October 2026

  Cisco Nexus 3000 and 9000 Series Switches NGOAM remote code execution vulnerabilities (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501)

  Cisco Nexus 3000 and 9000 Series Switches running NX-OS have three critical remote code execution flaws in the NGOAM feature. A remote, unauthenticated attacker can send crafted IP packets to run code as root or force a reload. Apply Cisco's fixed software or disable NGOAM if not required.

• Critical 9.8 CVE-2026-76471 Cisco 7 October 2026

  Cisco NX-OS NX-API remote code execution lets unauthenticated attackers execute code as root (CVE-2026-76471)

  Unauthenticated attackers can execute code with root privileges or force device reloads via crafted HTTP requests to Cisco NX-OS NX-API (9.8 Critical). No workarounds exist; apply Cisco's fixed software. A Live Protect shield offers temporary mitigation.

• Critical 9.8 CVE-2026-76465 Cisco 7 October 2026

  Cisco Nexus 3000 and 9000 Series Switches MPLS OAM remote code execution lets unauthenticated attackers run code (CVE-2026-76465)

  Cisco NX-OS on Nexus 3000 and 9000 Series Switches mishandles MPLS OAM echo-request packets. An unauthenticated remote attacker can send a crafted packet to run code with root privileges or cause a device reload. Cisco rates this Critical. Apply Cisco's fixed software or disable MPLS OAM if unused.

• High 8.6 GHSA-7rqw-r5p3-ff92, GHSA-5qgv-9jcx-wph7, GHSA-h34m-gqcf-25cp GLPI 7 October 2026

  GLPI 11.0.9 fixes form-illustration cross-site scripting and two access-control flaws

  GLPI 11.0.9 fixes three advisories: a high-severity cross-site scripting flaw in form illustration import, and two medium-severity authenticated access-control issues. Versions 11.0.0 to before 11.0.9 should upgrade to 11.0.9; affected versions before 10.0.27 should upgrade to 10.0.27.

• Weekly roundup Medium 5.3 1 CVE in scope Palo Alto Networks 4 October 2026

  Palo Alto Networks week 40: medium-severity credential flaw in Itron MV-90 xi

  Palo Alto Networks' week 40 release covers one medium-severity issue: CVE-2026-103548 in Itron MV-90 xi 3.0. A local attacker could decode stored passwords and access the application as any user. No fix is listed, and no exploitation is reported; restrict local access.

• Weekly roundup High 8.9 30 advisories in scope Open-source business platforms 4 October 2026

  Open-source business platforms week 40 2026: Joomla! SSRF and MFA bypass lead 30 vulnerabilities

  The maintainers of Joomla!, Moodle and Frappe / ERPNext published 30 vulnerabilities for week 40, 28 with CVE ids. Seven are high severity. No CISA KEV or exploited entries. A Joomla! SSRF and MFA bypass lead priorities; update Joomla! CMS and Moodle first.

• Release roundup High 8.8 1 CVE in scope Microsoft 3 October 2026

  Microsoft Patch Tuesday, October 2026: one Exchange Server elevation-of-privilege fix

  Microsoft's October 2026 Patch Tuesday contains one CVE: CVE-2026-96940, a high-severity (CVSS 8.8) elevation-of-privilege flaw in Microsoft Exchange Server. An authenticated attacker can exploit it over the network. No active exploitation is reported. Apply the Exchange update.

• Critical 9.4 KEV CVE-2026-102490 2 October 2026

  Zammad privilege escalation lets local zammad user escalate to root (CVE-2026-102490)

  Zammad versions 1.5.0 to before 7.1.0-alpha are affected by a critical privilege escalation that lets the local zammad user gain root. CISA KEV reports active exploitation. Upgrade to Zammad 7.1.0-alpha or discontinue use if mitigations are unavailable.

• Critical 9.4 KEV CVE-2026-102489 2 October 2026

  Zammad session hijack allows remote code execution without credentials (CVE-2026-102489)

  Zammad 6.3.0 to before 6.5.4 has a session hijack flaw that enables remote code execution as the zammad user. CISA lists it as actively exploited; update to Zammad 6.5.4.

• Critical 9.8 KEV CVE-2026-104286 Fortinet 1 October 2026

  FortiMail path traversal lets unauthenticated attackers write arbitrary files (CVE-2026-104286)

  Fortinet FortiMail has a critical unauthenticated path traversal flaw (CVE-2026-104286) that allows arbitrary file writes via crafted HTTP or HTTPS requests. It is being exploited. Apply Fortinet's workaround and upgrade to 7.4.9, 7.6.7 or 8.0.2.

• Critical 9.8 KEV CVE-2026-76504 Cisco 30 September 2026

  Cisco Catalyst SD-WAN Manager API authentication bypass gives unauthenticated admin access (CVE-2026-76504)

  Cisco Catalyst SD-WAN Manager has a critical API authentication bypass (CVE-2026-76504). An unauthenticated remote attacker can gain admin API access with a crafted HTTP request. Exploitation is active. Upgrade to a fixed Cisco release and restrict network exposure now.

• High 8.9 CVE-2026-92227, CVE-2026-92222, CVE-2026-92231 … Joomla! 30 September 2026

  Joomla! CMS 5.4.9 and 6.1.4 fix MFA bypass, SSRF, XSS and access control flaws

  Joomla! CMS 1.5.0–5.4.8 and 6.0.0–6.1.3 is affected by ten flaws including an MFA bypass, SSRF, XSS filter bypasses, ACL errors and unauthorised account creation. Joomla has released 5.4.9 and 6.1.4; update promptly.

• High 8.8 KEV CVE-2026-86950 Apple 28 September 2026

  Apple iOS and macOS out-of-bounds write allows arbitrary code execution via malicious file (CVE-2026-86950)

  Apple has fixed an out-of-bounds write in iOS, iPadOS and macOS that could allow arbitrary code execution when a malicious file is processed. CISA and Apple say it may have been exploited in targeted attacks. Update to iOS/iPadOS 26.7.1, macOS 15.8.1 or 26.7.1.

• Critical 9.5 KEV CVE-2026-88772 28 September 2026

  Citrix NetScaler ADC and Gateway memory overflow enables remote code execution (CVE-2026-88772)

  Citrix NetScaler ADC and Gateway have a critical memory overflow (CVE-2026-88772) reachable over the network without credentials, leading to RCE or denial of service. CISA added it to KEV, rates exploitation active, and sets a 30 September 2026 due date. Apply the fixed releases below.

• Critical 9.5 KEV CVE-2026-88771 28 September 2026

  Citrix NetScaler ADC and Gateway improper input validation allows unauthenticated remote code execution (CVE-2026-88771)

  Citrix NetScaler ADC and Gateway have a critical improper input validation flaw permitting unauthenticated remote code execution. CISA's KEV entry lists it as exploited. Apply the fixed versions now; CISA's due date is 30 September 2026.

• Weekly roundup High 7.8 2 CVEs in scope Microsoft 27 September 2026

  Microsoft week 39 2026: two high-severity Outlook remote code execution flaws in two-CVE release

  Microsoft's week 39 release covers two high-severity remote code execution flaws in Microsoft Outlook. Neither CVE is listed in CISA KEV or marked exploited. Affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. Apply the Office security update for CVE-2026-70125 first.

• Weekly roundup Critical 9.4 KEV 17 advisories in scope Open-source business platforms 27 September 2026

  Open-source business platforms, week 39 2026: exploited WordPress flaw among 17 vulnerabilities

  Week 39 of 2026 brings 17 vulnerabilities across GLPI, Frappe/ERPNext, WordPress and Nextcloud: 16 CVEs and one advisory. CVE-2026-87902 in WordPress is actively exploited and in CISA KEV; GLPI has a critical RCE. Patch WordPress and GLPI first.

• Weekly roundup Low 3.3 1 CVE in scope IBM 27 September 2026

  IBM week 39 of 2026: one low-severity encryption flaw in Db2 Mirror for i

  IBM's week 39 release: one low-severity CVE, CVE-2026-18104, in Db2 Mirror for i 7.6, 7.5 and 7.4 caused by AES ECB encryption. A local attacker could read sensitive information. No exploitation or CISA KEV entry. Apply IBM's available fix.

• Critical 9.1 CVE-2026-20284, CVE-2026-20283, CVE-2026-20282 Cisco 27 September 2026

  Cisco ISE SQL injection, command injection, and OS write access in APIs (CVE-2026-20282, CVE-2026-20283, CVE-2026-20284)

  Three authenticated vulnerabilities affect Cisco Identity Services Engine: SQL injection in the SXP REST API, command injection in the IPsec Open API, and write access through crafted HTTP. Cisco has fixes; a workaround exists for the IPsec API flaw.

• Critical 9.4 CVE-2026-48482, CVE-2026-47679, CVE-2026-55214 … GLPI 26 September 2026

  GLPI 11.0.8 fixes remote code execution via Form import and nine further vulnerabilities

  GLPI 11.0.8 fixes critical remote code execution through Form import and nine further flaws, including SQL injection, cross-site scripting and TOTP brute-forcing. Upgrade GLPI 11.0 before 11.0.8 to 11.0.8, and GLPI 10.0 before 10.0.26 to 10.0.26.

• High 8.1 KEV CVE-2026-87902 WordPress 23 September 2026

  WordPress unauthenticated page-template path traversal can lead to RCE (CVE-2026-87902)

  Unauthenticated page-template path traversal in WordPress before 7.1.2 can lead to remote code execution under specific conditions. CISA KEV records active exploitation. Apply the vendor's branch-specific update, including 7.1.2, immediately.

• Critical 9.3 KEV CVE-2026-94127 22 September 2026

  BIG-IP APM OAuth vulnerability allows unauthenticated remote code execution (CVE-2026-94127)

  BIG-IP APM configured as an OAuth Authorization Server is vulnerable to unauthenticated remote code execution. CISA lists CVE-2026-94127 as exploited in the KEV catalogue. Apply the engineering hotfixes for affected BIG-IP branches.

• Critical 9.1 CVE-2026-84388 Fortinet 22 September 2026

  FortiPAM Chrome Extension improper authentication lets malicious sites proxy browser traffic (CVE-2026-84388)

  Fortinet advisory FG-IR-26-168 covers CVE-2026-84388, an improper authentication weakness in the FortiPAM Chrome Extension. A malicious website could proxy a user's browser traffic through attacker-controlled servers. No fixed version or workaround has been published.

• Critical 9.8 KEV CVE-2026-93616 Check Point 22 September 2026

  Check Point Quantum Security Management directory traversal and file upload allows unauthenticated script execution (CVE-2026-93616)

  Check Point Quantum Security Management is affected by a critical directory traversal and file upload flaw (CVE-2026-93616) that lets unauthenticated attackers run arbitrary scripts. CISA KEV lists active exploitation. Apply vendor instructions in SK1000171.

• Critical 9.5 KEV CVE-2026-93952 22 September 2026

  VeloCloud Orchestrator On-Prem Improper Input Validation Allows Remote Access to Privileged Functionality (CVE-2026-93952)

  CVE-2026-93952 is a critical improper input validation issue in on-premises VeloCloud Orchestrator. CISA KEV lists it as actively exploited. Fixed builds listed are 5.2.3.16 and 6.4.2.8; apply the relevant build or restrict network exposure.

• Weekly roundup Critical 10.0 74 CVEs in scope IBM 20 September 2026

  IBM week 38, September 2026: MQ and Verify Access flaws lead 74 CVEs

  IBM week 38 covers 74 CVEs: 6 critical, 33 high, 32 medium, 3 low. None is exploited or in CISA KEV. Prioritise MQ Appliance pre-auth CVE-2026-10747, then unauthenticated RCE in MQ and Verify Identity Access, Sterling File Gateway auth bypass, and authenticated MQ code-execution flaws.

• Weekly roundup Critical 10.0 KEV 85 CVEs in scope Cisco 20 September 2026

  Cisco week 38 2026: two exploited flaws lead 85 CVEs across ISE, email and firewalls

  Cisco's week 38 2026 release covers 85 CVEs: 29 critical, 26 high, 29 medium and 1 low. Two are actively exploited and in CISA KEV: CVE-2026-76461 in Secure Email Gateway and CVE-2026-76460 in Identity Services Engine. Patch these first, then other internet-facing ISE, firewall and email issues.

• Weekly roundup Critical 9.6 49 advisories in scope Open-source business platforms 20 September 2026

  Open-source business platforms, week 38 2026: Shopware and ERPNext authorisation flaws lead 51 advisories

  Week 38 covers 51 vulnerabilities across Shopware, ERPNext, WordPress and Nextcloud — 5 with CVE ids, 46 as GitHub advisories. None is listed in CISA KEV or reported exploited. Critical Shopware webhook exposure and ERPNext SQL injection and stored XSS lead the patch order.

• Critical 9.1 CVE-2026-75878 IBM 18 September 2026

  IBM Sterling File Gateway authentication bypass via unvalidated SSO header (CVE-2026-75878)

  IBM Sterling File Gateway 6.2.0.0 to 6.2.0.6_1, 6.2.1.0 to 6.2.1.2, and 6.2.2.0 to 6.2.2.1 has a critical authentication bypass via an unvalidated SSO header. A remote attacker can obtain a fully authenticated session. IBM has published an advisory.

• Critical 9.9 CVE-2026-10858 IBM 18 September 2026

  IBM MQ for HPE NonStop heap buffer underflow lets authenticated attackers cause denial of service or execute code (CVE-2026-10858)

  IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 has a critical heap buffer underflow (CVE-2026-10858). An authenticated attacker can cause denial of service or potentially execute arbitrary code. IBM has published a fix; apply it.

• Critical 10.0 CVE-2026-10747 IBM 18 September 2026

  IBM MQ Appliance protocol message heap buffer overflow allows pre-authentication denial of service or code execution (CVE-2026-10747)

  IBM MQ Appliance has a critical pre-authentication heap buffer overflow in protocol message processing. A remote attacker can cause denial of service or potentially execute arbitrary code. IBM has a fix; no active exploitation is recorded.

• Critical 9.6 GHSA-rv4r-c8v3-3hrc, GHSA-v38v-9h2p-hr8v, GHSA-734c-hv9r-mg2c … Frappe / ERPNext 18 September 2026

  ERPNext 15 and 16 fix critical account takeover, SQL injection and authorisation flaws

  Frappe has fixed critical and high-severity flaws in ERPNext, including unauthenticated stored XSS account takeover and SQL injection by any authenticated user. No workaround exists. Upgrade 15.x to 15.121.3 and 16.x to 16.35.0.

• High 7.4 CVE-2026-20222 Cisco 17 September 2026

  Cisco ASA and FTD EIGRP denial of service lets adjacent attackers reload devices (CVE-2026-20222)

  Cisco Secure Firewall ASA and FTD Software have a high-severity EIGRP denial-of-service vulnerability (CVSS 7.4). An unauthenticated adjacent attacker can cause repeated device reloads. Apply Cisco's fixed software and enable EIGRP authentication as mitigation.

• High 8.6 CVE-2026-20154 Cisco 17 September 2026

  Cisco ASA and FTD logging denial of service lets remote attackers exhaust CPU (CVE-2026-20154)

  Unauthenticated remote attackers can cause high CPU and denial of service on Cisco ASA and FTD firewalls by flooding a device with TCP SYN packets. Apply Cisco's logging rate-limit workaround and monitor for fixed releases.

• High 8.6 CVE-2026-20135 Cisco 17 September 2026

  Cisco Secure Firewall Threat Defense TLS 1.3 denial of service (CVE-2026-20135)

  Cisco Secure Firewall Threat Defense has a high-severity TLS 1.3 denial-of-service flaw. An unauthenticated remote attacker can crash the LINA process and reload a vulnerable device. Fixes are available; patch or temporarily disable TLS 1.3.

• High 8.6 CVE-2026-20249 Cisco 17 September 2026

  Cisco ASA and FTD IKEv2 certificate authentication denial of service (CVE-2026-20249)

  Unauthenticated remote attackers can crash IKEv2 VPN services on affected Cisco ASA and FTD appliances by sending a crafted certificate during connection setup. Cisco has published a fix; no workaround is available.

• High 8.6 CVE-2026-20250 Cisco 17 September 2026

  Cisco Secure Firewall ASA and FTD DTLS denial of service allows unauthenticated remote attackers to reload affected devices (CVE-2026-20250)

  Cisco Secure Firewall ASA and FTD software on Firepower 3100 and 4200 series has a network-reachable DTLS denial-of-service flaw. Unauthenticated attackers can send crafted DTLS traffic to reload the device. Cisco indicates a fix is available, and a workaround disables DTLS flow offload.

• High 8.6 CVE-2026-20295, CVE-2026-20323 Cisco 17 September 2026

  Cisco Secure Firewall sftunnel vulnerabilities allow denial of service and authentication bypass (CVE-2026-20295, CVE-2026-20323)

  Cisco Secure Firewall Management Center and Threat Defense software have two high-severity sftunnel vulnerabilities: remote memory exhaustion denial of service (CVE-2026-20295) and adjacent authentication bypass to root (CVE-2026-20323). Fixes are available; no workarounds.

• Critical 10.0 KEV CVE-2026-76460 Cisco 16 September 2026

  Cisco Identity Services Engine authentication bypass lets unauthenticated attackers access the web management interface (CVE-2026-76460)

  Cisco Identity Services Engine has a critical API authentication bypass allowing unauthenticated remote access to the web management interface. CISA KEV and Cisco PSIRT confirm active exploitation. Apply Cisco's iACL mitigation, restrict exposure, and upgrade to a fixed software release.

• Critical 9.1 CVE-2026-20341, CVE-2026-20340, CVE-2026-20344 … Cisco 16 September 2026

  Cisco Secure Firewall Management Center flaws allow root command execution, SQL injection and DoS (CVE-2026-20340 to CVE-2026-20344)

  Cisco disclosed five Secure Firewall Management Center vulnerabilities: root command execution, SQL injection, arbitrary file download and an unauthenticated API denial-of-service. No workarounds exist. Review Cisco's advisory, restrict management access, and apply the fixed software.

• Critical 9.8 CVE-2026-20242 Cisco 16 September 2026

  Cisco Secure Firewall Management Center Java deserialization allows remote code execution as root (CVE-2026-20242)

  Cisco Secure Firewall Management Center has a critical Java deserialization flaw in External Database Access. An unauthenticated attacker who controls a configured database host can run commands as root. Cisco has published fixes; disable External Database Access until you apply the fixed release.

• Critical 10.0 CVE-2026-76423, CVE-2026-76425, CVE-2026-76424 … Cisco 16 September 2026

  Cisco ISE REST API authentication bypass allows unauthenticated administrative access (CVE-2026-76423)

  Cisco ISE and ISE-PIC are affected by multiple vulnerabilities, including CVE-2026-76423, an unauthenticated REST API authentication bypass with CVSS 10. Fixes are available; apply Cisco's fixed software and restrict exposure.

• Critical 9.9 CVE-2026-20324 Cisco 16 September 2026

  Cisco Secure Firewall Management Center sftunnel arbitrary code execution lets authenticated attackers run commands as root (CVE-2026-20324)

  Cisco Secure Firewall Management Center (FMC) sftunnel flaw allows an authenticated remote attacker to execute commands as root. Affected releases include 7.0.0 through 7.0.3 and 7.2.0. Cisco has a fix, but no workarounds.

• Critical 9.9 CVE-2026-20326, CVE-2026-20322, CVE-2026-20325 … Cisco 16 September 2026

  Cisco Nexus Dashboard September 2026 hardening fixes missing authentication and injection flaws (CVE-2026-20326 and others)

  Cisco Nexus Dashboard releases are affected by multiple critical missing authentication and injection flaws. Cisco's September 2026 security hardening release fixes them; no workaround is listed.

• Release roundup Critical 10.0 330 CVEs in scope Oracle 16 September 2026

  Oracle Critical Security Patch Update Advisory, September 2026: unauthenticated Fusion Middleware flaws lead 330 fixes

  Oracle's September 2026 Critical Patch Update covers 330 CVEs: 69 critical, 234 high, 24 medium and 3 low. No CVEs are recorded as exploited or in CISA KEV. Unauthenticated Fusion Middleware flaws, several scored 10.0, warrant priority.

• Critical 10.0 CVE-2026-20192, CVE-2026-20130, CVE-2026-20234 … Cisco 16 September 2026

  Cisco Identity Services Engine hardening release addresses multiple critical vulnerabilities (CVE-2026-20192 and others)

  Cisco Identity Services Engine and ISE-PIC have received a hardening release for several critical vulnerabilities, some reachable over the network without credentials. Apply Cisco's September 2026 release; no workarounds are available.

• Critical 9.9 CVE-2026-20329, CVE-2026-20330, CVE-2026-20332 … Cisco 16 September 2026

  Cisco Secure Firewall ASA, FTD and FMC hardening release fixes critical and high vulnerabilities (CVE-2026-20329 through CVE-2026-20336)

  Cisco has released a hardening update for ASA, FTD and FMC software addressing eight critical and high-severity vulnerabilities. No workarounds exist; Cisco reports no known exploitation. Apply the vendor release.

• Critical 9.0 CVE-2026-76420, CVE-2026-76412, CVE-2026-76413 Cisco 16 September 2026

  Cisco Secure Firewall Management Center root command execution and privilege escalation (CVE-2026-76420, CVE-2026-76412, CVE-2026-76413)

  Three vulnerabilities in Cisco Secure Firewall Management Center: unauthenticated root command execution via AJP when sftunnel is down, SSO admin token forgery, and authenticated privilege escalation to root. Fixes are available; see Cisco's advisory for fixed builds.

• Critical 9.9 CVE-2026-20307, CVE-2026-20176, CVE-2026-20211 Cisco 16 September 2026

  Cisco Identity Services Engine remote code execution vulnerabilities (CVE-2026-20307, CVE-2026-20176, CVE-2026-20211)

  Three critical vulnerabilities in Cisco Identity Services Engine allow authenticated administrators to run commands on the underlying operating system. No workarounds exist; Cisco has released fixes. Restrict management access and apply the vendor update.

• Critical 9.1 CVE-2026-20306, CVE-2026-20305 Cisco 16 September 2026

  Cisco Identity Services Engine command injection allows authenticated attackers to gain root (CVE-2026-20305, CVE-2026-20306)

  Two critical command injection flaws in Cisco Identity Services Engine and ISE-PIC allow an authenticated administrator to execute code as root. In single-node ISE deployments, an exploited node can become unavailable and block new network access. Cisco has released fixes; no workaround exists.

• Critical 9.8 CVE-2026-91843 Check Point 16 September 2026

  Check Point Quantum Security Management stack overflow allows unauthenticated remote code execution (CVE-2026-91843)

  Check Point Quantum Security Management has a critical pre-authentication stack overflow in the login process. No fixed release or vendor workaround is listed yet, so restrict access to management and log servers and monitor for unusual activity.

• Critical 9.6 GHSA-2qxr-vvj4-5934, GHSA-r432-q883-wgvf, GHSA-8xfc-pww7-3rm5 … Shopware 16 September 2026

  Shopware 6.7.14.1 and 6.6.10.25 fix SQL injection, webhook and privilege escalation flaws

  Shopware has released 6.7.14.1 and 6.6.10.25 to fix five security advisories: Store API SQL injection, webhook permission bypass, two privilege escalation flaws and a newsletter double opt-in bypass. Operators should upgrade.

• Release roundup High 8.8 8 CVEs in scope Apple 15 September 2026

  Apple security updates, September 2026: four high-severity macOS flaws lead eight fixes

  Apple's September 2026 security updates cover eight macOS CVEs: four high, four medium. None is listed in CISA KEV or marked exploited. The standout is a remote afpfs handling flaw that can cause kernel memory corruption; two local privilege escalation issues also need prompt patching.

• Release roundup High 7.8 9 CVEs in scope Apple 15 September 2026

  Apple security updates, September 2026: nine CVEs led by network privacy and memory-handling flaws

  Apple's September 2026 release covers 9 CVEs across iOS, iPadOS, macOS, tvOS, watchOS and visionOS. Three high, five medium, one low; none in CISA KEV or exploited. Patch iOS/iPadOS 26.6 first for the network-reachable fingerprinting flaw, then memory-handling fixes.

• Release roundup High 8.8 34 CVEs in scope Apple 15 September 2026

  Apple security updates, September 2026: seven high-severity fixes across 34 CVEs

  Apple's September 2026 updates address 34 CVEs across Safari, iOS, iPadOS, macOS, tvOS, visionOS and watchOS. No CVE is in CISA KEV. Start with the seven high-severity web-content and kernel issues, then the medium and low items.

• Release roundup Critical 9.8 98 CVEs in scope Apple 15 September 2026

  Apple security updates, September 2026: two critical macOS kernel flaws lead 98 fixes

  Apple's September 2026 security updates cover 98 CVEs: 2 critical, 34 high, 61 medium and 1 low. None is listed in CISA KEV or marked exploited. The two critical macOS kernel flaws are reachable over the network without credentials, so patch macOS first.

• Release roundup Critical 9.8 118 CVEs in scope Apple 15 September 2026

  Apple security updates, September 2026: five critical core OS flaws lead 118 fixes

  Apple's September 2026 update addresses 118 CVEs across iOS, iPadOS, macOS, tvOS, visionOS, watchOS and Safari. No in-scope CVE is exploited or in CISA KEV. Five critical and 28 high severity flaws, chiefly memory corruption and permission issues, call for prompt broad patching.

• Critical 9.8 CVE-2026-12351 IBM 15 September 2026

  IBM MQ JNDI injection allows unauthenticated remote code execution (CVE-2026-12351)

  IBM MQ in the 9.3.0.0, 9.4.0.0 and 10.0.0.0 release lines is vulnerable to unauthenticated remote code execution via unsafe JNDI lookup when the IVT application is deployed. CVSS 9.8 critical. Apply IBM's fix; confirm the correct build for your release.

• Critical 9.8 KEV CVE-2026-76461 Cisco 14 September 2026

  Cisco Secure Email Gateway SQL injection enables unauthenticated remote command execution (CVE-2026-76461)

  Cisco Secure Email Gateway's AsyncOS email parsing has a critical SQL injection flaw (CVE-2026-76461). A remote, unauthenticated attacker can send a crafted email to execute commands with root privileges. CISA KEV and Cisco PSIRT confirm active exploitation; upgrade to a fixed release.

• Critical 9.8 CVE-2026-76440, CVE-2026-76441, CVE-2026-76443 … Cisco 14 September 2026

  Cisco Secure Email Gateway hardening release addresses critical and high-severity flaws (CVE-2026-76440 and others)

  Cisco has issued a hardening release for Cisco Secure Email and Cisco Secure Email and Web Manager. Multiple flaws, four critical and one high, are reachable over the network without credentials. Cisco reports no known exploitation. No workarounds exist; apply the Cisco hardening release.

• Weekly roundup High 8.1 8 CVEs in scope IBM 13 September 2026

  IBM vulnerabilities, week 37 of 2026: two high-severity Db2 flaws and five WebSphere CVEs

  IBM's week 37 2026 release covers eight CVEs across Db2 and WebSphere Application Server: two high and six medium. None is exploited or in CISA KEV. Patch Db2 first, then move WebSphere to 9.0.5.29 or 8.5.5.31.

• Weekly roundup High 7.2 9 CVEs in scope Palo Alto Networks 13 September 2026

  Palo Alto Networks week 37 2026: PAN-OS XML buffer overflow leads nine fixes

  Palo Alto Networks published 9 CVEs for 7–13 September 2026: 1 high, 5 medium, 3 low. None is in CISA KEV or reported exploited. CVE-2026-0310, an unauthenticated PAN-OS XML buffer overflow, can cause DoS or root code execution. Patch PAN-OS/Prisma Access first, then agents and Checkov.

• Weekly roundup Critical 9.6 10 CVEs in scope Fortinet 13 September 2026

  Fortinet week 37 2026: critical FortiMonitorOnSight authentication bypass leads 10 CVEs

  Fortinet's week 37 2026 release covers 10 CVEs: one critical, two high, five medium and two low. The standout is CVE-2026-84390, an unauthenticated authentication bypass in FortiMonitorOnSight. No CVEs are listed as exploited or in CISA KEV, and no fixed versions are listed.

• Weekly roundup Critical 10.0 KEV 16 advisories in scope Open-source business platforms 13 September 2026

  Open-source business platforms week 37 2026: exploited Adobe Commerce flaw among 17 vulnerabilities

  Week 37 2026: 17 vulnerabilities across Adobe Commerce, Magento, Dolibarr, TYPO3, Frappe, WooCommerce and PrestaShop; 15 have CVE ids. CVE-2026-75650 is an exploited CVSS 10 Adobe Commerce template engine flaw in CISA KEV. Apply that hotfix first, then September updates.

• High 8.7 CVE-2026-89013, CVE-2026-89012 Dolibarr 12 September 2026

  Dolibarr 23.0.4–24.0.0 authorization and SQL filter bypasses expose files and password hashes (CVE-2026-89013, CVE-2026-89012)

  Dolibarr 24.0.1 fixes two high-severity flaws: an unauthenticated file-read authorization bypass (CVE-2026-89013) and an authenticated SQL filter denylist bypass that recovers password hashes (CVE-2026-89012). Update from 23.0.4 through 24.0.0 to 24.0.1.

• Critical 10.0 KEV CVE-2026-85706 12 September 2026

  GitLab path traversal in repository commits API allows unauthenticated file read (CVE-2026-85706)

  Unauthenticated path traversal in the GitLab CE/EE repository commits API can expose files from the server. Upgrade to a fixed release for your version line: 18.11.12, 19.0.9, 19.1.8, 19.2.6 or 19.3.2. CISA KEV lists active exploitation.

• Critical 9.6 CVE-2026-84390 Fortinet 11 September 2026

  FortiMonitorOnSight JWT authentication bypass allows unauthenticated web portal access (CVE-2026-84390)

  Fortinet FortiMonitorOnSight web portal has a critical JWT authentication bypass (CVE-2026-84390) in versions 7.2.0–7.2.2 and 7.2.4–7.2.7. No fixed version or workaround is listed; restrict network exposure and monitor access.

• High 7.2 CVE-2026-0310 Palo Alto Networks 10 September 2026

  PAN-OS XML processing buffer overflow allows unauthenticated code execution or denial of service (CVE-2026-0310)

  An unauthenticated attacker with network access to PAN-OS management or dataplane interfaces can crash VM-Series firewalls or gain root code execution on PA-Series. Fixed releases are available; no workaround exists.

• Critical 9.8 CVE-2026-85103 Check Point 9 September 2026

  Quantum Security Gateway and Management heap-based buffer overflow in VPN certificate ASN.1 decoding (CVE-2026-85103)

  Check Point Quantum Security Gateway and Security Management are affected by a critical heap-based buffer overflow in VPN certificate ASN.1 decoding. An unauthenticated remote attacker could execute code. No fixed release is listed yet; restrict network exposure and monitor the vendor advisory.

• Critical 9.8 KEV CVE-2026-85102 Check Point 9 September 2026

  Check Point Quantum Security Gateway improper certificate validation allows unauthenticated code execution (CVE-2026-85102)

  Check Point Quantum Security Gateway has a critical certificate validation flaw (CVE-2026-85102) that lets unauthenticated attackers run code over the network. CISA KEV lists it as actively exploited. Apply Check Point's SK1000117 mitigation immediately.

• High 7.3 CVE-2026-84393 Fortinet 9 September 2026

  FortiOS and FortiProxy ZTNA portal improper certificate validation allows man-in-the-middle (CVE-2026-84393)

  FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 are affected by an improper certificate validation flaw in the Agentless ZTNA portal that may allow a remote unauthenticated attacker to perform a man-in-the-middle attack. No fixed release is listed yet.

• Critical 9.3 CVE-2026-77109, CVE-2026-76200, CVE-2026-76201 … Adobe Commerce / Magento 9 September 2026

  Adobe Commerce and Magento Open Source update resolves incorrect authorization, stored XSS and path traversal (APSB26-138)

  Adobe Commerce, Commerce B2B and Magento Open Source need the September 2026 builds to close eight flaws: incorrect authorization, stored XSS and path traversal. The worst is a stored XSS scored 9.3; several authorization flaws require no user action. Apply the 2026-sep release.

• Critical 9.9 KEV CVE-2026-84869 8 September 2026

  ScreenConnect client guest-to-host file execution allows unauthorized code execution (CVE-2026-84869)

  ScreenConnect clients before 26.6.5 are affected by a critical guest-to-host file execution vulnerability rated 9.9. CISA lists it as exploited. Update clients to 26.6.5.9742; ScreenConnect servers are not impacted.

• Critical 9.8 CVE-2026-66302 Microsoft 8 September 2026

  Skype for Business Server remote code execution lets unauthenticated attackers run code (CVE-2026-66302)

  Critical remote code execution in Skype for Business Server can be exploited over the network without authentication. Microsoft has published fixed builds for Skype for Business Server 2015 CU13, 2019 CU8 and Subscription Edition CU1.

• High 7.8 KEV CVE-2026-85880 Microsoft 8 September 2026

  Windows ALPC heap-based buffer overflow allows local privilege escalation (CVE-2026-85880)

  CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC. An authenticated local attacker can exploit it to elevate privileges, and it is recorded as actively exploited by CISA KEV and Microsoft. Patched Windows builds are available.

• High 7.8 KEV CVE-2026-81963 Microsoft 8 September 2026

  Windows Update Stack link following lets local attackers elevate privileges (CVE-2026-81963)

  Microsoft's Windows Update Stack has a high-severity local elevation-of-privilege flaw, listed as exploited by CISA KEV and Microsoft. Apply the September 2026 updates for Windows 11 and Windows Server 2025.

• Critical 9.8 CVE-2026-69910 Microsoft 8 September 2026

  Windows Hyper-V stack-based buffer overflow enables remote code execution (CVE-2026-69910)

  A stack-based buffer overflow in Windows Hyper-V can be exploited over the network without authentication or user interaction. Microsoft has released fixed builds; apply the September 2026 update.

• Critical 9.8 CVE-2026-69845 Microsoft 8 September 2026

  Windows DHCP Server heap-based buffer overflow allows remote code execution (CVE-2026-69845)

  CVE-2026-69845: Critical heap-based buffer overflow in Windows DHCP Server allows unauthenticated remote code execution without user interaction. Affects Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 and Windows 10 1607/1809. Apply Microsoft's September 2026 security updates.

• Critical 9.6 CVE-2026-65669 Microsoft 8 September 2026

  Microsoft SQL Server Management Studio 22 injection lets unauthenticated attackers elevate privileges over the network (CVE-2026-65669)

  Microsoft SQL Server Management Studio 22 before 22.8.2 has a critical injection flaw (CVSS 9.6) that allows an unauthenticated attacker to elevate privileges over the network with user interaction. Update to 22.8.2.

• Release roundup Critical 10.0 19 CVEs in scope SAP 8 September 2026

  SAP Security Patch Day, September 2026: four critical vulnerabilities among 19 fixes

  SAP Security Patch Day, September 2026 covers 19 CVEs: 4 critical, 4 high, 8 medium, 3 low. None exploited or in CISA KEV. Prioritise unauthenticated network-facing issues in SAP Extended Passport, NetWeaver Message Server and SAP CAP, then the remaining SAP Notes.

• Critical 9.8 CVE-2026-67643 Microsoft 8 September 2026

  Microsoft SQL Server heap-based buffer overflow lets unauthenticated attackers execute code over a network (CVE-2026-67643)

  A critical heap-based buffer overflow in Microsoft SQL Server allows unauthenticated attackers to execute code over a network. Fixed builds for SQL Server 2022 and 2025 CU and GDR branches are available now.

• Release roundup Critical 9.8 KEV 938 CVEs in scope Microsoft 8 September 2026

  Microsoft Patch Tuesday, September 2026: two exploited Windows flaws lead 938 fixes

  Microsoft’s September 2026 Patch Tuesday brings 938 CVEs, including two exploited Windows privilege-escalation flaws now in CISA KEV and 41 critical-rated issues. Prioritise the Windows ALPC and Update Stack fixes, then network-accessible SQL Server, Skype for Business and Windows component updates.

• Critical 9.0 CVE-2026-67636 Microsoft 8 September 2026

  Microsoft SQL Server out-of-bounds read allows unauthenticated remote code execution (CVE-2026-67636)

  Microsoft SQL Server 2019, 2022 and 2025 have a critical out-of-bounds read vulnerability. An unauthenticated attacker on the network can execute code; fixed builds are available.

• Critical 9.8 CVE-2026-78509 Microsoft 8 September 2026

  Microsoft Office Outlook heap-based buffer overflow allows unauthenticated remote code execution (CVE-2026-78509)

  Microsoft Office Outlook has a critical heap-based buffer overflow (CVE-2026-78509) allowing an unauthenticated attacker to execute code over a network. Apply Microsoft's September 2026 security updates for your Office release.

• Critical 9.0 CVE-2026-67378 Microsoft 8 September 2026

  Microsoft SQL Server remote code execution lets unauthenticated attackers run code over the network (CVE-2026-67378)

  A critical, unauthenticated remote code execution vulnerability affects Microsoft SQL Server 2019, 2022 and 2025. Apply Microsoft's September 2026 security update.

• Critical 9.8 CVE-2026-69579 Microsoft 8 September 2026

  Windows Message Queuing use-after-free allows remote code execution (CVE-2026-69579)

  Use-after-free in Windows Message Queuing lets an unauthenticated attacker execute code over the network (CVSS 9.8). Microsoft has published fixed builds in the September 2026 update. Apply them to affected Windows 10, Windows 11 and Windows Server systems.

• Critical 9.8 CVE-2026-72982 Microsoft 8 September 2026

  Windows Netlogon stack-based buffer overflow lets unauthorised attackers execute code over a network (CVE-2026-72982)

  Microsoft Windows Netlogon has a critical stack-based buffer overflow (CVE-2026-72982). An unauthorised attacker can execute code over a network without user interaction. The September 2026 security update provides fixed builds; apply them to affected Windows clients and servers.

• Critical 9.8 CVE-2026-72979 Microsoft 8 September 2026

  Windows DHCP Server use-after-free vulnerability allows remote code execution (CVE-2026-72979)

  Use-after-free in Windows DHCP Server allows an unauthenticated attacker to execute code over the network. Microsoft rates the flaw critical and has released fixed builds for affected Windows Server and Windows 10 versions. Apply the September 2026 updates promptly.

• Critical 9.1 CVE-2026-69641 Microsoft 8 September 2026

  Microsoft Exchange Server missing authorization allows privilege elevation (CVE-2026-69641)

  Microsoft Exchange Server has a missing authorization vulnerability (CVE-2026-69641). An authenticated attacker with high privileges can elevate over the network. Fixed security updates are available; apply the builds listed. CVSS 9.1.

• Critical 9.3 CVE-2026-69356 Microsoft 8 September 2026

  Microsoft Exchange Server cross-site scripting allows spoofing over a network (CVE-2026-69356)

  Microsoft Exchange Server 2016 CU23, 2019 CU14/CU15 and Subscription Edition RTM are affected by a cross-site scripting flaw with a CVSS 9.3 critical rating. Microsoft has released fixed builds in the September 2026 security updates.

• Critical 9.8 CVE-2026-69730 Microsoft 8 September 2026

  Windows DNS Server use-after-free lets unauthenticated attackers execute code remotely (CVE-2026-69730)

  Use-after-free in Windows DNS Server (CVE-2026-69730) allows network-based code execution without privileges or user interaction. Microsoft has released fixes for affected Windows 10 and Windows Server builds; apply the September 2026 update.

• Critical 9.8 CVE-2026-69525 Microsoft 8 September 2026

  Windows Remote Desktop Services use-after-free allows unauthenticated remote code execution (CVE-2026-69525)

  Windows Remote Desktop Services use-after-free (CVE-2026-69525) allows unauthorised remote code execution over the network. CVSS 9.8 Critical; Microsoft rates it Important. No exploitation or public disclosure is recorded. Apply the September 2026 security update.

• Critical 9.8 CVE-2026-67631 Microsoft 8 September 2026

  Microsoft SQL Server heap-based buffer overflow allows unauthenticated remote code execution (CVE-2026-67631)

  Microsoft SQL Server 2017 through 2025 is affected by a critical heap-based buffer overflow (CVE-2026-67631) that lets an unauthenticated attacker execute code over the network. Apply the September 2026 security update for your branch; fixed builds are listed below.

• Critical 9.4 CVE-2026-76969 SAP 8 September 2026

  SAP Cloud Application Programming Model credential disclosure allows unauthenticated tenant data replacement or deletion (CVE-2026-76969)

  SAP Cloud Application Programming Model (CAP) multitenant applications using @sap/cds-mtxs at or below 1.18.3, 2.7.6, 3.9.6 and 4.0.2 allow unauthenticated credential disclosure leading to tenant data replacement or deletion. Apply SAP Note 3798315.

• Critical 9.0 CVE-2026-66768 SAP 8 September 2026

  SAP GUI for Java improper access control allows arbitrary command execution (CVE-2026-66768)

  SAP GUI for Java (BC-FES-JAV 8.10) does not correctly enforce trust-level policy for functions invoked by a connected backend system, allowing a low-privileged attacker to run arbitrary commands on a victim's machine (CVSS 9). Apply SAP Note 3781729.

• Critical 9.8 CVE-2026-58240 SAP 8 September 2026

  SAP NetWeaver Message Server missing authentication check lets unauthenticated attackers register components (CVE-2026-58240)

  SAP NetWeaver Message Server KERNEL 9.16, 9.18, 9.19 and 9.20 lacks an authentication check. An unauthenticated attacker with network access could register an unauthorised component, with high impact on confidentiality, integrity and availability. Apply SAP Note 3759472.

• Critical 10.0 CVE-2026-44756 SAP 8 September 2026

  SAP Extended Passport (EPP) memory corruption allows unauthenticated network compromise (CVE-2026-44756)

  SAP Extended Passport (EPP) Processing in SAP kernel and Web Dispatcher lines has a critical memory corruption flaw (CVE-2026-44756). An unauthenticated attacker can send a crafted EPP header to cause undefined behaviour and process termination. Apply SAP Note 3747649.

• Critical 10.0 KEV CVE-2026-75650 7 September 2026

  Adobe Commerce and Magento Open Source template engine flaw enables unauthenticated code execution (CVE-2026-75650)

  CISA KEV lists CVE-2026-75650 as exploited. Adobe Commerce, Adobe Commerce B2B and Magento Open Source have a template engine flaw allowing unauthenticated remote code execution. Apply the relevant hotfix and treat internet-facing instances as exposed.

• Weekly roundup High 7.5 6 CVEs in scope IBM 6 September 2026

  IBM week 36 2026: six CVEs led by a high-severity Verify Identity Access disclosure

  IBM's week 36 2026 set covers six CVEs: one high, five medium, with no CVEs in CISA KEV or confirmed exploitation. The priority is CVE-2026-13297, an unauthenticated information disclosure in Verify Identity Access and Security Verify Access. Patch it first, then Db2 Mirror and MQ Agent.

• Weekly roundup Critical 9.8 11 CVEs in scope Cisco 6 September 2026

  Cisco Week 36 of 2026: three critical IOS XR and NX-OS flaws lead 11 CVEs

  Cisco week 36 of 2026 covers 11 CVEs: 3 critical, 6 high and 2 medium. No exploited or CISA KEV entries. Prioritise the NX-OS Silicon One remote code execution flaw and the IOS XR hardening release, then SIP and Secure Email fixes.

• Weekly roundup High 7.6 2 CVEs in scope Open-source business platforms 6 September 2026

  Open-source business platforms, week 36 of 2026: WooCommerce SQL injection and Dolibarr access control

  Open-source business platforms, week 36 of 2026: two CVEs, one high and one medium. WooCommerce before 11.0 has a high-severity SQL injection; Dolibarr has a medium-severity access-control weakness fixed in 23.0.4. Neither is in CISA KEV. Update WooCommerce first.

• Critical 10.0 KEV CVE-2026-86218 6 September 2026

  N-central pre-authentication remote code execution enables unauthorised code execution (CVE-2026-86218)

  N-central before 2026.3.1.14 has a pre-authentication remote code execution vulnerability, CVE-2026-86218, rated CVSS 4.0 critical (10). CISA KEV lists it as actively exploited. Apply the fixed release N-central 2026.3.1.14 immediately.

• Critical 9.2 KEV CVE-2026-86060 5 September 2026

  MikroTik RouterOS SSH username flaw enables privilege escalation (CVE-2026-86060)

  MikroTik RouterOS has a critical SSH login flaw, CVE-2026-86060, that allows an unauthenticated attacker to escalate privileges. CISA KEV lists the flaw as exploited. Upgrade to RouterOS 6.49.21, 7.23.4 or 7.24.2 and restrict SSH exposure.

• Critical 9.8 CVE-2026-11928, CVE-2026-11921, CVE-2026-12101 … IBM 5 September 2026

  IBM Verify Identity Access and Security Verify Access buffer overflow among multiple addressed issues (CVE-2026-11928)

  IBM has addressed multiple vulnerabilities in Verify Identity Access and Security Verify Access, including a network-reachable buffer overflow scored CVSS 9.8. Apply IBM's update and review exposed instances.

• Critical 9.8 CVE-2026-20274, CVE-2026-20279, CVE-2026-20275 … Cisco 3 September 2026

  Cisco IOS XR Software security hardening release addresses multiple internally discovered vulnerabilities (September 2026)

  Cisco IOS XR Software is affected by multiple internally discovered vulnerabilities fixed in the September 2026 security hardening release. Two are critical and reachable without credentials; no workarounds exist. Apply the release and restrict exposure.

• Critical 9.8 CVE-2026-20212 Cisco 2 September 2026

  Cisco Nexus 3000 and 9000 Series Switches Silicon One HAL remote code execution (CVE-2026-20212)

  Cisco NX-OS for Nexus 3000/9000 exposes TCP ports 43210 and 43211 in the default L3 VRF, allowing unauthenticated remote code execution with root privileges. CVSS 9.8 critical. Apply Cisco's fix and use iACLs as a workaround.

• Critical 10.0 KEV CVE-2026-83548 1 September 2026

  SMA1000 Work Place pre-authentication SSRF exposes sensitive functionality (CVE-2026-83548)

  SMA1000 has a pre-authentication SSRF in the Work Place interface (CVE-2026-83548). CVSS 3.1 score 10 critical; remote unauthenticated attackers can reach sensitive functionality. CISA KEV lists active exploitation. Apply the fixed builds listed below.

• Weekly roundup Critical 9.6 31 advisories in scope Open-source business platforms 30 August 2026

  Open-source business platforms, week 35 2026: three critical Shopware advisories lead 31 fixes

  Open-source business platforms, week 35 of 2026: 31 in-scope flaws across Shopware, Dolibarr, Frappe, Drupal core and ERP. Three critical Shopware advisories and Dolibarr REST API issues stand out; no CISA KEV or exploited entries. Patch Shopware 6.6.10.23/6.7.13.1 and Dolibarr 24.0.0 first.

• Critical 9.8 KEV CVE-2026-82329 28 August 2026

  JFrog Artifactory authentication bypass can grant unauthenticated admin access (CVE-2026-82329)

  JFrog Artifactory has an authentication weakness that, under default configuration, may let an unauthenticated network attacker gain administrative privileges. CISA records active exploitation. Fixed releases are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20.

• Critical 9.4 KEV CVE-2026-82078 28 August 2026

  PaperCut MF/NG unsafe dynamic class loading may allow arbitrary code execution (CVE-2026-82078)

  PaperCut MF/NG has an unsafe dynamic class loading flaw in database connection utilities. High-privileged attackers who can alter configuration may run arbitrary Java bytecode. CISA KEV and SSVC report active exploitation; fixed releases are available. Upgrade promptly.

• Critical 9.8 KEV CVE-2026-60004 26 August 2026

  Gitea diffpatch API remote code execution through Git hook installation (CVE-2026-60004)

  Gitea before 1.27.1 allows unauthenticated remote code execution through the diffpatch API via Git hook installation. CISA KEV lists the vulnerability as exploited. Upgrade to Gitea 1.27.1.

• Release roundup High 8.8 5 CVEs in scope Apple 26 August 2026

  Apple security updates, August 2026: high-severity Safari CSP bypass among five CVEs

  Apple's August 2026 security updates cover five CVEs: one high, three medium, one low. None are exploited or in CISA KEV. Prioritise the high-severity Safari Content Security Policy bypass, then the network denial-of-service, then update iOS, iPadOS, Safari and related Apple systems.

• Critical 9.6 GHSA-6qhw-38wm-7g7h, GHSA-xj2c-8fw5-mr6m, GHSA-xrcf-c96g-q5hr … Shopware 25 August 2026

  Shopware 6.6.10.23 and 6.7.13.1 fix App Script sandbox escape, admin takeover and other flaws

  Shopware's 6.6.10.23 and 6.7.13.1 releases fix ten flaws, including a critical App Script sandbox escape, admin account takeover via Host-header poisoning, SQL injection, SSRF and path traversal. Update immediately.

• High 8.8 CVE-2026-81730, CVE-2026-71504, CVE-2026-81728 … Dolibarr 25 August 2026

  Dolibarr 24.0.0 fixes path traversal, SQL injection and REST API authorization flaws

  Dolibarr before 24.0.0 is affected by ten high-severity flaws: unauthenticated path traversal via EmailCollector attachments, SQL injection in import and user APIs, and REST API authorization bypasses affecting passwords, payments, bank details and payroll. Upgrade to 24.0.0.

• Weekly roundup Critical 10.0 125 CVEs in scope Cisco 23 August 2026

  Cisco vulnerabilities, week 34 of 2026: critical Splunk, Crosswork and Secure Workload fixes lead 125 CVEs

  Cisco week 34 of 2026 covers 125 CVEs: 12 critical, 42 high, 66 medium and 5 low. No CVE is listed in CISA KEV or marked exploited. Prioritise Crosswork Planning, Secure Workload, Splunk Enterprise embedded reports and Splunk MCP Server, then move through the remaining high-severity Splunk items.

• Weekly roundup High 8.9 11 CVEs in scope Open-source business platforms 23 August 2026

  Open-source business platforms, week 34 of 2026: Joomla and WordPress upload and access flaws lead 11 fixes

  Open-source business platforms week 34 (17–23 August 2026) covers 11 CVEs: 10 Joomla! CMS and one WordPress. None are exploited or in CISA KEV. Four high-severity flaws include Joomla SHTML upload, WordPress PostScript RCE, ACL and MFA bypass. Patch Joomla to 5.4.8 or 6.1.3; update WordPress.

• Weekly roundup Critical 9.9 144 CVEs in scope IBM 23 August 2026

  IBM AIX week 34 2026: 32 critical flaws include unauthenticated command execution

  IBM's week 34 2026 release covers 144 AIX CVEs, some also affecting PowerVM VIOS: 32 critical, 79 high. No CVE is in CISA KEV or reported exploited. Unauthenticated command execution and memory-corruption flaws in AIX and VIOS should be patched first on exposed systems.

• Critical 9.1 CVE-2026-76404 Cisco 20 August 2026

  Splunk MCP Server app deserialization flaw lets admin users run OS commands (CVE-2026-76404)

  Splunk MCP Server app versions 1.2 through before 1.2.1 contain a critical deserialization vulnerability (CVSS 9.1). An attacker with the admin Splunk role can execute arbitrary OS commands. Install version 1.2.1 to fix the issue.

• Critical 9.4 CVE-2026-76312 Cisco 20 August 2026

  Splunk Enterprise embedded reports improper access control lets unauthenticated users access data (CVE-2026-76312)

  Splunk Enterprise 9.4, 10.0, 10.2 and 10.4 before the patched builds has improper access control in embedded reports. An unauthenticated user who can read the HTML source of an embedding page could reuse exposed session material to access data and affect integrity. Apply the fixed releases.

• Critical 9.4 CVE-2026-76311 Cisco 19 August 2026

  Splunk Enterprise embedded report access control lets unauthenticated users download dispatch archives (CVE-2026-76311)

  Splunk Enterprise before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 has an improper access control flaw in embedded report dispatch archives. An unauthenticated user with an embedded report token can download an archive and use exposed session material to access data and affect integrity. Upgrade now.

• Critical 9.4 CVE-2026-76310 Cisco 19 August 2026

  Splunk Enterprise embedded report access control flaw lets unauthenticated users take administrative actions (CVE-2026-76310)

  Splunk Enterprise 9.4, 10.0, 10.2 and 10.4 before fixed builds have a critical access control flaw. An unauthenticated user with an embedded report token can recover session material and act with the report owner's privileges, including admin. Update to 9.4.14, 10.0.9, 10.2.6 or 10.4.2.

• Release roundup Critical 10.0 KEV 390 CVEs in scope Oracle 19 August 2026

  Oracle Critical Patch Update, August 2026: one exploited Identity Manager flaw in 390 fixes

  Oracle's August 2026 Critical Patch Update covers 390 CVEs: 84 critical and 247 high. CVE-2025-61757 in Oracle Identity Manager is actively exploited and in CISA KEV. Apply that first, then unauthenticated OID and WebCenter flaws, then the wider update.

• Critical 9.5 KEV CVE-2026-72530 19 August 2026

  TrueConf Server isolated environment breakout enables unauthenticated remote code execution (CVE-2026-72530)

  TrueConf Server before 5.3.9 (5.3.x), before 5.4.9 (5.4.x) and before 5.5.5 (5.5.x) can be exploited over TCP 4307 by an unauthenticated attacker to escape an isolated environment and run code on the host. CISA KEV lists active exploitation. Apply the fixed builds.

• Critical 9.3 KEV CVE-2026-72529 19 August 2026

  TrueConf Server missing authentication allows unauthenticated script execution via port 4307/TCP (CVE-2026-72529)

  CVE-2026-72529 is a critical (CVSS 9.3) missing authentication flaw in TrueConf Server. A remote attacker with network access to port 4307/TCP can execute an arbitrary script without credentials. CISA KEV records active exploitation; fixed releases are 5.3.9, 5.4.9 and 5.5.5.

• Critical 10.0 CVE-2026-20317, CVE-2026-20315, CVE-2026-20231 … Cisco 19 August 2026

  Cisco Secure Workload August 2026 hardening release fixes improper authentication and access control (CVE-2026-20317 et al.)

  Cisco's August 2026 Secure Workload hardening release fixes several internally discovered improper authentication and access control vulnerabilities. Cisco reports no public disclosure or malicious use. Apply the hardening release; no workarounds exist.

• Critical 10.0 CVE-2026-20030, CVE-2026-20357, CVE-2026-20358 … Cisco 19 August 2026

  Cisco Crosswork Planning hardening release fixes SQL injection, missing authentication and more (CVE-2026-20030, CVE-2026-20357)

  Cisco's August 2026 hardening release for Crosswork Planning fixes four critical, network-reachable flaws including SQL injection and missing authentication. No workarounds; Cisco reports no malicious use. Apply the hardening release.

• Critical 9.9 CVE-2026-17040, CVE-2026-15068, CVE-2026-16816 … IBM 19 August 2026

  IBM AIX and PowerVM VIOS critical vulnerabilities allow remote code execution (CVE-2026-17040, CVE-2026-15068, and eight more)

  IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 have critical vulnerabilities allowing remote unauthenticated code execution, command injection and privilege escalation. IBM has fixed VIOS builds 4.1.0.50, 4.1.1.30 and 4.1.2.20; apply them promptly.

• Critical 9.3 KEV CVE-2026-19490 19 August 2026

  NetScaler ADC and NetScaler Gateway authentication bypass (CVE-2026-19490)

  NetScaler ADC and Gateway are affected by a critical network-reachable authentication bypass, and CISA records active exploitation. Fixed builds are listed for some ADC editions; confirm your branch and restrict exposure now.

• High 8.9 CVE-2026-73337, CVE-2026-73373, CVE-2026-71574 … Joomla! 19 August 2026

  Joomla! Core security release fixes MFA bypass, SHTML uploads and webservice ACL flaws

  Joomla! Core 4.0.0-5.4.6 and 6.0.0-6.1.2 (and the Joomla! Framework Filesystem package) have multiple flaws, including MFA bypass, SHTML upload and webservice ACL issues. Update to Joomla! CMS 5.4.8 or 6.1.3.

• High 8.2 GHSA-xrwj-pq6w-f8m4, GHSA-w6j9-q9rq-wrqg, GHSA-2cr4-vw9p-pjvf … PrestaShop 18 August 2026

  PrestaShop 9.1.5 and 8.2.8 fix SSRF, SQL injection and access control flaws

  PrestaShop 9.0.0 to before 9.1.5 and 8.0.0 to before 8.2.8 are affected by five security advisories: SSRF, CSV injection, IP spoofing, SQL injection and broken access control. Upgrade to PrestaShop 9.1.5 or 8.2.8.

• High 8.8 CVE-2026-65640 WordPress 18 August 2026

  WordPress remote code execution via PostScript file upload by Author-level users (CVE-2026-65640)

  CVE-2026-65640: WordPress before 7.0.4 has a high-severity remote code execution flaw. An Author-level user can upload a malicious PostScript file when Imagick and Ghostscript are enabled. Update to 7.0.4 or the backported release for your branch.

• Critical 9.3 KEV CVE-2026-64849 17 August 2026

  MLflow webhook test SSRF allows unauthenticated access to internal and cloud metadata (CVE-2026-64849)

  MLflow before 3.15.0 has an unauthenticated server-side request forgery (SSRF) flaw in webhook testing. Attackers can use redirects to reach internal or cloud metadata services and read response data. CISA KEV records active exploitation. Upgrade to MLflow 3.15.0.

• Weekly roundup Critical 9.1 KEV 7 CVEs in scope Open-source business platforms 16 August 2026

  Open-source business platforms, week 33 2026: one exploited Adobe Commerce flaw among seven CVEs

  Open-source business platforms week 33 of 2026: seven Adobe Commerce CVEs, including one exploited and KEV-listed incorrect authorisation flaw. Prioritise CVE-2026-71362 and apply the August 2026 Commerce, B2B and Magento Open Source updates.

• Critical 9.9 GHSA-x635-wr4c-7345, GHSA-6w83-8777-v93q, GHSA-8pr6-r75h-h8xx … Frappe / ERPNext 13 August 2026

  Frappe and ERPNext advisories: privilege escalation, SSTI, XSS, SQL injection and CSRF (CVE-2026-66001, CVE-2026-65822)

  Frappe disclosed ten advisories affecting ERPNext. Critical flaws let an authenticated user create privileged accounts or read, write and delete data via template injection; others include stored XSS, SQL injection and CSRF. Apply fixes; two medium Frappe flaws have no fix. No active exploitation.

• Release roundup Critical 9.8 KEV 375 CVEs in scope Microsoft 11 August 2026

  Microsoft Patch Tuesday, August 2026: two exploited flaws headline 375 CVEs

  Microsoft Patch Tuesday, August 2026 covers 375 CVEs — 5 critical, 246 high, 124 medium. Two are exploited and in CISA KEV: a SharePoint Server RCE and a Windows AFD WinSock elevation of privilege. Patch those first, then exposed network-facing critical services.

• Critical 9.1 KEV CVE-2026-48413, CVE-2026-71362, CVE-2026-48414 … Adobe Commerce / Magento 11 August 2026

  Adobe Commerce APSB26-92 fixes stored XSS and authorization flaws (CVE-2026-48413 and five others)

  Adobe Commerce APSB26-92 fixes six flaws: stored XSS CVE-2026-48413 and CVE-2026-48414, and authorization flaws CVE-2026-48415, CVE-2026-48416, CVE-2026-48411, CVE-2026-48412. Exploited CVE-2026-71362 has its own page. Upgrade to August 2026 releases.

• Critical 9.1 KEV CVE-2026-71362 11 August 2026

  Adobe Commerce incorrect authorization allows unauthenticated privilege escalation (CVE-2026-71362)

  Adobe Commerce, Adobe Commerce B2B and Magento Open Source are affected by an incorrect authorization vulnerability (CVE-2026-71362) with a critical CVSS 9.1 score. CISA lists it as actively exploited. Apply the August 2026 security updates before 27 September 2026.

• Critical 10.0 KEV CVE-2026-5430 6 August 2026

  WSO2 JWT authentication bypass allows unauthenticated account takeover (CVE-2026-5430)

  Several WSO2 API products accept JWTs signed with unapproved algorithms, allowing unauthenticated attackers to take over accounts. CISA KEV lists CVE-2026-5430 as actively exploited with a 2026-09-27 due date; patched builds are available.

• Critical 9.9 CVE-2026-72911, CVE-2026-13227, CVE-2026-72909 … Frappe / ERPNext 5 August 2026

  ERPNext server-side template injection and related access-control flaws (CVE-2026-72911 and others)

  ERPNext before 15.118.0 and 16.x before 16.29.0: a server-side template injection flaw lets an authenticated user with a common operational role run server-side code; four related access-control flaws affect earlier releases. Upgrade to 15.118.0 or 16.29.0.

• Critical 9.9 GHSA-cx24-rr7r-mxrg, GHSA-239h-ffjr-v957, GHSA-3phg-q9w9-4pqw … SuiteCRM 31 July 2026

  SuiteCRM flaws before 7.15.2 and 8.10.2 allow SQL injection, code execution and account takeover

  SuiteCRM before 7.15.2 and before 8.10.2 has SQL injection, local file inclusion to RCE, and a password-reset account takeover flaw. An authenticated user can read or modify the database or execute code. Upgrade to SuiteCRM 7.15.2 or 8.10.2; the password-reset flaw is fixed in SuiteCRM-Core 8.10.2.

• Critical 9.9 CVE-2026-65974, CVE-2026-12895, CVE-2026-72908 … Frappe / ERPNext 29 July 2026

  ERPNext updates fix server-side template injection, SQL injection and broken access control (CVE-2026-65974)

  ERPNext before 15.111.0 and 16.22.0 has a critical server-side template injection allowing remote code execution for low-privileged authenticated users, plus SQL injection and broken access control. Fixed releases are available; update to the latest patched version.