18 dispatches · latest 18 SEP 2026 · all keywords →
The weekly 'top vulnerabilities by CVSS' email goes dark Monday. CISA's replacement signal chain is KEV + advisories + CVE.org — and BOD 26-04 replaces severity scores with a four-variable risk model your patch routine can run on too.
Insecure file permissions in Acronis's cPanel & WHM plugin and Plesk extension let a low-privilege local user escalate to root. Exploited in the wild in limited, targeted attacks; fixed builds are out now.
A single crafted request to an unauthenticated REST endpoint in Cisco Identity Services Engine bypasses the management interface entirely and lands at root. CVSS 10, actively exploited, no workarounds. CISA's federal due date is Saturday.
A SQL injection in Cisco Secure Email Gateway's AsyncOS email parser lets an unauthenticated attacker run arbitrary commands as root by delivering a single crafted email. No login, no exotic ports — just SMTP. CISA added it to KEV on 2026-09-14 with a due date of 2026-09-17.
An unauthenticated path traversal in GitLab's repository commits API reads arbitrary files off self-managed CE/EE. Fixed Sept 10 in 19.3.2 / 19.2.6 / 19.1.8, on KEV with a federal due date of Sept 14 — and watchTowr's honeypots are already seeing behavioral probes.
Two patched JFrog Artifactory flaws chain into unauth-to-admin in under five minutes, CISA put both on KEV with a Sep 25 due date, and Wiz found attackers installing Groovy plugins and a custom Rust backdoor that reportedly outlived patching.
CERT Polska disclosed six RouterOS vulnerabilities found with GPT-5.5-cyber; two chain into zero-auth full device takeover when SSH is internet-reachable, both are on KEV with a Sep 13 due date, and the patched build scans your config for signs of compromise.
Five days after our last Chrome zero-day post, Google patched a second exploited V8 bug — rated Medium by the vendor with no vector of its own, and CISA added it to KEV the next day. Browser patching is a cadence problem now.
An unauthenticated auth bypass in Citrix NetScaler ADC/Gateway landed on CISA's KEV catalog with a Sep 12 due date and a forensic-triage requirement. The vendor published exact config strings to grep before you patch.
CVE-2026-86218 is a CVSS 10.0 pre-auth RCE in N-able's on-prem RMM appliance, fixed in 2026.3 Hotfix 4 (build 2026.3.1.14) and now on KEV with a September 11 due date. Hosted customers are patched; self-hosted ones need to move tonight.
A type-confusion bug in V8's Maglev compiler turns an ordinary sort() into arbitrary read/write on the JS heap. Fixed in 152.0.7977.82, actively exploited, and it's the sixth of these this year.
CVE-2026-59822 lets an unauthenticated attacker open an authenticated LiteLLM MCP session with a fabricated Authorization header — the OAuth2 passthrough fallback replaced failed key validation with an empty auth object. CVSS v4 8.8, fixed in 1.84.0, on KEV with a Sep 16 due date.
CVE-2026-83548 is a pre-auth CVSS 10.0 SSRF in the SMA1000 Work Place interface that chains with post-auth command injection into unauth RCE on internet-facing remote-access gateways. Exploited in the wild, KEV due date Sep 5.
CISA's FY2024/2025 Vulnerability Review (2026-08-26) lands the punchline homelabbers already suspect: most compromises come from injection flaws and input-validation bugs we've known about for twenty years. The fix is Secure by Design, not more zero-day budgets.
CVE-2026-8452 is a Citrix NetScaler flaw the vendor rated as high-severity DoS, but watchTowr Labs demonstrated unauthenticated RCE. CISA added it to KEV Aug 26 with a Saturday due date.
A Git hook planted through Gitea's diffpatch endpoint gives unauthenticated attackers RCE as the Gitea service account. ~5,000 instances are exposed and the KEV due date is today.
A 2023 ownCloud flaw lets anyone who knows a username mint pre-signed URLs and touch any file. CISA just added it to KEV — your ownCloud has probably been quietly vulnerable for three years.
CISA added a Broadcom VMware vCenter vulnerability to the Known Exploited Vulnerabilities catalog with a 46% EPSS. If you run vCenter, you know the drill.