Keyword

self-hosted

7 dispatches · latest 13 SEP 2026 · all keywords →

exploits

GitLab's CVSS-10 File Read Needs No Login — and the Scanners Are Already Knocking (CVE-2026-85706)

An unauthenticated path traversal in GitLab's repository commits API reads arbitrary files off self-managed CE/EE. Fixed Sept 10 in 19.3.2 / 19.2.6 / 19.1.8, on KEV with a federal due date of Sept 14 — and watchTowr's honeypots are already seeing behavioral probes.

Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.CVSS 10.0Exploited in the wildKEV due 14 SEP 2026CVE-2026-85706 +2
gitlabkevpath-traversal
exploits

JFrog Artifactory: Three Chained Flaws Turn an Unauthenticated Request Into Admin — and a Rust Backdoor Survived the Patch

Two patched JFrog Artifactory flaws chain into unauth-to-admin in under five minutes, CISA put both on KEV with a Sep 25 due date, and Wiz found attackers installing Groovy plugins and a custom Rust backdoor that reportedly outlived patching.

Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.CVSS 8.1Exploited in the wildKEV due 25 SEP 2026CVE-2026-42018 +2
jfrogartifactorykev
exploits

PaperCut's Zero-Day Is Being Exploited Right Now: Every Version Is Exposed, and the Patch Race Is the Real Story

An actively-exploited zero-day in PaperCut NG/MF affects every supported version. The alert came from a university's forensics team, an emergency patch for v25/v26 shipped the next morning, hardened Release 2 for every branch followed by 10:08pm AEST on Aug 28, and it published two new CVEs plus concrete IOCs to hunt.

Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.Exploited in the wildCVE-2026-82078 +3
papercutzero-dayprint-server
exploits

Your authentik 'Helpdesk' Admin Might Be Superuser: CVE-2026-40172 (Not KEV, But Patch It)

A delegated authentik user manager can grant themselves admin-equivalent by assigning arbitrary groups, including is_superuser=True, via the user API. No KEV, no confirmed in-the-wild — but if you run delegated admins, check your SSO.

Moderate severity, 2 of 4. Known flaw, no confirmed in-the-wild exploitation. Fix it when you next touch the box.CVSS 8.1CVE-2026-40172
authentikself-hostedsso