-
In all nine of today’s stories the patch already existed — what arrived today was the record
Four KEV additions, three of them due Saturday, September 12. The biggest number of the day — 1,079,819 people exposed — has nothing left to act on. And…
-
Open WebUI discloses 16 CVEs at once, and its 8.1 OAuth bypass only affects SQLite deployments
Sixteen CVEs against the self-hosted AI platform Open WebUI landed in NVD within one hour on September 9, 2026, all fixed by version 0.11.1 — a release that…
-
AWS discloses a 9.6 RCE in its Postgres MCP server, fixed by the same release as last week’s 6.5
Amazon disclosed a critical command execution flaw in its Postgres MCP server on September 9, 2026 — patched by version 1.1.7, the same release its September 4 bulletin…
-
Google rates the exploited Chrome V8 zero-day Medium, and its release note still lists no security fixes; CISA’s deadline is September 23
CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities catalog on September 9, 2026 with a September 23 deadline, citing a Chrome release note whose security section has not…
-
CISA added a 2025 FortiOS heap overflow to KEV with a September 12 deadline, and named a product the CVE record does not list
CISA added CVE-2025-25249 to the Known Exploited Vulnerabilities catalog on September 9, 2026 with a September 12 deadline; the CVE record scores it 9.8, Fortinet scores it 8.1,…
-
CISA put a 9.3 NetScaler authentication bypass on a three-day clock; Citrix offers no mitigation and the CVE record does not describe the flaw
CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog on September 9, 2026 with a September 12 deadline; Citrix’s advisory, unchanged since August 19, says nothing about exploitation…
-
Cisco confirmed exploitation of its 10.0 Firewall Management Center bypass on September 9; federal agencies have until September 12
CISA added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog on September 9, 2026 with a three-day remediation deadline, the same day Cisco revised a six-month-old advisory to say…
-
Tencent patched a wormable zero-click WeChat flaw on August 21, and it still has no CVE
Calif published a working zero-click WeChat worm on September 8. The bug it exploits was patched on August 21, has no CVE, and appears in no Tencent advisory.
-
F5 BIG-IP APM rootkit injects a PHP web shell that never touches disk; 795 hosts still vulnerable
Sophos published a teardown of a Linux implant on F5 BIG-IP APM appliances that rewrites what Apache sees in memory rather than writing a web shell to disk…
-
Two 10.0s drew a Friday federal deadline, and in half of today’s stories the vendor contradicts its own record
Two flaws scoring 10.0 entered KEV today with a September 11 due date. The bigger-sounding story — patient Social Security numbers taken through a vendor’s API credentials —…
-
Veradigm discloses a breach that reached patient Social Security numbers through API credentials stolen from a third-party vendor
Veradigm told the SEC on September 8, 2026 that an unauthorized party took credentials from a third-party vendor’s environment, used them against a Veradigm application programming interface, and…
-
N-able N-central’s 10.0 enters KEV with a September 11 deadline, and N-able’s own two statements disagree on whether it has been exploited
CISA added the N-central pre-authentication remote code execution flaw to the Known Exploited Vulnerabilities catalog on September 8, 2026 with a September 11 due date, while N-able’s status…
-
Adobe Commerce’s exploited 10.0 enters KEV with a three-day clock, and the fix CISA points to has no version number
CISA added the actively exploited Adobe Commerce flaw to the Known Exploited Vulnerabilities catalog on September 8, 2026 and gave federal agencies until September 11 — three days…
-
Snowflake drivers fetched a cloud identity token before checking the host was Snowflake, and eight driver lines needed the same fix
CVE-2026-86600, published September 8, 2026, describes a confused deputy in Snowflake’s client drivers: the workload-identity flow fetched an ambient cloud credential and attached it to the login request…