Advisories
Critical Vulnerability in F5 Big-IP APM Under Active Exploitation (CVE-2026-94127)
On September 22nd, 2026, F5 published an advisory for a critical vulnerability in BIG-IP Access Policy Manager (APM) and confirmed active exploitation in the wild. Tracked as CVE-2026-94127, the flaw lets an unauthenticated, remote attacker send crafted traffic to an affected virtual server and execute code on the appliance.
Sep 22, 2026 - 4 Min Read
Critical Vulnerability in WordPress Disclosed (CVE-2026-87902)
A critical unauthenticated path traversal in WordPress Core lets a remote attacker force a site to include a local PHP file from outside its theme directories, which on common server configurations leads to remote code execution.
Sep 22, 2026 - 4 Min Read
Critical Vulnerability in Cisco ISE Under Active Exploitation (CVE-2026-76460)
On September 16th, 2026, Cisco disclosed a critical vulnerability in Identity Services Engine (ISE) and confirmed it is under active exploitation. Tracked as CVE-2026-76460, the flaw stems from insufficient authentication control on an API endpoint.
Sep 17, 2026 - 3 Min Read
Critical Vulnerabilities in Cisco Secure Email Gateway and Secure Email and Web Manager (CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76443, CVE-2026-76442)
Cisco released hardening updates for its email security appliances on September 14th, closing five sets of vulnerabilities that an unauthenticated, remote attacker can reach regardless of how the device is configured.
Sep 14, 2026 - 4 Min Read
Critical Vulnerability in Cisco Secure Email Gateway Under Active Exploitation (CVE-2026-76461)
On September 14th, 2026, Cisco disclosed a critical vulnerability in the email parsing logic of AsyncOS Software for Cisco Secure Email Gateway. Tracked as CVE-2026-76461, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog the same day, confirming exploitation in the wild.
Sep 14, 2026 - 4 Min Read
Critical Path Traversal in GitLab CE and EE Under Active Exploitation (CVE-2026-85706)
Reaching it requires only a single crafted request to the repository commits API and at least one public project on the target instance. GitLab released fixed versions on September 10th, 2026, and credits researcher s3ntago with reporting the issue through HackerOne.
Sep 13, 2026 - 3 Min Read
Critical Vulnerability in SAP Kernel (CVE-2026-44756)
On September 8th, 2026, SAP disclosed a critical vulnerability in the SAP kernel as part of its September Security Patch Day. Tracked as CVE-2026-44756, the vulnerability grants an unauthenticated attacker remote code execution on a target SAP host. SAP products are commonly deployed internet facing, and successful compromise provides threat actors initial access into an organization’s network.
Sep 10, 2026 - 3 Min Read
Critical Vulnerabilities in Cisco Secure Firewall Management Center Under Active Exploitation (CVE-2026-20079, CVE-2026-20316)
Two Cisco Secure Firewall Management Center flaws, an unauthenticated authentication bypass that grants root and a static credential for a built-in account, are being exploited together by state-sponsored and ransomware actors to take over firewall management consoles.
Sep 9, 2026 - 7 Min Read
Critical Vulnerabilities in Multiple Adobe Products Under Active Exploitation (CVE-2026-48273, CVE-2026-75746, CVE-2026-19232, CVE-2026-75650)
On September 8th, 2026, CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of a critical vulnerability in Adobe Commerce and Magento Open Source. The flaw lets an unauthenticated, remote attacker inject and execute arbitrary code through Magento's template engine. Magento is an E-commerce platform, and a compromise could expose confidential client financial data. It could also provide threat actors initial access into an organization’s internal network. It was one of four critical vulnerabilities Adobe addressed across its September 2026 security update cycle involving multiple products.
Sep 9, 2026 - 4 Min Read
Critical Remote Code Execution Vulnerabilities in Check Point Quantum Security Gateway and Security Management (CVE-2026-85102, CVE-2026-85103)
On September 9th, 2026, Check Point released emergency security updates for two critical vulnerabilities in the VPN certificate handling of its Quantum product line. The vulnerabilities could allow an unauthenticated, remote attacker to compromise and execute code on affected Check Point systems.
Sep 9, 2026 - 4 Min Read