Microsoft and Adobe Patch Tuesday, September 2026 Security Update Review

Microsoft kicks off September with its monthly Patch Tuesday release, delivering fixes for security vulnerabilities affecting its products. The security updates are packed with security fixes, providing organizations with important updates to help protect their environments from emerging threats...

CVE-2026-81963

creationtimestamp| type| source ---|---|--- 2026-09-08 17:25:21+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117236585017342705 2026-09-08 18:09:10+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3muzmkt3whi2t 2026-09-08 18:19:20+00:00| seen|...

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization

SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...

VulnCheck KEV: CVE-2026-87491

Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft...

CVE-2026-86060

creationtimestamp| type| source ---|---|--- 2026-09-05 20:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muse5uamk62w 2026-09-05 21:41:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7hz5v6cd2tn4v 2026-09-05 22:00:02+00:00| exploited|...

CVE-2026-67276

creationtimestamp| type| source ---|---|--- 2026-09-05 20:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muse5sihmx2j 2026-09-05 22:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4974c0db-04af-472f-a69e-78bc275e7d1b 2026-09-...

CVE-2026-67277

creationtimestamp| type| source ---|---|--- 2026-09-05 20:20:30+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117220286803293141 2026-09-05 22:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1d9ea784-c941-41ec-aa5f-c1cb172bcb68 2026-09-0...

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 CVSS score: 8.8, has been described as a type confusion bug in V8, Chrome's JavaScript and...

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...

The Bug Report – August 2026 Edition

The Bug Report – August 2026 Edition By Jonathan Omakun · September 3, 2026 Why am I here? Sharpen your pencils and pull out those fresh notebooks; we're back with the bug report! Half the world is squeezing the last drops of joy out of their summer vacations, and the other half is on the...

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

Overview On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution RCE ...

CVE-2026-78141

creationtimestamp| type| source ---|---|--- 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9751b736-8bb9-4c37-8b98-397276c88a36 2026-09-03 01:02:36+00:00| exploited|...

CVE-2026-5153

creationtimestamp| type| source ---|---|--- 2026-09-02 10:00:30+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2026-09-01 2026-09-02 11:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7b4ab454-d7da-47b7-8de3-083f9b71d5a8 2026-09-03...

EUVD-2026-68393

A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexit...

CVE-2026-82552

A security vulnerability has been detected in Linux Foundation Magma 1.9.0. Affected by this vulnerability is an unknown functionality of the file tasks/ngap/ngapamf.c of the component gNB Termination Handler. The manipulation leads to denial of service. The attack is possible to be carried out...

Exploit for Code Injection in Langflow

CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution...

CVE-2026-66384

creationtimestamp| type| source ---|---|--- 2026-08-27 17:44:46+00:00| seen| https://bsky.app/profile/cvesentinel.bsky.social/post/3mu3fm5paxf24 2026-08-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d46c9d24-f8e3-4328-8a89-6da9954a94e6...

Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 CVSS score: 9.8, a case of remote code execution that allows an...

CGA-7R46-5XW5-56Q2

Bulletin has no description...

CVE-2026-77136

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute...