CVE-2026-78449

creationtimestamp| type| source ---|---|--- 2026-09-08 22:01:03+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:00:59+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:54:57+00:00|...

Microsoft Plugs Nearly 1,000 Security Holes

Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that man...

Patch Tuesday - September 2026

Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch...

GHSA-JRC7-96C5-Q579 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Impact DOM.sanitize in src/util/dom.ts iterated elem.attributes a live NamedNodeMap while calling elem.removeAttribute in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute. An attacker can provide an HTML paylo...

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Impact DOM.sanitize in src/util/dom.ts iterated elem.attributes a live NamedNodeMap while calling elem.removeAttribute in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute. An attacker can provide an HTML paylo...

CVE-2026-32202

Zero-click強制認証: 細工された .lnk が含まれるフォルダを表示すると、アイコンのレンダリング時にUNC解決がトリガーされ、被害者は攻撃者が指定したアウトバウンド接続を強制され、Net-NTLMv2資格情報が漏洩しリレーも可能になる。これはCVE-2026-21510の不完全な修正により発生した。Microsoftが追加した信頼性検証はShellExecuteExW呼び出し時起動時のみ機能したが、CControlPanelFolder::GetUIObjectOfの時点では既に被害が発生しており、これはShellExecuteの信頼性検証より前に呼び出される。...

kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

A flaw was found in the Linux kernel's iwlwifi Intel Wireless WiFi driver. This vulnerability allows an attacker to cause an out-of-bounds memory access in the WiFi Block Acknowledgement BA session handlers. This occurs when the stamask value is zero, leading to an incorrect station ID calculatio...

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones. The person being called does not have to answer or touch their phone for it to work, but the caller must already be one of their...

Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download

Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/downloadworkdirfile.py, letting attackers access unauthorized files, exploit requires crafted request. id: CVE-2025-55523 info: name: Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download author: 0xAkoko...

PT-2026-88524

Name of the Vulnerable Software and Affected Versions OpenIDC/cjose versions 0.6.1 through 0.6.2.5 Description When encrypting a JSON Web Encryption JWE using AES-CBC-HMAC content-encryption algorithms A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 combined with any key-management algorithm that...

Update your browser: Security fix for Chrome zero-day CVE‑2026‑85046

News, Security Update your browser: Security fix for Chrome zero-day CVE‑2026‑85046 Share September 8th, 2026 Hi everyone! The latest patches to Opera’s browsers address several recent vulnerabilities, including a zero-day exploit CVE‑2026‑85046. We recommend updating your browsers to the latest...

cjose -- Use of Hard-coded Cryptographic Key

https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm...

Security update for emacs

This update for emacs fixes the following issues: code execution upon opening arbitrary file bsc1275941. CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader bsc1276264. CVE-2026-79992: zero-click local command execution via TRAMP bsc1275927. Patch Instructions: To install this SUSE updat...

SUSE-SU-2026:3993-1 Security update for emacs

This update for emacs fixes the following issues: - code execution upon opening arbitrary file bsc1275941. - CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader bsc1276264. - CVE-2026-79992: zero-click local command execution via TRAMP bsc1275927...

ROS-20260907-73-0068

The vulnerability in freerdp3 is related to the lack of checks for division by zero. Exploiting this vulnerability can allow an attacker to cause a service failure...

MariaDB 3.4.0 < 3.4.10

The version of MariaDB installed on the remote host is prior to 3.4.10. It is, therefore, affected by a vulnerability as referenced in the GHSA-fmq9-qjxj-qpf7 advisory. - Impact In the Zero-Configuration SSL protocol, the MariaDB client must refuse sending clear-text password over unverified TLS...

ROS-20260907-73-0104

The vulnerability in gobgp is related to the assignment of the zero pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

Benchmarking LLMs for Threat Level Determination

The fast progress of large language models LLMs opens new opportunities in the management of cyber threat intelligence, but their reliability for operational tasks remains unclear. In this work, we benchmark LLMs on the task of threat level determination. First, we construct a curated dataset...

Skynet: Workflow-Level Anomaly Detection for Agentic AI Via Semantic and Structural Modeling

Agentic AI systems execute complex tasks through long-horizon workflows of planning, tool use, and multi-agent coordination. Task failures in these systems often originate from a single step, such as an injected prompt or a flawed plan, and are then amplified through downstream dependencies as th...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053371)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053371 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCPUSERTIMEOUT, and the other pee...