CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

Overview On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition CE and Enterprise Edition EE. The release addresses CVE-2026-85706, a critical path traversal vulnerability CWE-22 in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLa...

Exploit for Static Code Injection in N-Able N-Central

CVE-2026-86218 — N-able N-central Pre-Authentication RCE | IOC...

Exploit for CVE-2026-85706

CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection...

Exploit for CVE-2026-85706

cve-2026-85706 Unauthenticated arbitrary local file read in G...

CVE-2024-2851

creationtimestamp| type| source ---|---|--- 2026-09-10 11:00:46+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/64394a9a-b4a1-4a61-ba7b-af896277501e...

Update Chrome now to protect against an actively exploited vulnerability

Chrome is rolling out an update for its desktop browser. The update includes 230 security fixes, one of which is known to be actively exploited. The stable channel has been updated to 153.0.8010.36/.37 for Windows and Mac, and 153.0.8010.36 for Linux. How to update Chrome If you don’t want to wai...

Microsoft fixes record 964 flaws, including 2 exploited zero-days

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs, including 104 rated Critical and 860 rated Important, making it the company’s largest Patch Tuesday release on record. Microsoft lists 974 CVEs in its full September security release. However, 10 of those affect cloud services or involv...

Vulnerability handling in Google Chrome

Google has discovered a vulnerability in the V8 JavaScript engine of Google Chrome. Google reports that this vulnerability is actively exploited with the identifier CVE-2026-87491. It involves an out-of-bounds write operation in the V8 engine of Google Chrome, which occurs in versions prior to...

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google on Tuesday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 CVSS score: N/A, has been described as an out-of-bounds bug in V8, Chrome's...

Microsoft and Adobe Patch Tuesday, September 2026 Security Update Review

Microsoft kicks off September with its monthly Patch Tuesday release, delivering fixes for security vulnerabilities affecting its products. The security updates are packed with security fixes, providing organizations with important updates to help protect their environments from emerging threats...

CVE-2026-81963

creationtimestamp| type| source ---|---|--- 2026-09-08 17:25:21+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117236585017342705 2026-09-08 18:09:10+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3muzmkt3whi2t 2026-09-08 18:19:20+00:00| seen|...

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization

SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...

VulnCheck KEV: CVE-2026-87491

Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft...

CVE-2026-86060

creationtimestamp| type| source ---|---|--- 2026-09-05 20:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muse5uamk62w 2026-09-05 21:41:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7hz5v6cd2tn4v 2026-09-05 22:00:02+00:00| exploited|...

CVE-2026-67276

creationtimestamp| type| source ---|---|--- 2026-09-05 20:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muse5sihmx2j 2026-09-05 22:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4974c0db-04af-472f-a69e-78bc275e7d1b 2026-09-...

CVE-2026-67277

creationtimestamp| type| source ---|---|--- 2026-09-05 20:20:30+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117220286803293141 2026-09-05 22:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1d9ea784-c941-41ec-aa5f-c1cb172bcb68 2026-09-0...

Exploit for Type Confusion in Google Chrome

CVE-2026-78938 — V8 TurboFan CheckMaps instance-migration type...

Exploit for CVE-2026-85046

CVE-2026-85046 Chrome Zero-Day Vulnerability Exploited in the...

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 CVSS score: 8.8, has been described as a type confusion bug in V8, Chrome's JavaScript and...

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

On July 9th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Super Forms, a WordPress plugin with an estimated 13,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...