Weekly Vulnerability Report: Sep 7 – Sep 13, 2026
24 new CVEs were published, 11 of them rated critical or high. 14 were added to CISA's exploited list.
Between September 7, 2026 and September 13, 2026, 24 new vulnerabilities were published, 26% more than the previous week (19). 11 of them, or 46%, were rated high or critical. The busiest day was September 7, 2026, with 10 CVEs.
CISA confirmed active exploitation of 14 vulnerabilities during the week. These are listed first below because attackers are already using them. Pmmp had the most new CVEs (16), and improper input validation was the most common weakness type (8).
Confirmed exploited this week
- 10.0 Critical severity
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Exploited
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbit
- 7.8 High severity
Microsoft Windows Link Following Exploited
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Microsoft Windows Heap-Based Buffer Overflow Exploited
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
- 9.8 Critical severity
N-able N-central Static Code Injection Exploited
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
- 9.8 Critical severity
Fortinet Multiple Products Heap-based Buffer Overflow Exploited
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.
- 9.8 Critical severity
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Exploited
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
- 10.0 Critical severity
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Exploited
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying opera
- 8.8 High severity
Google Chromium V8 Out of Bounds Write Exploited
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.2 High severity
MikroTik RouterOS Missing Authentication for Critical Function Exploited
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail fr
- 9.8 Critical severity
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Exploited
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated
- 8.8 High severity
JFrog Artifactory Incorrect Authorization Exploited
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
- 7.5 High severity
JFrog Artifactory Improper Authentication Exploited
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
- 9.9 Critical severity
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Exploited
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
- 10.0 Critical severity
GitLab Community Edition and Enterprise Edition Path Traversal Exploited
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrar
The 11 most important new vulnerabilities
- 10.0 Critical severity
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Exploited
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbit
- 9.8 Critical severity
Check Point Multiple Products Improper Certificate Validation Exploited
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
- 10.0 Critical severity
GitLab Community Edition and Enterprise Edition Path Traversal Exploited
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrar
- 9.9 Critical severity
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Exploited
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
- 8.8 High severity
Google Chromium V8 Out of Bounds Write Exploited
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 7.8 High severity
Microsoft Windows Link Following Exploited
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Microsoft Windows Heap-Based Buffer Overflow Exploited
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields…
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName
- 7.5 High severity
PocketMine-MP: Improper Verification of Cryptographic Signature
PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verifica
- 7.5 High severity
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket…
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.
- 7.5 High severity
PocketMine-MP: Comparison Using Wrong Factors
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the serv
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 4 | 17% |
| High | 7 | 29% |
| Medium | 13 | 54% |
| Low | 0 | 0% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.