Weekly Vulnerability Report: Sep 14 – Sep 20, 2026
38 new CVEs were published, 13 of them rated critical or high. 7 were added to CISA's exploited list.
Between September 14, 2026 and September 20, 2026, 38 new vulnerabilities were published, 58% more than the previous week (24). 13 of them, or 34%, were rated high or critical. The busiest day was September 14, 2026, with 31 CVEs.
CISA confirmed active exploitation of 7 vulnerabilities during the week. These are listed first below because attackers are already using them. Simon Tatham had the most new CVEs (7), and buffer copy without checking size of input was the most common weakness type (6).
Confirmed exploited this week
- 9.8 Critical severity
Cisco Secure Email Gateway SQL Injection Exploited
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to in
- 8.8 High severity
Google Pixel Improper Authorization Exploited
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 10.0 Critical severity
Cisco Identity Services Engine Incorrect Use of Privileged APIs Exploited
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vuln
- 7.8 High severity
Acronis Backup Incorrect Default Permissions Exploited
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin
- 9.8 Critical severity
Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has
- 5.5 Medium severity
Linux Kernel Race Condition Exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, co
- 8.8 High severity
Linux Kernel Out-of-Bounds Write Exploited
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge
The 10 most important new vulnerabilities
- 10.0 Critical severity
Cisco Identity Services Engine Incorrect Use of Privileged APIs Exploited
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vuln
- 9.8 Critical severity
Cisco Secure Email Gateway SQL Injection Exploited
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to in
- 8.8 High severity
Google Pixel Improper Authorization Exploited
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Acronis Backup Incorrect Default Permissions Exploited
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin
- 9.8 Critical severity
U8 Cloud: Deserialization of Untrusted Data
Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST requ
- 9.8 Critical severity
e-HR: Improper Neutralization of Special Elements used in an SQL Command
Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can
- 7.5 High severity
ca-certificates: Incorrect Resource Transfer Between Spheres
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.
- 8.8 High severity
direct_mail: Incorrect Authorization
An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploit
- 7.5 High severity
tornado: Inconsistent Interpretation of HTTP Requests
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle req
- 7.5 High severity
Freelance Controller DCP: Improper Handling of Length Parameter Inconsistency
Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 20
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 4 | 11% |
| High | 9 | 24% |
| Medium | 10 | 26% |
| Low | 15 | 39% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.