Weekly Vulnerability Report: Sep 21 – Sep 27, 2026
34 new CVEs were published, 17 of them rated critical or high. 12 were added to CISA's exploited list.
Between September 21, 2026 and September 27, 2026, 34 new vulnerabilities were published, 60% fewer than the previous week (84). 17 of them, or 50%, were rated high or critical. The busiest day was September 22, 2026, with 11 CVEs.
CISA confirmed active exploitation of 12 vulnerabilities during the week. These are listed first below because attackers are already using them. Edgelesssys had the most new CVEs (5), and improper input validation was the most common weakness type (3).
Confirmed exploited this week
- 8.8 High severity
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Exploited
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
- 9.8 Critical severity
Check Point Multiple Products Improper Certificate Validation Exploited
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
- 9.8 Critical severity
Check Point Multiple Products Path Traversal Exploited
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
- 10.0 Critical severity
Arista VeloCloud Orchestrator Improper Input Validation Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
- 9.8 Critical severity
F5 BIG-IP APM Heap-based Buffer Overflow Exploited
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Depl
- 10.0 Critical severity
WSO2 Multiple Products Path Traversal Exploited
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acces
- 9.1 Critical severity
Adobe Commerce and Magento Incorrect Authorization Exploited
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user int
- 8.8 High severity
Microsoft SharePoint Code Injection Exploited
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 6.5 Medium severity
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Exploited
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the
- 8.1 High severity
WordPress Core Remote File Inclusion Exploited
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to
- 9.8 Critical severity
Citrix NetScaler Improper Input Validation Exploited
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.
- 8.1 High severity
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Exploited
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote
The 15 most important new vulnerabilities
- 9.8 Critical severity
Check Point Multiple Products Path Traversal Exploited
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
- 9.8 Critical severity
F5 BIG-IP APM Heap-based Buffer Overflow Exploited
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Depl
- 8.1 High severity
WordPress Core Remote File Inclusion Exploited
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to
- 9.8 Critical severity
Citrix NetScaler Improper Input Validation Exploited
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.
- 10.0 Critical severity
Arista VeloCloud Orchestrator Improper Input Validation Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
- 8.1 High severity
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Exploited
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote
- 7.2 High severity
Plex Media Server External Control of File Name or Path Exploited
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without si
- 6.5 Medium severity
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Exploited
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
- 4.3 Medium severity
Plex Media Server Server-Side Request Forgery (SSRF) Exploited
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
- 4.3 Medium severity
Plex Media Server Server-Side Request Forgery (SSRF) Exploited
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
- 7.5 High severity
Concert: Use of a Broken or Risky Cryptographic Algorithm
IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- 9.1 Critical severity
Eclipse Open VSX: Insufficient Verification of Data Authenticity
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back t
- 8.8 High severity
BM Content Builder: Improper Limitation of a Pathname to a Restricted Directory
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it
- 8.6 High severity
jet-form-builder-stripe-gateway: Improper Neutralization of Special Elements used in an SQL Command
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes.
- 7.3 High severity
contrast: Insertion of Sensitive Information into Log File
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not custo
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 6 | 18% |
| High | 11 | 32% |
| Medium | 16 | 47% |
| Low | 1 | 3% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.