Weekly Vulnerability Report: Sep 28 – Oct 4, 2026
24 new CVEs were published, 17 of them rated critical or high. 6 were added to CISA's exploited list.
Between September 28, 2026 and October 4, 2026, 24 new vulnerabilities were published, 29% fewer than the previous week (34). 17 of them, or 71%, were rated high or critical. The busiest day was September 30, 2026, with 7 CVEs.
CISA confirmed active exploitation of 6 vulnerabilities during the week. These are listed first below because attackers are already using them. Ahsay had the most new CVEs (2), and improper limitation of a pathname to a restricted directory was the most common weakness type (6).
Confirmed exploited this week
- 8.8 High severity
Apple Multiple Products Out-of-Bounds Write Exploited
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary
- 9.8 Critical severity
Cisco Catalyst SD-WAN Manager Hex Encoding Exploited
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling o
- 9.8 Critical severity
Fortinet FortiMail Path Traversal Exploited
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions m
- 9.8 Critical severity
Zammad GmbH Zammad Session Fixation Exploited
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
- 7.8 High severity
Zammad GmbH Zammad Improper Privilege Management Exploited
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as
- 7.5 High severity
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Exploited
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
The 15 most important new vulnerabilities
- 9.8 Critical severity
Cisco Catalyst SD-WAN Manager Hex Encoding Exploited
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling o
- 10.0 Critical severity
Ahsay AhsayCBS Command Injection Exploited
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comman
- 8.8 High severity
Apple Multiple Products Out-of-Bounds Write Exploited
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary
- 9.8 Critical severity
Zammad GmbH Zammad Session Fixation Exploited
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.
- 9.8 Critical severity
Fortinet FortiMail Path Traversal Exploited
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions m
- 7.3 High severity
Ahsay AhsayCBS Improper Authentication Exploited
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authe
- 7.8 High severity
Zammad GmbH Zammad Improper Privilege Management Exploited
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as
- 7.5 High severity
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Exploited
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
- 9.8 Critical severity
CVM: Unrestricted Upload of File with Dangerous Type
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating t
- 9.8 Critical severity
0751-9x01: Improper Limitation of a Pathname to a Restricted Directory
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or
- 9.8 Critical severity
Fumeng Cloud: Improper Neutralization of Special Elements used in an SQL Command
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can ex
- 8.8 High severity
akaunting: Improper Neutralization of Special Elements used in an OS Command
Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metachara
- 8.4 High severity
Robot Operating System 2 (ROS 2): Improper Control of Generation of Code
A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the
- 7.5 High severity
Haiyue HCM Cloud: Improper Limitation of a Pathname to a Restricted Directory
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can cra
- 7.5 High severity
U8 CRM: Improper Limitation of a Pathname to a Restricted Directory
Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 8 | 33% |
| High | 9 | 38% |
| Medium | 7 | 29% |
| Low | 0 | 0% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.