Rosetta Daily · Sep 11, 2026
Traefik shipped seven advisories at once, and they are one defect seen from seven angles: the entrypoint's protections were all written against the HTTP/1.1 header path, so HTTP/3, request trailers and opaque request-targets each reach the backend without passing them. n8n's two expression sandbox escapes have the same shape — both rebind a global the compiler trusted at code-generation time.
Actively exploited (KEV)
[Added detail] Cisco Secure Firewall Management Center: authentication bypass exploited by three separate clusters (CVE-2026-20079, CVSS 10)
Talos says two recently patched FMC vulnerabilities have been exploited by three independent activity clusters, covering both ransomware operations and state-sponsored actors. CISA's federal patch deadline is September 12.
Sources: Bleeping Computer · The Hacker News
MikroTik RouterOS: two flaws enter KEV on the same day (CVE-2026-67277, CVE-2026-86060)
CVE-2026-67277 is missing authentication on the btest service, allowing kernel memory disclosure and denial of service. CVE-2026-86060 is improper neutralization of argument delimiters in a command, letting an attacker change the trusted RouterOS policy mask and escalate privileges. Both were added on evidence of active exploitation.
Sources: CISA
[Added detail] PaperCut NG/MF: a campaign run by hundreds of AI agents reached 395 organizations (CVE-2026-81578, CVE-2026-82078)
Blackpoint Cyber and GreyNoise reported independently that the attacker — assessed as Russian-speaking — used hundreds of AI agents to develop and launch exploitation against more than 440 exposed instances. Both reports trace the activity to a single address, 45.142.193[.]132.
Sources: Bleeping Computer · The Hacker News
WatchGuard Firebox: a remote code execution flaw catalogued in December is now flagged as used in ransomware (CVE-2025-14733)
The flaw entered KEV on December 19, 2025 with ransomware use recorded as unknown. CISA has now confirmed that ransomware crews are exploiting it as well.
Sources: Bleeping Computer
Critical vulnerabilities
Traefik: seven advisories, and the entrypoint defences only know the HTTP/1.1 header path (worst CVE-2026-88007, CRITICAL)
The HTTP/3 request path never initializes the connection-scoped transport holder that isolates NTLM and Kerberos, so backend connections are reused across requests (CVE-2026-88007). Entrypoint protections such as aliasHeadersStrategy scan req.Header and never req.Trailer, so spoofed trusted headers can arrive in a trailer (CVE-2026-88004). A client-supplied Upgrade: h2c header and its HTTP2-Settings are forwarded verbatim to the backend, giving request smuggling (CVE-2026-88008). An opaque request-target routes and logs as / but is forwarded as written (CVE-2026-88009). Separately, CVE-2026-88877 (CVSS 9.3): the ingress-nginx provider builds an extra sibling router — host-match only, redirect middleware only — for Ingresses carrying both an auth annotation and from-to-www-redirect.
Sources: GHSA-qqjf-53cj-pwvv · GHSA-w4v4-9rw7-5326 · NVD
rclone: nine advisories, two critical, and serve s3checks no signature at all (CVE-2026-88018, CVE-2026-88044)
With --auth-proxy configured but no --auth-key, authPairMiddleware reads the accessKeyID straight out of the client's own Authorization header, bypassing SigV4 verification entirely (CVE-2026-88018). In the second, the FTP and S3 RC adapters accept a per-server proxyOpt, but their constructors decide whether proxy authentication is on by reading the process-global proxy.Opt.AuthProxy (CVE-2026-88044).
Sources: GHSA-xwwr-4h3p-r22c · GHSA-p569-5gjg-9cmj
n8n: two expression sandbox escapes lead to code execution (CVE-2026-86083, CVE-2026-86076)
Both the compiler printing synthetic string literals and the isolate bridge interpolating a timezone value call the global JSON.stringify at generation time, so replacing that global rewrites the generated source (CVE-2026-86083). In the second, the sanitizer resolves through a dynamically-scoped this, and a class field named __sanitize rebinds it and reaches the Function constructor (CVE-2026-86076). Fourteen further advisories in the same batch cover OAuth resource substitution, cross-tenant PII disclosure, and OIDC endpoints that keep issuing sessions after being disabled.
Sources: GHSA-6xcw-7xm6-48c6 · GHSA-hw8v-xxg5-vvvx
Open WebUI: a batch of advisories clustered at identity and server-side fetching (CVE-2026-87995, CVE-2026-87016, CVE-2026-87996)
The terminal port-preview iframe hardcodes both allow-scripts and allow-same-origin while the content is served from the Open WebUI origin, so any user with access to a shared terminal server can run script in that origin (CVE-2026-87995). On SQLite deployments, the lookup mapping an external identity to a local account does substring matching, so a subject containing % or _ resolves to accounts it was never issued for (CVE-2026-87016). The Playwright web loader screens the address and then hands the request to the browser, which resolves the hostname again without a second check — DNS rebinding (CVE-2026-87996). The OAuth token exchange endpoint also skips the email domain allowlist and role policy the login callback enforces (CVE-2026-88005, CVE-2026-88006).
Sources: GHSA-jmc6-2wr8-h3wj · GHSA-wpmr-8h3q-fwj7 · GHSA-4v28-j6q3-5m4r
Apache Camel K: two at CVSS 9.8, both giving a tenant the operator's privileges (CVE-2026-80351, CVE-2026-80352)
Directives in dynamically evaluated Maven configuration are not neutralized, so tenant-controlled repository content can influence code execution inside the operator pod (CVE-2026-80351). YAML injection in custom resource configuration allows arbitrary Kubernetes objects to be created with the operator's privileges (CVE-2026-80352). CVE-2026-80354 (CVSS 8.1) additionally lets a tenant reference secrets by name in the operator namespace. Affects 2.0.0–2.9.3 and 2.10.1–2.10.2.
Apache ActiveMQ Artemis: three flaws reachable before authentication (CVE-2026-57967, CVSS 9.8)
An unauthenticated attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume its execution (CVE-2026-57967). A crafted Openwire RemoveSubscriptionInfo command deletes a queue before the connection reaches authentication and authorization (CVE-2026-67593, CVSS 9.1). A network-adjacent attacker can capture cluster administrative credentials during the initial cluster handshake (CVE-2026-49364, CVSS 9.1). Affects Artemis 2.50.0–2.56.0 and ActiveMQ Artemis 1.0.0–2.44.0; fixed in 2.57.0.
Angular: XSS and SSRF in server-side rendering (CVE-2026-88060, CVE-2026-88056)
@angular/platform-server traverses ancestor tags across <template> boundaries during HTML serialization, so untrusted input rendered inside raw-text tags (<xmp>, <style>, <script>) loses its escaping (CVE-2026-88060). The second is a discrepancy between WHATWG URL parsing and Angular SSR's own URL resolution that bypasses same-origin checks and can leak server-side credentials through SSRF (CVE-2026-88056).
Sources: GHSA-v3p8-whq6-r5jg · GHSA-f6mr-pjwc-34m4
Velociraptor: client monitoring artifacts skip the EXECVE permission check (CVE-2026-19583, CVSS 9.9)
Artifacts that run arbitrary commands on endpoints, such as Linux.Sys.BashShell, require the EXECVE permission to schedule — but no equivalent check was implemented on the client monitoring path, and nothing required monitoring artifacts to carry the CLIENT_EVENTS type. On a DFIR agent deployed across an estate, that is a bypass of its own privilege tiering.
Sources: NVD
miniOrange 2FA for WordPress: any visitor can delete site options (CVE-2026-77770, CVSS 10)
Deleting options requires no validated transaction, and the option names come straight from unauthenticated request input. The result is locking every administrator out of the dashboard, or deactivating the plugin itself — a two-factor plugin that hands over the means to remove two-factor. Affects versions before 6.3.1 and before 19.3.
Sources: NVD
libXfont2: a malicious font server can write past the end of client memory (CVE-2026-44950, CVSS 9.5; CVE-2026-59679, CVSS 9.2)
fs_read_glyphs() indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, while the array was sized from num_extents in the separate FS_QueryXExtents16 reply; the two CARD32 fields are never cross-checked (CVE-2026-59679). In the other, copying each glyph's bitmap validates only that the source slice lies within the source buffer, never that the running destination cursor has passed the allocation (CVE-2026-44950).
Check Point: two VPN certificate flaws, both rated 9.8, allowing unauthenticated remote code execution
One affects Check Point's Security Gateways firewall appliances; the other affects those gateways and Security Management. The vendor says exploitation requires "specific conditions" which it has not described.
Sources: The Hacker News
Vendor advisories
CISA industrial and medical advisories: Mirth Connect, AVEVA, Orthanc
NextGen Healthcare Mirth Connect ≤4.7.1 carries SQL injection and XXE (CVE-2026-82583, CVE-2026-78224, CVE-2026-82578, worst 8.3). AVEVA Pipeline Integrity Monitor ships a hard-coded cryptographic key and a broken algorithm (worst 8.4). Orthanc DICOM Server before 1.13.0 writes past a heap allocation when decoding an attacker-supplied PNG or JPEG, crashing the process (CVE-2026-87020, 8.1).
September Windows Server updates break Remote Desktop Services
Administrators report that after the September security updates, users cannot connect to Windows Server 2019, 2022 and 2025 hosts, and in some cases a hard reset is needed to restore service. The same round of Office updates (KB5002914) is breaking copy-and-paste and formula dragging in Excel.
Sources: Bleeping Computer · Bleeping Computer
AI security
Gemini CLI: a .env file in an untrusted repository overrides GEMINI_CLI_HOME and executes code (CVE-2026-13745, CVSS 9.2)
Gemini CLI and its companion GitHub Action are both affected; an unprivileged attacker achieves arbitrary code execution by overriding GEMINI_CLI_HOME through an untrusted local .env file.
Sources: NVD
OmniRoute: registering a custom agent runs a command (CVE-2026-88062, CRITICAL)
POST /api/acp/agents accepts user-controlled binary and versionCommand values. The same request then calls refreshAgentCache(), and the resulting version probe passes both to execFileSync.
Sources: GHSA-hf57-cqmx-p4gr
mistral.rs: unauthenticated SSRF and arbitrary local file read
/v1/chat/completions fetches any request-supplied image or audio URL with no host or IP validation, and opens arbitrary local files (a file:// URL, or any relative or absolute path), so an unauthenticated client can make the server reach internal or cloud-metadata addresses. A second advisory covers the same endpoint fetching remote media with no byte limit and extracting every frame of a video when num_frames is None.
Sources: GHSA-wfgq-w7cq-qj7j · GHSA-m3wp-48jr-vr4g
Nearly one in ten exposed LiteLLM gateways still accept the example admin key sk-1234
Of the internet-facing LiteLLM servers Wiz Research scanned in February, close to a tenth accepted sk-1234 — the example admin key printed in LiteLLM's own setup guide. Whoever holds it can read every record passing through the gateway.
Sources: The Hacker News
PuzzleMask: plain English prose as a wrapper that defeats lightweight LLM policy checks
Check Point Research describes a prompt-crafting technique that uses no emoji, base64 or invisible formatting — the policy-violating payload is simply embedded in a specially built prose wrapper, which a limited-capability policy model does not see through.
Sources: Check Point Research
Other
IDScan confirms its cloud platform was breached, in a case tied to 153 million driver's licence scans
Identity verification company IDScan has confirmed that attackers accessed customer data stored in its cloud platform. Reports days earlier had linked the company to a database holding more than 153 million driver's licence scans.
Sources: Bleeping Computer
Surfshark: an internal test server exposed to the internet by a configuration error was breached
Surfshark disclosed that attackers reached one of its internal test servers after a configuration error left it internet-facing; proxy servers were also involved.
Sources: Bleeping Computer
Google Play's Early Access programme is being used to distribute deceptive apps
Early Access exists for apps not yet released on the store, so developers can gather feedback. It is being abused to push apps claiming to offer money, rewards, casino winnings and premium content.
Sources: The Hacker News