Rosetta Daily · Sep 12, 2026
Three of the four vulnerabilities CISA catalogued on September 11 sit inside the software build pipeline: GitLab's repository commits API, and two in JFrog Artifactory, the registry build servers pull from. The fourth, ConnectWise ScreenConnect, is how an operator reaches those machines afterwards.
Actively exploited (KEV)
GitLab Community and Enterprise Edition: unauthenticated arbitrary file read through the repository commits API (CVE-2026-85706, CVSS 10)
Improper path confinement and missing authentication enforcement in the commits API let an unauthenticated caller read any file the GitLab process can reach. Probing appeared in the wild within hours of the public advisory, and CISA catalogued it the same day.
Sources: The Hacker News · Bleeping Computer · CISA
JFrog Artifactory: two authorization flaws chained to administrator control and a Rust backdoor (CVE-2026-42016, CVE-2026-42018)
CVE-2026-42016 checks a token's signature and issuer but not its scope; CVE-2026-42018 hands an internal anonymous-user token to an unauthenticated caller even where anonymous access is turned off. Wiz observed the pair used together against self-hosted servers between August 15 and September 8, ending in a Rust backdoor. JFrog had shipped both fixes before that window opened, so what was reachable was entirely unpatched instances.
Sources: The Hacker News · Bleeping Computer · CISA
[Added detail] ConnectWise ScreenConnect: file transfer and execution inside a live session, with no host confirmation (CVE-2026-84869)
Improper privilege management together with a missing authorization check lets an attacker push and run files through an active remote session without the host approving it. CISA catalogued it on September 11.
Sources: CISA
[Added detail] Cisco Secure Firewall Management Center: Qilin ransomware named among the three clusters (CVE-2026-20079, CVSS 10)
Cisco puts credential theft first in the sequence and names Qilin ransomware as one endpoint of it. The three clusters working the authentication bypass are tied to ransomware and to state-sponsored activity.
Sources: The Hacker News
Critical vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0: more than a dozen advisories, and almost every one crosses a tenant boundary (CVE-2026-82107, CVSS 9.6; CVE-2026-80424, CVSS 9.1)
The batch includes improper authentication that yields another tenant's information (CVE-2026-82107), archive extraction that path-traverses to create files anywhere (CVE-2026-80424), OS command execution from an authenticated account (CVE-2026-82099, CVE-2026-82098, CVE-2026-82095, CVE-2026-81550, all 8.8), ruleset files overwritten across tenants (CVE-2026-81540, 8.5), and an SSRF whose outbound fetch originates from a shared-infrastructure pod — scheme, host, port and path all caller-controlled, with reach to co-tenant services and link-local addresses, and the response body reflected verbatim (CVE-2026-81207, 8.5).
Forgejo: a crafted template repository executes code on the server (CVE-2026-89094, CVSS 9.9)
Template expansion over files in .forgejo/template is mishandled, so creating a project from a malicious template repository yields remote code execution. Fixed in 16.0.4.
Sources: NVD
Central Dogma: a hard-coded ZooKeeper replication secret, and a Git mirror that verifies no host key (CVE-2026-11746, CRITICAL; CVE-2026-11745, HIGH)
When an operator omits replication.secret, ZooKeeperReplicationConfig.secret() silently substitutes the constant ch4n63m3 and wires it into both the client-facing SASL context and the quorum and learner contexts — cluster takeover with a guessable string, and no error along the way. Separately, the Git mirror's SSH client installs a ServerKeyVerifier that returns true for every outbound connection and disables the known_hosts fallback, and the Active Directory realm interpolates the login name into an LDAP filter without escaping (CVE-2026-11748).
Prowler: a tenant with its own SAML provider can claim another tenant's email domain (CVE-2026-59151, CRITICAL)
The SAML flow trusted the email domain asserted in the response when deciding which tenant should receive the final token. A malicious tenant running its own identity provider could therefore complete a valid assertion and take over accounts in another.
Sources: GHSA
Federated OIDC logins can reach the uaa.admin scope past the allow-list (CVE-2026-47839, CVSS 9.2)
Where an OIDC identity provider uses groupMappingMode: AS_SCOPES and externalGroupsWhitelist holds a wildcard entry, the restriction operators believe they configured does not hold, and users authenticating through that provider obtain the administrative scope.
Sources: NVD
Four WordPress plugins, three of which issue a session without checking a password (CVE-2026-14560, CVSS 10; CVE-2026-14559 and CVE-2026-14563, CVSS 9.8)
teddy-bear-customize-addon (through 1.0.5) trusts a client-supplied content type and keeps the original filename, so an unauthenticated attacker uploads PHP and runs it (CVE-2026-14560); the same plugin issues a session for any registered email address with no password check (CVE-2026-14559), as does advanced-customized-prompts through 1.0.1 (CVE-2026-14563). MIPL Grouped Checkout Fields for WooCommerce through 1.2.1 has no file-type validation on its upload handler (CVE-2026-8778, CVSS 9.8).
Suricata: a mid-stream protocol change on HTTP/2 causes type confusion in the IDS itself (CVE-2026-45764, CVSS 9.1)
Crafted traffic can crash Suricata before 7.0.16 and 8.0.5, taking the monitoring down with it. Disabling HTTP/2 parsing is the stated workaround.
Sources: NVD
yayson: a JSON:API document with type: "__proto__"writes onto Object.prototype (CVE-2026-61534, CRITICAL)
Store and LegacyStore key their internal lookup tables by the type, id and relationship names taken from the document, and those tables were plain objects — so deserializing one document pollutes every object in the process.
Sources: GHSA
Mockoon: the admin API is unauthenticated, on by default, and served with wildcard CORS (CVE-2026-59148, HIGH)
commons-server mounts the admin API on the same Express listener as the user-defined mock routes in every shipped runtime, which allows mock-state hijack and secret theft. A second flaw lets a templated filePath escape the served directory, because the base-directory check is a prefix test with no path-separator boundary (CVE-2026-59149).
Net-SNMP: one unauthenticated connection that sends nothing suspends all SNMP processing (CVE-2026-89147, CVSS 8.7)
smux_accept() performs a blocking read with no timeout on newly accepted connections, so a client that connects to the SMUX listener and then stays silent blocks the single-threaded snmpd main loop indefinitely. Affects through 5.9.5.2.
Sources: NVD
Vendor advisories
PaperCut NG/MF: maintenance releases replace every emergency patch issued for the two exploited flaws
Versions 26.0.5, 25.0.13 and 24.1.10 are regular maintenance releases and supersede the out-of-band patches shipped during the exploitation campaign.
Sources: The Hacker News
Microsoft: this month's updates break Office in two places
Teams and Outlook failed to launch on ARM-based Windows devices after any update released since the August Patch Tuesday; that is now fixed. Separately, the KB5002914 Office security update breaks copy-and-paste and formula dragging in Excel for some users, with rollback restoring normal behaviour.
Sources: Bleeping Computer · Bleeping Computer
AI security
IBM Langflow OSS 1.0.0–1.11.5: a batch of advisories, and most of them are its own security scanner being walked around (CVE-2026-79724, CVE-2026-81204, CVE-2026-85025, all CVSS 9.8)
Two paths give unauthenticated code execution — OS command injection (CVE-2026-79724) and code injection during graph construction (CVE-2026-81204) — and a third reaches it through publicly shared MCP project endpoints, where public-flow restrictions and session isolation are not enforced (CVE-2026-85025). The rest are the guardrails failing one at a time: an annotated class-body assignment that resolves to a dangerous callable through alias tracking the blocklist never checks (CVE-2026-76059), an incomplete denylist in the scanner (CVE-2026-78569), an incomplete environment-variable blocklist (CVE-2026-79742), and an MCP Tools component configured for a local stdio subprocess transport, which bypasses both LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS (CVE-2026-81941).
IBM ContextForge MCP Gateway 1.0.0–1.0.7: default credentials grant administrative access (CVE-2026-78573, CVSS 9.8)
A remote attacker reaches administrative access using the shipped default credentials.
Sources: NVD
MySQL MCP Server: the SSE transport is built without security settings, so any web page can drive it (CVE-2026-59971, CRITICAL)
mysql_mcp_server constructs SseServerTransport without passing security_settings, which disables the MCP Python SDK's DNS-rebinding protection (Origin and Host validation); the Starlette application has neither CORS nor TrustedHost middleware, and the service binds broadly. The result is unauthenticated SQL execution, by DNS rebinding or by direct exposure.
Sources: GHSA
FrontMCP and mcp-from-openapi: the hostname denylist added for the last SSRF is not the boundary (CVE-2026-59973, HIGH)
The published fix for CVE-2026-39885 added a hostname denylist for OpenAPI external $ref dereferencing. The patched dependency mcp-from-openapi 2.3.0 still issues backend-origin requests to loopback when the target is reached through hostname resolution or a redirect.
Sources: GHSA
Google Cloud Gemini Enterprise Agent Platform App Builder: SSRF leaks the Compute Engine default service account token (CVE-2026-19486, CVSS 8.7)
Unauthenticated, in versions before 2026-06-01. The platform was patched on June 1, but apps deployed before that have to be redeployed to pick the fix up — the patch date is not the fleet date here.
Sources: NVD
Anthropic reports Claude used to automate exploitation and data theft, and names seven China-based labs distilling it
Anthropic's account covers December 2025 through August 2026 and groups the activity under what it calls Generative Threat Groups, spanning state-sponsored actors, financially motivated criminals and commercial vendors. One operation extracted secrets from 1.8 million Android applications. Separately, Anthropic says it disrupted industrial-scale distillation attacks from seven China-based labs, naming Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax.
Sources: The Hacker News · The Hacker News · Bleeping Computer
Other
[Added detail] Florida's DAVID driver database: the way in was a police department employee's credentials
The Department of Highway Safety and Motor Vehicles has confirmed the breach and says the attackers used credentials belonging to a police department employee.
Sources: Bleeping Computer
[Added detail] Trezor: 347,000 addresses targeted, 2,500 users clicked
The phishing that followed the Brevo breach reached 347,000 email addresses; Trezor says 2,500 users clicked the embedded link.
Sources: Bleeping Computer