Rosetta Daily · Sep 21, 2026
Two vendors account for eleven of today's high-severity entries: seven command-injection and overflow flaws in one Netcore NBR200V2 router, and four BioStar desktop utilities each shipping a driver that writes to arbitrary physical memory. All eleven come with public exploit code, and all eleven advisories close with the same sentence — the vendor was contacted before disclosure and did not respond in any way.
Critical vulnerabilities
REDCap: unauthenticated remote code execution from a public survey context (CVE-2026-90817, CVSS 9.8)
A crafted HTTP request escapes the survey passthrough route into a controller that was never meant to be reachable from outside, and a crafted file-path or stream parameter during import handling then executes arbitrary code on the server. No account is needed anywhere along that path. REDCap is a clinical research data capture system used widely in academic and medical institutions, which is to say it is usually deployed next to subject data.
Sources: NVD
OrdaSoft Joomla Gallery: four advisories, one of which calls a request field as a PHP function (CVE-2026-88856, CVE-2026-88857, both CVSS 9.4; CVE-2026-88854, CVSS 9.3; CVE-2026-88855, CVSS 8.6)
updateOSGallery() reads a JSON request body, calls the value of a method field as a live PHP function, and passes the value of a package field as its single argument — no allow-list, no is_callable() check. Any single-argument function name is directly reachable. saveWatermark() copies an uploaded file into a web-accessible directory under the client-supplied filename exactly as sent, with no extension check, no content check and no sanitisation. The unauthenticated one is in the search endpoint: the parameter is read with getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but leaves quotes and SQL syntax alone, and the value is concatenated straight into a LIKE clause. Affects the extension on Joomla before 6.2.7.
Suricata before 8.0.7: use-after-free on the HTTP/2 inspection path, and a DoH2 type confusion (CVE-2026-94084, CVE-2026-94083, both CVSS 9.4)
The first fires when one transaction is inspected by rules that use http.response_header both with and without a transform, hitting a use-after-free in Http2ThreadMultiBuf. The second is an invalid free: on a DoH2 request carrying an HTTP/1-to-HTTP/2 upgrade, the HTTP2 state cleanup runs even though the actual state is HTTP1. It requires app-layer.protocols.doh2, which is on by default in 8.x. The attack surface is the IDS's own parser — anything that can reach it with traffic can reach both paths.
NivoCart through 2.4.0: password reset tokens are predictable, and the file manager takes PHP (CVE-2026-94107, CVSS 9.2; CVE-2026-94104, CVSS 8.7)
forgotten.php generates recovery codes with substr(md5(mt_rand()), 0, 10), with neither rate limiting nor expiry — knowing an administrator's email address is enough to request a reset and predict the token. The file manager's multi() endpoint skips extension validation for new filenames and whenever the chunks parameter is 2 or higher, so an account with view-only back-office access can upload PHP into the web-accessible image/data/ directory and request it.
openEQUELLA before 2026.1.0: FreeMarker template compilation is unsandboxed (CVE-2026-94109, CVSS 8.7)
With TemplateClassResolver left unrestricted, an authenticated attacker can inject template expressions through collection summaries, dashboard portlets or MIME templates, instantiate classes such as freemarker.template.utility.Execute and call Runtime.exec. openEQUELLA is a digital collection platform common in higher education, where "authenticated" tends to mean every student and member of staff.
Sources: NVD
getID3: filenames reach the shell, and XML metadata pulls in external entities (CVE-2026-94106, CVSS 8.7; CVE-2026-94108, CVSS 8.3)
Before 1.9.26, shell-out handlers fail to escape filenames in command strings, so a filename carrying shell metacharacters injects commands that run with the privileges of whatever process embeds getID3. Separately, the XML2array helper does not properly disable entity loading on PHP before 8.0, so XML metadata inside a media file can disclose local files, drive SSRF, or expand entities until the process dies. getID3 is what a great many CMSes and media sites use to read audio and video tags — typically on files a user just uploaded.
Expat through 2.8.4: no check for a low surrogate after a high one in UTF-16 (CVE-2026-93990, CVSS 8.7)
Malformed UTF-16 sequences are accepted, and a lone high surrogate consumes the code units that follow it, hiding markup characters from the parser and enabling XML injection. Expat is one of the most widely statically linked XML parsers in C, so the exposed surface is a question of who compiled it in.
Sources: NVD
Argo Workflows 4.1.0 through 4.1.3: a negated field selector skips the cluster-scoped access review (CVE-2026-93991, CVSS 8.3)
ListArchivedWorkflows fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. An attacker holding list permission in a single namespace can use a negated namespace selector to retrieve archived workflows from every other namespace, along with their spec arguments, parameter values and annotations — and putting credentials in workflow parameters is common practice.
Sources: NVD
SmartLife: the app's own auth parameters can be lifted and used to reset any account (CVE-2026-86553, CVSS 8.8)
The SmartLife app generates fresh application authentication parameters inside its runtime process. With those in hand, an attacker calls the backend /account/verify.serv directly to turn a registered email address into the real account ID, then spoofs the application authentication information together with that ID to reset the target's password. SmartLife is the companion app for a large number of white-label smart home devices.
Sources: NVD
WordPress plugins
SAML Single Sign On before 6.0.0: identities are matched by login name no matter what the site configured (CVE-2026-82842, CVSS 8.1)
The plugin ignores the configured criterion for linking an incoming single sign-on identity to a WordPress account and always resolves by login name. An attacker who can get the site's identity provider to assert a login name of their choosing authenticates as that account — administrators included — without ever proving they own it.
Sources: NVD
Forminator Forms before 1.57.2.1: a value from an XML-RPC request is deserialised without class restrictions (CVE-2026-87067, CVSS 8.5)
The plugin does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, letting a user with its forms-management permission write a file of their choosing and execute code. That permission belongs to an administrator by default, but a site can grant it to other roles through the plugin's own settings, so the real bar can sit well below administrator.
Sources: NVD
Network devices
Netcore NBR200V2 1.3.241127.071246: seven entries, diagnostics and configuration straight through to a shell (CVE-2026-94097, CVSS 9.3; CVE-2026-94095, CVE-2026-94096, CVE-2026-94099, CVE-2026-94100, CVE-2026-94101, all CVSS 8.6; CVE-2026-94098, CVSS 8.5)
Four command injections: param/key/val and url (traceroute) and ipv4 (LAN IP configuration) in network_tools, QUERY_STRING in restore.cgi, and QUERY_STRING at the upgrade endpoint. Two buffer overflows, both in VLAN handling inside /usr/bin/routerd — wan_num in vlan_load_form_uci and vlan_wanX.ports in wan_config_set_vlan. All remotely reachable, all with public exploit code, and all seven advisories note the vendor was contacted early and never responded.
D-Link DIR-868L and R95: a stack overflow in the authentication handler, and an NTP server name passed to system() (CVE-2026-94089, CVSS 9.3; CVE-2026-93958, CVSS 8.5)
On DIR-868L 2.01b05, /webfa_authentication.cgi calls strcpy on id/password, giving a stack-based buffer overflow in the authentication handler — that is, before login. On R95 BE9500_1.00.16, /bin/ssi hands the DHMAPI NTPServer argument to system. Both are remotely executable and both have public exploit code.
Comfast CF-N1-S 2.6.0.1: stack overflow in the web management interface (CVE-2026-94003, CVSS 9.3)
get_css_path_from_uri in /cgi-bin/mbox-config contains a stack-based buffer overflow, remotely reachable, with the exploit already public.
Sources: NVD
Drivers and local privilege escalation
Four BioStar desktop utilities: each ships a signed driver that writes to arbitrary physical memory (CVE-2026-94146, CVE-2026-94128, CVE-2026-94129, CVE-2026-94142, all CVSS 8.5)
BSMEM64_W10.sys in BIOS Update Utility, BS_LED64.sys in VIVID LED DJ, BS_RVSIO64.sys in VALKYRIE AURORA, BS_HWMIO64_W10.sys in Temperature Monitor Utility — four IOCTL handlers that take PhysicalAddress/Size or AssociatedIrp and yield a write-what-where condition. Local access is required and every exploit is public. Motherboard-vendor companion drivers are standard material for bring-your-own-vulnerable-driver attacks, not least because uninstalling the utility frequently leaves the driver behind.
AI security
Mistral Vibe before 2.25.5: git hooks run before trust validation (CVE-2026-93993, CVSS 8.6)
Worktree creation executes git hooks first and validates trust afterwards. A repository carrying a crafted post-checkout hook therefore runs arbitrary shell commands as the user running Vibe. Coding tools treat "open a repository" as a read-only act; git's hook mechanism makes opening it an execution.
Sources: NVD
Researchers escaped the OpenAI Codex sandbox two ways, one of them from its most locked-down mode
Both paths run commands on a developer's own machine, and one of them starts from the strictest isolation setting Codex offers. OpenAI has patched both.
Sources: Bleeping Computer
Tencent BrowserSkill through 0.3.0: the local daemon accepts anything shaped like an extension (CVE-2026-94111, CVSS 6.9)
WebSocket origin validation only requires the chrome-extension scheme and 32 characters in the range a–p; it never establishes which extension. An attacker registers a malicious extension, joins as a browser client, and intercepts or manipulates the page content, DOM and screenshots returned to the AI agent. The agent's picture of the world becomes the attacker's to choose, and nothing in that picture says so.
Sources: NVD
vLLM through 0.29.0: one request's out-of-bounds token index changes another request's answer (CVE-2026-93989, CVSS 2.3)
SamplingParams.update_from_tokenizer() does not validate bad_words token indices against the model's generation output width, so out-of-bounds indices corrupt the logits memory of concurrent requests and a different in-flight HTTP request comes back with incorrect tokens. The score is low, but cross-request influence is rare in inference serving: what the affected party sees is a well-formed answer whose content was altered.
Sources: NVD
A batch of MCP tools entered the CVE catalogue on the same day, all path traversal, command injection and SSRF
nexus_reauth in nexus-mcp passes a url to child_process.exec; analyze_csv_data in mcp-file-analyzer takes a filename into a path traversal; get_file_snippet in ACE-MCP and create_file in lovepreetSingh MCP do the same; the template import endpoint in MCPHub through 1.0.32 mishandles privilege; and the pdf path in pdf-tools-mcp yields SSRF (CVE-2026-94031, CVE-2026-94037, CVE-2026-94046, CVE-2026-94044, CVE-2026-94047, CVE-2026-94051, CVSS 2.1 to 5.5). Every score is low, and most of these projects carry no versioning at all — affected ranges are identified by commit hash. What is worth recording is the shape rather than any single entry: the file and command tools we hand to models are entering dependency trees in bulk, at the engineering standard of a personal repository.
Supply chain
Malicious npm packages moved the logic into runtime, past defenses that only read install scripts
An npm campaign around the indexed-btree package hides its malicious code in the package's normal runtime behaviour instead of in installation scripts. Supply chain defenses generally take preinstall/postinstall as their checkpoint; samples built this way do nothing at install time and wait to be required.
Sources: Bleeping Computer