Rosetta Daily · Sep 22, 2026
Most of today's high-scoring entries are not memory corruption. jshERP ships five separate privilege bypasses at once, a MISP read-only API key gets the account's full permissions restored by one function, Airflow's logout revokes a cookie but not a bearer token, and CRI-O restores a checkpointed container with the credentials and capabilities the checkpoint carried. None of these is an authentication failure — authentication worked. What was missing, or in the wrong place, is the check on what that identity may do.
Actively exploited (KEV)
Zyxel GS1900 series switches: stack-based buffer overflow in the CGI program (CVE-2026-7273, CVSS 8.8)
CISA added this to the KEV catalogue on September 21, citing evidence of active exploitation. A LAN-based, unauthenticated attacker can execute operating system commands through a crafted HTTP request; a patch exists. The same report pairs it with a Veeam flaw also described as under active exploitation.
Sources: CISA · The Hacker News
Critical vulnerabilities
Ajenti before 2.2.16: any authenticated user can make the root task worker run pip (CVE-2026-79920, CVSS 9.9)
/api/core/tasks/start does not check plugin-management authorization, so any authenticated user can enqueue InstallPlugin, UnInstallPlugin or UpgradeAll. The plugin name and version fields go unvalidated into a pip package specification, and the task worker invokes pip while running as root. A low-privileged user can therefore choose or manipulate a package installed with root privileges, ending in root code execution and full host compromise.
Sources: NVD
Apache MINA: the fix announced as "fully addressed" landed on one branch only (CVE-2026-94301, CVSS 9.8)
The fix for CVE-2026-47065 — a resolveProxyClass() override closing an acceptMatchers allow-list bypass via java.lang.reflect.Proxy — was released on 2026-06-02 and announced as fully addressed in 2.2.8, 2.1.13 and 2.0.29. It was committed to the 2.2.X branch only. The 2.0.29 and 2.1.13 artifacts listed as fixed, and every later release on those lines up to 2.0.30 and 2.1.14, remain open to the original bypass.
Sources: NVD
Mailu: a client-controlled X-Forwarded-By header is trusted as proxy identity (CVE-2026-85751, CVSS 9.8)
Deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset are affected. The proxy_hide_header directive in the nginx template hid the header from upstream responses but never overwrote the incoming request value. An unauthenticated remote attacker can spoof the trusted proxy identity and bypass authentication. Affects Mailu 2.0 through 2024.06.55, and helm-charts before 2.7.3.
Sources: NVD
Warpgate before 0.25.5: an SSO return parameter is written unescaped into the authenticated origin (CVE-2026-58491, CVSS 9.3)
/@warpgate/api/sso/providers/:name/start stores an attacker-controlled next parameter that POST /@warpgate/api/sso/return inserts without HTML escaping. A victim who follows a crafted link and completes SSO executes markup and JavaScript inside the authenticated Warpgate origin — and Warpgate is an SSH, HTTPS and MySQL bastion, so that origin holds the sessions into the network behind it. Administrator APIs are reachable when the victim is an administrator.
Sources: NVD
Fluent Bit 0.11.0 through 5.0.8: a handshake PONG message overwrites the stack (CVE-2026-61674, CVSS 9.2)
secure_forward_pong memcpys the server-controlled PONG[2] reason into a 32-byte stack buffer without checking its MessagePack type or its length. An attacker who controls or can impersonate an out_forward Secure Forward destination sends an oversized reason during the first handshake and overwrites stack control data. Builds with a stack canary terminate reliably; builds without one can yield remote code execution as the Fluent Bit process.
Sources: NVD
Apache Airflow: logout revokes the cookie, not the bearer token (CVE-2026-86473, CVSS 9.1)
The Core API logout endpoint only revokes a session token presented as the _token cookie. A client that logs out presenting its credential as an Authorization bearer header gets the normal logout response and nothing is revoked — the token stays valid until it expires, with a default lifetime of 24 hours. An attacker already holding a copy of that token keeps the victim's access after the victim has logged out and believes the session ended.
Sources: NVD
jshERP through 3.6: five separate authorization bypasses (CVE-2026-94411, CVE-2026-94412, CVE-2026-94496, CVE-2026-94497, CVE-2026-94501, all CVSS 8.7)
updateOneValueByKeyIdAndType lets an authenticated user grant themselves arbitrary roles, escalating from low-privilege tenant user to tenant administrator. POST /user/resetPwd resets any other user's password — administrators included — to a known default. /role/update and /role/delete do not check caller permissions, so a role's data scope can be widened to all data. The by-id info, update and delete endpoints do not validate object ownership. The userBusiness CRUD endpoints let anyone rewrite user-role mappings. Five different entry points: patching one does nothing for the other four.
MISP: a read-only API key can regain the account's full permissions (CVE-2026-94381, CVSS 8.7)
After logging in with a read-only key, one specific function can accidentally restore the user's normal account permissions. A read-only key holder can therefore gain write, delete or administrator access if the underlying account has it. Exploitation needs a valid read-only key and a single request to that function. Disclosed the same day: CVE-2026-94383 (CVSS 8.6), where the blocklist workflow module accepts a user-supplied filename without validating its extension, letting a site administrator place a file with an arbitrary extension into the MISP export directory — code execution if the web server interprets scripts there.
Temporal: the Worker Service runs a command of the caller's choosing on its own host (CVE-2026-89139, CVSS 8.7)
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess that launches a worker by running a command on the machine hosting the service. The program name and argument vector come from the compute provider configuration in the caller's request, not from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore execute a command of their choosing under the account the server process runs as.
Sources: NVD
Four Temporal Go libraries: a parser that panics is a process that dies (CVE-2026-65651, CVE-2026-65652, CVE-2026-65653, CVE-2026-16651, all CVSS 8.7)
tchannel-go does not validate the one-byte checksum-type field in inbound call frames and uses the value to index a four-entry pool, panicking the connection read goroutine and terminating the host process; the same library unconditionally takes the first element of an empty chunk slice when a call fragment carries checksum metadata but no length-prefixed argument chunks. ringpop-go does not apply its configured LabelOptions limits to label maps received in SWIM membership changes, so a peer can repeatedly submit oversized labels and exceed memory and gossip-bandwidth bounds. sqlparser enforces no nesting limit on deeply nested unary expressions, and formatting or walking the resulting tree hits a runtime-fatal Go stack overflow that panic recovery cannot contain. Temporal Server passes caller-controlled query input through that parser on archival, visibility and worker-query paths.
ntopng before 6.7.260717/260718: non-admins can run commands and download configuration backups (CVE-2026-82412, CVE-2026-84990, both CVSS 8.8)
The vulnerability-scan endpoints accept a scan_ports parameter with no administrator gate and pass it through validateSingleWord, which permits shell metacharacters; the value is then concatenated into an nmap command and executed through ntop.execCmd or popen. Separately, the configuration-backup list and download endpoints also lack an administrator check, and the backup includes the ntopng.user.* Redis key space — password hashes for local users and, where configured, API tokens, TOTP secrets and WebAuthn credential data.
KubeEdge: two job resources concatenate user input into keadm shell commands (CVE-2026-62182, CVE-2026-62371, both CVSS 8.8)
ConfigUpdateJob processing concatenates updateFields values into keadm config-update and runs it through a system shell; the v1alpha2 NodeUpgradeJob handler does the same with spec.version and spec.image into keadm upgrade edge. A user permitted to create or modify either resource puts shell metacharacters in those fields and executes arbitrary commands on the targeted edge nodes. Fixed in 1.21.2, 1.22.2 and 1.23.1.
CRI-O: a restored container keeps the checkpoint's privileges, not the destination's (CVE-2026-92574, CVSS 8.8)
A user who can create a pod from a malicious checkpointed container bypasses the destination Kubernetes security context. The restored process retains credentials, Linux capabilities, no_new_privs and seccomp state from the checkpoint instead of enforcing the destination configuration. Affects upstream CRI-O 1.34 and later, and downstream Red Hat products from OCP 4.17 onward; fixes are on supported branches but not yet released.
Sources: NVD
Conda before 26.5.2: an entry-point command from package metadata can write outside the target directory (CVE-2026-53940, CVSS 8.8)
parse_entry_point_def accepted an unvalidated entry-point command from a noarch:python package's info/link.json. CreatePythonEntryPointAction interpolated it into target_short_path, and PrefixPathAction.target_full_path joined it to the installation prefix without verifying the result stayed under the intended bin or Scripts directory. A malicious package can therefore write an executable wrapper to an arbitrary path.
Sources: NVD
deepstream 10.1.0: one action missing from the rules map defaults to allow (CVE-2026-63116, CVSS 8.8)
rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When permission.type is config, getRulesForMessage returns a null rule specification for that action and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can modify arbitrary protected records. Fixed in 10.1.1.
Sources: NVD
libXrender before 0.9.13: a malicious X server can inject code into its clients (CVE-2026-88807, CVSS 8.9)
A heap overflow in RenderQueryPictFormats, running in the direction people rarely defend: the target is the attached X client and the attacker sits on the X server side.
Sources: NVD
Feast before 0.65.0: approval labels survive a new push from a fork (CVE-2026-55563, CVSS 8.9)
pr_integration_tests.yml uses pull_request_target with the synchronize event and preserves ok-to-test, approved and lgtm labels across newly pushed commits. A fork contributor can get approval for a benign revision and then have changed code run from refs/pull/<n>/merge through privileged make targets. That job exposes GCP, AWS and Snowflake credentials to the code it runs.
Sources: NVD
nginx ignition: an unauthenticated request creates an admin account (CVE-2026-61628, HIGH)
POST /api/users/onboarding/finish is registered as anonymous and creates a user with full ReadWrite admin permissions. The check-then-act pattern between "onboarding already completed?" and the user-creation write has no atomic guard, so a remote unauthenticated attacker who reaches an instance in its pre-onboarding state can create an administrator account, and concurrent requests can create several. Disclosed alongside CVE-2026-61629: the i18n middleware passes the raw Accept-Language header to ParseAcceptLanguage, and the CVE-2022-32149 guard in golang.org/x/text caps - characters but not _, allowing roughly 75x CPU amplification.
Sources: GitHub Advisory · GitHub Advisory
Tuleap Enterprise Edition 17.3 through 17.5: OS command injection (CVE-2026-84285, CVSS 8.8)
An attacker can execute arbitrary commands on the server.
Sources: NVD
UVdesk core-framework before 1.1.7: an agent can promote itself to administrator (CVE-2025-71421, CVSS 8.6)
Improper privilege management in the editAgent endpoint. An agent holding the agent-management privilege submits their own account identifier with the role parameter set to ROLE_ADMIN and gains full administrative control over agents, tickets and mail configuration.
Sources: NVD
Web security research
WordPress Comment2Shell: XSS in an anonymous comment becomes server-side RCE through an admin session (CVE-2026-93485)
An anonymous visitor could leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed it on September 17 in version 7.1.1 and told site owners to update right away.
Sources: The Hacker News
Project Zero: dangling COM object registrations, and an incomplete fix (CVE-2026-66804)
This privilege escalation is the incomplete fix for CVE-2026-50343, the bug Calif dubbed "Dark Elevator"; the author reported it together with 14 others. The root cause is a dangling COM registration for the CrossDevice COM object, CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration normally needs two parts — a server executable, a DLL for in-process components, and a CLSID entry under HKEY_CLASSES_ROOT pointing at it — and here the pointer outlives the target.
Sources: Project Zero
Trail of Bits: SAML should be deprecated
The post traces SAML from its design-by-committee origin to where it now sits, and the argument lands somewhere specific: SAML works if you assume XML signature validation is reliable, and XML signature validation is complicated enough that most fielded implementations wrap libxmlsec, a C codebase almost nobody reads. The recommendation is to move to OpenID Connect.
Sources: Trail of Bits
AI security
Meta Muse: change one hidden setting and the voice assistant becomes a backdoor
Security researcher Patrick Wardle published a proof-of-concept on September 21 showing that malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app. It changes a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. It presumes code already on the machine, so this is a privilege and persistence path rather than a remote entry point.
Sources: The Hacker News
Incidents
BigCommerce: stolen third-party Ribon app credentials used to inject scripts into merchant stores
The ecommerce platform has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores.
Sources: Bleeping Computer
Regulation and vendor notices
Google fined €403 million by Ireland's DPC over location data
Ireland's Data Protection Commission, Google's lead EU regulator, found that three of the company's features handled users' location data in breach of the GDPR between May 2018 and February 2020, fined the company €403 million ($463M) and ordered it to bring the processing into compliance within six months. The DPC has not said publicly which three features are involved.
Sources: The Hacker News · Bleeping Computer
Microsoft: two September update side effects, and two retirement dates
The Excel copy-and-paste failure is fixed for all Office users; the File History backup feature may still stop working on some systems that installed the September 2026 security updates. Separately, the Calendar, People and Files Microsoft 365 companion apps retire on December 16, with admins asked to remove them from managed devices, and SMS first-factor sign-in for Entra ID retires starting February 2027, so admins are being told to move users to phishing-resistant methods such as passkeys.
Sources: Bleeping Computer · Bleeping Computer