CVE-2026-81546 (published ~17 September 2026 per Tenable/NVD indexing) covers a stack-based buffer overflow in the Affinity by Canva application before the 3.3.0 September 2026 release: inadequate bounds checking when parsing Affinity document files. A crafted Affinity document opened by a user can lead to arbitrary code execution. Tenable lists CVSS 3.1 base score 7.7 (High). Australia relevance: Affinity is Canva’s creative suite (Canva is Australian-headquartered). Patch: upgrade Affinity by Canva to 3.3.0 or later. No public exploitation claim on the Tenable/NVD snippets reviewed this pass. (source: CVE/NVD/Tenable record)
Tenable — CVE-2026-81546 Affinity by Canva (indexed 17 Sep 2026)
Doyensec research post (17 September 2026) shows Open vSwitch’s kernel datapath can strip SKBFL_SHARED_FRAG from a still-forwarded packet, re-opening the Fragnesia Dirty COW-class primitive: an unprivileged user can cause in-place ESP decrypt over page-cache pages they may only read, writing attacker-chosen bytes into root-owned file page cache. Tracked as CVE-2026-90049, CVE-2026-89487 and CVE-2026-80977; reported to the Linux kernel security team and coordinated with OVS maintainers. Builds on prior Dirty Frag / Fragnesia work (including CVE-2026-43284 and CVE-2026-43500). Impact surface: virtualisation/container stacks using OVS (OpenStack Neutron, oVirt, Antrea/OVN-Kubernetes, libvirt bridges, etc.). (source: Doyensec blog) Correction (02 Nov 2026): removed talkback.sh as a source. (source: Doyensec)
Two CVE records published on 16 September 2026 (AWST) rate CVE-2026-71133 and CVE-2026-83059 at CVSS 3.1 10.0, critical. CVE-2026-71133 is in the Authentication Engine component of Oracle Access Manager (Oracle Fusion Middleware): the record says the easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, and a successful attack can result in takeover of Oracle Access Manager. CVE-2026-83059 is in the OID LDAP Server component of Oracle Internet Directory: the same kind of unauthenticated network attack, via LDAP, can result in takeover of Oracle Internet Directory. For both, the records say attacks may significantly impact additional products (scope change), and list supported versions 12.2.1.4.0 and 14.1.2.1.0 as affected. (source: CVE records) Correction (31 Oct 2026): removed Oracle's Critical Security Patch Update advisory and SecurityWeek, which this desk cannot read, as sources, with the details only they gave; the card now carries only what the two CVE records state, and its date moved from 15 to 16 September 2026, the records' publication date in AWST. (source: CVE records)
Trend Micro Zero Day Initiative advisory ZDI-26-708 / ZDI-CAN-29849 (published 16 September 2026; CVSS 5.3 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) documents an unpatched Microsoft Windows privilege-escalation issue in HTTP proxy authentication handling. A low-privileged local attacker who can change the user proxy setting to an attacker-controlled server can coerce NTLM authentication in the machine-account context (commonly via Network Connectivity Status Indicator / WinHTTP connectivity checks running as NETWORK SERVICE). Microsoft acknowledged the report (May 2026), initially indicated a September fix, then on 31 August 2026 said the issue did not meet the Windows security servicing bar; ZDI published as a 0-day on 16 Sep. No CVE assigned. ITRESIT Labs (28 Sep) describes a pentest chain using the coercion into AD CS Web Enrollment relay when EPA/HTTPS are not enforced — that chain is environmental, not part of ZDI’s scored impact. (sources: ZDI-26-708; ITRESIT)
ZDI-26-708 — Microsoft Windows HTTP Proxy Privilege Escalation (0-day, 16 Sep 2026)
oss-security disclosure by Hyunwoo Kim (17 September 2026; embargo lift) and CVE published 16 September 2026: CVE-2026-89775 is a guest-to-host escape in KVM/arm64 when nested virtualization is enabled. Type truncation of the stage-1 walk level can make VNCR pseudo-TLB size computation return 0 (“size unknown”); invalidation treats that as an empty range and skips, leaving a freed host page mapped writable so a malicious guest gets 64-bit R/W without trap/VM-exit. Introduced mainline 7270cc9157f47 (14 May 2025); fixed 8053393680d4 (6 Aug 2026). Red Hat rates Important, CVSS 3.1 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). On hosts with nested virt and world-writable /dev/kvm (e.g. some RHEL configs), also a local root LPE path. (sources: oss-security; Red Hat CVE page) Correction (02 Nov 2026): removed The Hacker News as a source. (source: CVE.report)
Veeam KB4852 documents CVE-2026-32996, a local privilege escalation in Veeam Agent for Microsoft Windows. Vendor CVSS 4.0 score 7.3 High (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). KB4852 says the flaws it lists affect Veeam Backup & Replication 13.0.1.2067 and all earlier version 13 builds. Fixed starting with Veeam Backup & Replication 13.0.2.29; Veeam's Agent for Windows fix list (KB3108) shows CVE-2026-32996 fixed in Agent build 13.0.3.1220. Same KB also ships CVE-2026-32997 (Backup Administrator arbitrary file write on Linux Veeam Software Appliance; CVSS 4.0 8.6) fixed in the same 13.0.2.29 build. (sources: Veeam KB4852; Veeam KB3108) Correction (24 Oct 2026): KB4852 gives the affected range as Veeam Backup & Replication 13.0.1.2067 and earlier version 13 builds, not Agent builds; the fixed Agent build 13.0.3.1220 is now sourced to Veeam KB3108 because the Arctic Wolf post no longer loads. (source: Veeam KB4852) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Veeam KB4852; Veeam KB3108)
Check Point advisory sk1000155 (disclosed 16 September 2026; NVD published same day) documents CVE-2026-91843, a stack overflow (CWE-121) in the unauthenticated login process on Security Management and Log Servers. Check Point CVSS 3.1 base 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker without credentials can run arbitrary code as root over the network; Check Point states the vulnerable path runs through the Trusted Clients setting (hosts allowed to connect via SmartConsole). Vendor and CISA SSVC: no indication of in-the-wild exploitation; not in KEV as of mid-September catalog checks. Affected branches by Jumbo Hotfix Take (or older): R82.20 (apply Take 29+), R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below; R81.10/R81/R80.x End of Support (ticket Check Point for fix or upgrade). Smart-1 Cloud hosted management is not affected (fix already deployed). Remediation: LivePatch per sk1000155; customers with automatic updates (sk175504) already protected. (sources: Check Point sk1000155; NVD) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Check Point)
Check Point sk1000155 — CVE-2026-91843 Security Management/Log Server (16 Sep 2026)
CVE-2026-65388 (GHSA-mx96-5vvg-x2mg; Apple/containerization Swift package) covers RegistryClient following the WWW-Authenticate realm without validating host or scheme. A remote attacker who controls a container registry can redirect the client’s token request to an attacker-chosen host and disclose the victim’s registry credentials. GitHub advisory severity Moderate; published on the advisory 30 August 2026; Tenable/NVD indexing lists CVE published ~16 September 2026 with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). GHSA lists affected versions ≤ 0.41.0 and patched versions > 0.41.0; Tenable text says the issue is addressed in containerization 0.41.0 — confirm the exact fixed build against GHSA before closing. No public exploitation claim on the Tenable/GHSA material reviewed this pass. Australia relevance: Apple container tooling / Mac container workflows pulling from untrusted registries.
NLnet Labs advisory dated 16 September 2026 assigns CVE-2026-81642 to a Critical heap overflow in Unbound’s DNSSEC validator when digesting a DNSKEY whose owner name is a compression pointer into its own RDATA. An attacker who controls a malicious zone and queries a vulnerable resolver can cause denial of service and possible remote code execution through attacker-controlled data. NLnet Labs rates Critical with maintainer CVSS 9.1 (CVSS:4.0 network/no privileges/no UI). Affected: Unbound up to and including 1.26.0 (includes 1.25.2 and 1.26.0). Fixed: Unbound 1.26.1 (source + Windows binaries) or apply NLnet Labs patches (minimal or complete for CVE-2026-81642; combined patch covers nine CVEs in the release, including high CVE-2026-82717 CNAME-synthesis heap corruption). NLnet Labs reports no known exploitation. (source: NLnet Labs CVE-2026-81642.txt) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: NLnet Labs)
ISC published 14 BIND 9 security advisories on 16 September 2026, seven rated High severity by ISC: CVE-2026-80274, CVE-2026-76163, CVE-2026-19666 (use-after-free in query_addnoqnameproof() via the DNS64 filter64 path; ISC CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CVE-2026-81563, CVE-2026-77692 (unauthenticated remote crash of named via a crafted DNS-over-HTTPS request with an invalid SIG(0) record followed by a premature connection close; ISC CVSS 7.5), CVE-2026-19667 and CVE-2026-81736. ISC describes all seven High-severity issues as denial-of-service. Triggers per ISC include a mismatched NOQNAME proof, a QTYPE TKEY query when named.conf has no global options block, a specifically malformed authoritative answer on DNS64 resolvers, SVCB/HTTPS AliasMode records, crafted DoH requests and a negative answer of exactly 65536 bytes. The other seven advisories are rated Medium by ISC and cover a resolver crash, cache poisoning, zone-data injection and resource exhaustion. ISC says it is not aware of any active exploits. Fixed releases per ISC: BIND 9.20.29 and 9.21.26 (9.20.29-S1 for the Supported Preview Edition). Source: ISC KB advisories. Correction (23 Oct 2026): re-checked against ISC's own advisories and removed a third-party news source; the card now rests on ISC alone; the set is 14 advisories, not 14 denial-of-service flaws (ISC rates seven Medium issues that include cache poisoning and zone-data injection), and the affected-version line now uses ISC's ranges.
Micah Lee (16 September 2026; dataset from DDoSecrets / stegan0gram field extraction, also covered by 404 Media and Wired) analyses firmware from an in-use Flock Safety automatic licence-plate reader (ALPR) camera. The unit ran a modified Android 8.1 build dated 5 June 2025 on Linux 3.18.71 — far past vendor/Google support — and ships multiple Flock apps. Lee documents a hard-coded x-api-key in an app used to request device credentials from hpnotiq.flocksafety.com (MAC-address keyed), with returned credentials stored in plaintext and usable to mint bearer tokens via device-login.flocksafety.com. Lee lists older public Android/kernel CVEs the patch level likely predates but does not claim live exploitation tests on this hardware. Flock gave a statement to 404 Media/Wired (per Lee). No CVE assigned in the write-up. (source: Micah Lee analysis)
Micah Lee — Flock cameras hard-coded credentials (16 Sep 2026)
The CVE record (published 15 September 2026, 16:41 UTC; 16 September, 12:41 am Perth) covers CVE-2026-89026 in Issabel Framework (web UI for Issabel PBX / Asterisk). Before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd the pbxapi index.php embeds a hard-coded HS256 JWT signing key identical on every install (CWE-321). Unauthenticated attackers forge bearer tokens and call /pbxapi/manager/originate with the System application parameter so Asterisk runs arbitrary OS commands as the Asterisk user. The CVE record rates it CVSS 4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 9.8. Patch (1 August 2026) replaces the hard-coded key with a key from /etc/issabel.conf. Shadowserver first observed exploitation on 9 September 2026; scale/actors not detailed. Apply the patched framework commit or later; rotate any JWT material that relied on the shared key. (source: CVE record) Correction (25 Oct 2026): the card date has moved from 15 to 16 September 2026, the Perth date of the CVE record's publication (15 September, 16:41 UTC; 16 September, 12:41 am Perth). (source: CVE.org) Correction (02 Nov 2026): removed The Hacker News as a source. (source: CVE record; Issabel framework commit on GitHub)
CVE.org — CVE-2026-89026 record (Issabel Framework hard-coded JWT key; published 16 Sep 2026 Perth)
