Apple security content for iOS/iPadOS 26.7 (support 149041, released 14 September 2026) and macOS Golden Gate 27 (149035) lists CVE-2026-86869 in ImageIO: out-of-bounds write addressed with improved bounds checking; Apple impact text on 26.7 is “Processing a maliciously crafted image may lead to unexpected app termination” (credits: Niels Hofmans, Meta Red Team X, Geonha Lee, Chris Bailey — Short Circuit). UPDATE 26 Sep 2026: ironPeak blog EX-ARRR publishes full technical disclosure — heap overflow in libAppleEXR.dylib / CompressedInterleave4 when decoding crafted OpenEXR; researcher states Apple triage classified the report as 0-click code execution via iMessage EXR image payload, with BlastDoor not decoding EXR and Spotlight/ImageIO thumbnailing providing the side-door reach; PAC/MIE still constrain reliable exploitation on modern Apple silicon. Reported May 2026; fixed across iOS/iPadOS/macOS 27 family builds as CVE-2026-86869 per researcher timeline. No CVSS from Apple. Patch: current iOS/iPadOS 26.7+ / macOS 27 (Golden Gate) / equivalent trains. (sources: Apple iOS 26.7 security content; ironPeak)
Apple — iOS 26.7 and iPadOS 26.7 security content (CVE-2026-86869 ImageIO, 14 Sep 2026)
JFrog Security Research (CVE published 14 September 2026; industry report 22 Sep) documents CVE-2026-90898 in MaximHQ Bifrost (open-source AI gateway / HTTP transport): with default governance.auth_config.is_enabled=false, an unauthenticated POST /api/mcp/client registering a stdio-type MCP client starts attacker-chosen command+args as the Bifrost process user before any MCP handshake. JFrog/CNA CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-306/284. Stock binary binds management API to localhost by default; official Docker image binds 0.0.0.0 so published ports expose the management API. Fix: transports/v2.1.0 returns 403 for unauthenticated stdio registration (PR #6757). Affected: Bifrost HTTP transport < 2.1.0; 1.6.x through 1.6.11 and transports/v2.0.0 lack the fix. Workaround: enable management auth and firewall the listener; treat previously exposed unauth instances as compromised and rotate virtual keys/provider credentials. (sources: JFrog advisory; CVE.report) Correction (02 Nov 2026): removed The Hacker News as a source. (source: CVE.report)
JFrog — Bifrost unauth RCE via MCP stdio (CVE-2026-90898)
cPanel Security advisory (14 September 2026) warns of a critical privilege-escalation flaw in LiteSpeed Web Server Enterprise: on shared-hosting servers a malicious low-privilege website user could gain root-level access, bypassing account isolation including CageFS, and access or alter other sites and the server. Affected: LiteSpeed Web Server Enterprise prior to v6.3.7. Fix: upgrade to 6.3.7 or later. cPanel/LiteSpeed publish the forced update command /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7. LiteSpeed store announcement for 6.3.7 (11 September 2026) lists three security changes (lscgid auth, internal redirect URL validation, block internal-use env vars from .htaccess) without naming a CVE or privilege-escalation root cause; neither cPanel nor LiteSpeed assigned a public CVE or CVSS for this Enterprise web-server issue as of 15 September 2026 check. Advisory does not state in-the-wild exploitation for this Enterprise flaw (distinct from earlier actively exploited LiteSpeed cPanel-plugin issues CVE-2026-48172 and CVE-2026-54420 already on Cyberstack). OpenLiteSpeed not named in the cPanel advisory. (sources: cPanel; LiteSpeed 6.3.7 announcement) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: cPanel; LiteSpeed)
Antonio De Turris (deturris.io, 14 September 2026) details two authorization bypasses in n8n’s AI Agents feature. CVE-2026-65015: a read-only Project Viewer can instruct an agent’s run_node_tool to execute arbitrary n8n nodes (including HTTP Request) with the project’s credentials; if Execute Command is enabled on self-hosted, that path can reach host command execution. Affected: all versions before 2.29.8, plus 2.30.0; fixed in 2.29.8 and 2.30.1. GitHub GHSA-x5vx-c2c8-m3w9 rates High (CVSS 4.0 overall 7.2). CVE-2026-59207: the agent MCP client sends credential headers without enforcing “Allowed HTTP Request Domains”, so a use-only credential holder can point MCP at an attacker host and exfiltrate the secret. Affected: all before 2.27.4, plus 2.28.0; fixed in 2.27.4 and 2.28.1. GHSA-h44j-f5r5-ph73 High (CVSS 4.0 overall 7.1). Reported June 2026; vendor advisories published with the fixes. (source: n8n GitHub security advisories)
De Turris — n8n AI Agents authorization bypasses (14 Sep 2026)
Silent Signal (14 September 2026) documents a pre-authentication vulnerability chain in the IBM Db2 Mirror for i web interface (Db2MirrorServlet on the IBM i administrative Liberty instance; lab IBM i V7R5, GUI WAR build timestamp late 2025). The write-up describes how authentication/validation filters can be confused, enabling unauthenticated reach into powerful admin features (arbitrary file read via log/trace viewers, attacker-influenced writes into an expanded WAR path that becomes JSP execution in Liberty, then a native helper crossing to QSECOFR on the local IBM i system). No CVE identifier is assigned in the post; the author withholds exploit/JSP payload bodies and frames the piece as vulnerability mechanics plus hardening guidance. Confirm IBM PSIRT/bulletin status for your Db2 Mirror for i / IBM i web stack build before declaring patched. (source: Silent Signal) Correction (02 Nov 2026): removed talkback.sh as a source. (source: Silent Signal)
Silent Signal — Db2 Mirror for i pre-auth RCE chain (14 Sep 2026)
Cisco PSIRT advisory cisco-sa-esa-inj-2bLVGmhX (14 September 2026) covers CVE-2026-76461, a Critical SQL injection in email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway (physical and virtual, any configuration). Unauthenticated remote attackers can send a crafted email with malicious SQL statements and gain command execution as root on the underlying OS. Cisco CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-89; Bug CSCwu56234. Not affected: Secure Email and Web Manager, Secure Web Appliance. Cisco PSIRT became aware of active exploitation in September 2026; Cloud customers with detected malicious activity were contacted directly; Cloud fleet already upgraded to 16.5.0-780. IoC guidance: grep mail_logs for suspicious SQL (example COPY.*TO PROGRAM); also review external network/firewall logs because root access can erase on-box evidence. No workarounds. Fixed AsyncOS: 15.5 and earlier → 15.5.5-014; 16.0 → 16.0.4-302; 16.5 → 16.5.0-780 (Cisco strongly recommends 16.5.0-780). CISA added CVE-2026-76461 to KEV with FCEB remediation due 17 September 2026 (report: BleepingComputer, 15 Sep). Same-day Cisco also shipped other critical SEG/SEWM fixes (CVE-2026-76440/76441/20353/76443) without claimed in-the-wild use — covered here only as context, not separate cards. (sources: Cisco PSIRT; BleepingComputer) Correction (02 Nov 2026): removed The Hacker News as a source. (source: Cisco; BleepingComputer)
Apple published security-content pages dated 14 September 2026 for major releases including iOS 27 and iPadOS 27 (support.apple.com/en-us/149034; 100+ CVE entries on that page alone), macOS Tahoe 26.7 (149042), macOS Sequoia 15.8 (149043), Safari 27 (149039), plus tvOS/watchOS/visionOS 27 and macOS Golden Gate 27. Highlighted iOS 27 entries (Apple does not publish CVSS): sandbox breakout CVE-2026-65354; sandboxed app to kernel privileges CVE-2026-84607; WebKit universal cross-site scripting via crafted webarchive CVE-2026-86898; ImageIO/remote code-execution class issues including CVE-2026-65414; privileged-network IPSec authentication bypass CVE-2026-65329 (also listed on earlier 26.6.x content). No “actively exploited” callouts observed on the fetched iOS 27 page. UPDATE 16 September 2026: macOS Golden Gate 27 security content (support.apple.com/en-us/149035) re-fetched — 200+ CVE entries on that page alone. Separate from prior /n/apple-ios-2661-20260817. Correction (30 Oct 2026): removed a fix count credited to SecurityWeek, which this desk cannot read; Apple's own pages are the source for the entries listed. (source: Apple)
Gitea GHSA-rcr6-4jqh-j84m / CVE-2026-60004 (28 July 2026 advisory; CISA KEV 25 August 2026): diffpatch API can let a user with repository write access (including self-registered users on open instances) run commands as the Gitea service account. Affected 1.17 through versions before 1.27.1; patch to 1.27.1+. UPDATE 14 September 2026: Acronis Threat Research Unit (13 September) assesses with moderate confidence that a cluster it tracks as Red Heron operates within a PRC-linked context; it began building on a public CVE-2026-60004 PoC on 29 July 2026, scanning 1,386 Gitea instances across seven countries (plus a 477-instance Taiwan dataset). Acronis says confirmed compromises affected organisations in Canada, Argentina, Taiwan, the United States and Sri Lanka, and a Qatar-based target also had data pulled. Campaign progressed from repository theft to credentials, persistence, and lateral movement (including root on a three-node Proxmox cluster). Tooling includes C++ Linux implant JITTERLY (30+ commands) and LD_PRELOAD rootkit SIXZUT. (sources: Gitea; CISA; Acronis TRU) Correction (29 Oct 2026): CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on 25 August 2026; CISA's alert and catalog entry are now linked, as is Acronis TRU's own report (13 Sep 2026); internal source labels were removed. (sources: CISA; Acronis) Correction (29 Oct 2026): an earlier version gave a figure of 13 compromised organisations; no linked source on this card gives that figure. (source: Acronis TRU) Correction (29 Oct 2026): the card date is now 13 September 2026, the date shown on Acronis Threat Research Unit's report, the earliest readable source reporting the Red Heron exploitation this card is about; Gitea's 28 July 2026 advisory is background on the flaw and no longer sets the date. The card had been dated 25 August 2026, the day CISA added the flaw to its Known Exploited Vulnerabilities catalog. (source: Acronis TRU) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Acronis TRU)
Wordfence CNA (CVE published 12 September 2026; disclosed 11 Sep; vendor notified 23 Aug) documents CVE-2026-78175 in Themeum Tutor LMS (WordPress e-learning plugin): authenticated subscriber+ PHP object injection via the withdraw_method_field parameter of the tutor_save_withdraw_account AJAX handler (CWE-502). The handler relies on a nonce only (no capability/role check) and passes attacker-controlled values through esc_sql() before update_user_meta(); on retrieve, unserialize() over-reads into attacker-controlled bytes, enabling arbitrary object injection. Wordfence describes a GuzzleHttp\Cookie\FileCookieJar POP chain via the plugin's bundled PayPal Composer autoloader (TUTOR\RestAPI spl_autoload_register), writing attacker-controlled content to an attacker-chosen filename — remote code execution on the web server. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected: all versions ≤ 4.0.7; unauthenticated pathway when user registration is enabled (common for student/teacher sign-up) and monetization is enabled. CISA ADP SSVC (15 Sep): Exploitation none / Automatable no / Technical Impact total. No in-the-wild exploitation claimed in the CNA. Patch: Tutor LMS 4.0.8 (report reporting: Themeum release ~10 Sep 2026). Credits: Chloe Chamberland / Wordfence Argus. (sources: Wordfence threat-intel; CVE record)
Wordfence (CVE records published 12 September 2026, crediting Chloe Chamberland and Wordfence Argus) documents two critical unauthenticated remote-code-execution chains in StellarWP The Events Calendar plugin (600,000+ active installations per WordPress.org). CVE-2026-78159 (CVSS 9.8; versions up to and including 6.17.3): unauthenticated code injection via insufficient validation of the widget 'classes' map, triggered when the single-event HTML including the comment area is processed; it requires comments enabled on events and a crafted comment — version 6.17.3.1 is dated 26 August 2026 in the plugin's changelog. CVE-2026-78006 (CVSS 9.8; versions up to and including 6.17.4): unauthenticated PHP object injection when event comments are enabled/visible — payload reaches the vulnerable path before moderation; patched in 6.17.4.1 (10 September 2026). Both can fully compromise the WordPress site. Update to 6.17.4.1 or later. (sources: Wordfence; CVE.org; WordPress.org) Correction (27 Oct 2026): the card said 6.17.3.1 was released on 25 August; the plugin's WordPress.org changelog dates it 26 August 2026. Removed an estimate of about 240,000 sites on vulnerable branches, which no readable source states. The vendor link now points to the plugin's WordPress.org page because theeventscalendar.com now redirects to another site, and the card is now dated 12 September, when the CVE records were published. (source: WordPress.org; CVE.org) Correction (29 Oct 2026): removed a SecurityWeek link and internal source labels. (source: WordPress.org)
ExPatch (Denis and Aleksander Rostilov; writeup 12 September 2026) detail a stored XSS in Telegram Desktop’s HTML chat export: inline-keyboard button text was written into export HTML without escaping (message body and names were escaped). A bot could hide a script in button text; forwarded link-button messages keep the payload; opening an old export in a browser runs the script and can exfiltrate that file’s messages/metadata or rewrite the page (fake verification form demo). No in-the-wild use claimed. Reported to Telegram 3 June 2026. Affected stable: 4.15.1 (March 2024) through 6.9.3. Fixed: 6.9.4 beta (3 July 2026), 7.0.1 stable (14 July 2026) and later. App update does not scrub previously exported HTML. (source: ExPatch) Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ExPatch; Telegram Desktop on GitHub)
ExPatch — Telegram Desktop HTML export XSS (12 Sep 2026)
GitHub advisory GHSA-3c86-2m5g-59q7 (published 28 August 2026; CVE-2026-90553) covers vLLM before 0.28.0. The LlavaOnevision2 processor loader calls transformers.dynamic_module_utils.get_class_from_dynamic_module with trust_remote_code=..., but that helper has no such parameter — the flag is swallowed into **kwargs and ignored — so attacker-supplied processing_llava_onevision2.py / video_processing_llava_onevision2.py top-level code runs even when the operator set trust_remote_code=False. Because LlavaOnevision2ForConditionalGeneration is a built-in vLLM architecture, model config load does not refuse the path. NVD: CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS 4.0 8.5 High. Patch to vLLM 0.28.0 or later. Category tech (LLM inference stack, not a model-vendor guidance item). No Australian exploitation reports on this pass. (sources: GitHub advisory; NVD)
GitHub GHSA-3c86-2m5g-59q7 — vLLM LlavaOnevision2 (28 Aug 2026)
