New that day
- highpatchedexploited BerriAI LiteLLM Improper Authentication Vulnerability BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-16).
- highpatchedexploited Kludex Starlette HTTP Request/Response Smuggling Vulnerability Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-16).
- highpatchedexploited Kestra OSS OS Command Injection Vulnerability Kestra Kestra OSS Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-05).
- highpatchedexploited JFrog Artifactory Improper Authentication Vulnerability JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-05).
- highpatchedexploited Sangoma Switchvox SQL Injection Vulnerability Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-05).
- highpatchedexploited SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. Can be chained with CVE-2026-83549. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-05).