New that day
- highpatchedexploited ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11 (federal deadline 2026-09-14).
- highpatchedexploited JFrog Artifactory Incorrect Authorization Vulnerability JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. Can be chained with CVE-2026-42018. Added to CISA KEV on 2026-09-11 (federal deadline 2026-09-25).
- highpatchedexploited GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11 (federal deadline 2026-09-14).