Skip to content

24 Sept 2026

3 new, 0 updated.

New that day

criticalpartial fix 24 Sept 2026 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and… fixed in github.com/ixofoundation/ixo-blockchain/v8 8.0.0CVE-2026-616045 sources
highpatchedexploited 24 Sept 2026 WSO2 Multiple Products Path Traversal Vulnerability WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. Added to CISA KEV on 2026-09-24 (federal deadline 2026-09-27). CVE-2026-54302 sources
highpatchedexploited 24 Sept 2026 Adobe Commerce and Magento Incorrect Authorization Vulnerability Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24 (federal deadline 2026-09-27). CVE-2026-713622 sources