Briefs

Roundup of Google security advisories published in September 2026.

The go-openapi/swag library is vulnerable to a stack overflow in its jsonutils component, allowing remote unauthenticated attackers to cause a denial-of-service by submitting deeply nested JSON documents.

The Multi Uploader for Gravity Forms WordPress plugin is vulnerable to unauthenticated arbitrary file upload due to improper validation in the move_file function, enabling potential remote code execution.

Roundup of Microsoft security advisories published in September 2026.

Grav CMS 2.0.10 is vulnerable to path traversal in the ImageMedium::watermark() method, allowing unauthenticated attackers to disclose arbitrary image files by traversing outside the media sandbox.

CVE-2026-92917 allows an authenticated user with page-edit privileges in Grav CMS 2.0.0-rc.1 through 2.0.21 to bypass Twig sandboxing and exfiltrate the full application configuration, including API keys and credentials.

A missing 'security@' guard in Grav's group blueprint allows an 'admin.users' operator to escalate privileges to 'admin.super' by modifying group access configurations.

An authenticated path traversal vulnerability in Grav CMS's MediaUploadTrait allows users with media management permissions to delete arbitrary files on the server by providing crafted file paths.

Jupyter Server versions prior to 2.21.0 inadvertently expose authentication tokens in plain-text 500 error logs due to improper logging of the Referer header.

A vulnerability in djust caused multi-tenant isolation to fail open on WebSocket and SSE paths, allowing unauthorized cross-tenant data disclosure due to improper tenant context propagation.

The HAPI FHIR SHCParser component contains an unbounded DEFLATE decompression flaw (CVE-2026-81875) allowing attackers to trigger memory exhaustion and denial-of-service.

CoreDNS versions up to 1.14.6 fail to validate DNS UPDATE opcodes over DoH, DoH3, DoQ, and gRPC, allowing attackers to relay unauthorized updates to upstream servers.

A malformed HTTP chunked body triggers an infinite loop in the react/http ChunkedDecoder, causing 100% CPU usage and service disruption in both server and client implementations.

The redis-parser library up to version 3.0.0 is vulnerable to a denial of service attack where crafted RESP byte streams trigger unbounded recursion, exhausting the V8 call stack and crashing the host Node.js process.

SigNoz versions 0.88.0 through 0.141.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to query sensitive trace analytics via the trace-funnel endpoint.

An improper input validation vulnerability in NetworkManager-l2tp (CVE-2026-93337) allows local users with VPN creation permissions to inject malicious directives into the pppd configuration, leading to arbitrary code execution as root.

A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.

A vulnerability in the Redis cluster bus packet parser allows remote attackers to trigger an out-of-bounds read via crafted PING, PONG, or MEET packets, resulting in potential information disclosure or denial of service.

A stored Cross-Site Scripting (XSS) vulnerability in the Vendure Admin Dashboard allows authenticated administrators to execute arbitrary JavaScript in the context of other users viewing entity lists, leading to potential account takeover.

A command injection vulnerability in @cyclonedx/cyclonedx-npm on Windows allows attackers to execute arbitrary commands by supplying malicious input to the --workspace argument.

A logic error in the RabbitMQ Java client's frame size negotiation allows a malicious server to trigger a massive memory allocation and service crash by exploiting an integer comparison flaw in frame handling.

PocketBase is susceptible to a denial-of-service vulnerability (CVE-2026-82410) where unhandled panics in internal worker goroutines trigger unexpected server process termination.

A broken access control vulnerability in @tinacms/auth allows attackers to perform unauthorized actions by supplying their own valid TinaCloud credentials against a victim's TinaCMS deployment.

Umbraco CMS contains an authorization bypass vulnerability (CVE-2026-69197) in the Delivery API where protected content is leaked when referenced by an unprotected node through expansion parameters.

ExifReader version 4.41.0 is susceptible to a heap exhaustion denial-of-service vulnerability due to an unbounded object allocation loop when parsing malicious ISO-BMFF iloc box structures.

RestrictedPython versions prior to 8.4 are vulnerable to a sandbox escape (CVE-2026-76825) via the string.Formatter module, which can bypass attribute guards to access sensitive objects and primitives.

A critical integer overflow vulnerability in the amqp091-go parser causes protocol desynchronization, allowing remote attackers to inject arbitrary AMQP frames into the network stream.

The RabbitMQ amqp091-go library contains a vulnerability in its Qos configuration method where signed integer inputs are implicitly cast to unsigned integers, allowing attackers to trigger message flooding and OOM crashes via integer wrap-around.

An authenticated remote code execution vulnerability (CVE-2026-65608) in Grav CMS versions 1.7.0 through 2.0.8 allows attackers with Flex directory create/update permissions to execute arbitrary shell commands due to improper input validation in `FlexDirectory::dynamicDataField()`.

An unauthenticated SSRF vulnerability in the Kestra OSS Pebble template engine allows remote attackers to perform arbitrary requests to internal network services and cloud metadata endpoints.