Apache Security Advisories - 2026-09-23

Adobe Patch Day 2026-09-22

Apache Security Advisories - 2026-09-21

big-ip_access_policy_manager

Heap-based Buffer Overflow

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.

Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

When a BIG-IP APM access policy and an OAuth profile is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).

Impact:
This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

BIG-IP

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution. This vulnerability only affects BIG-IP APM systems configured as an OAuth Authorization Server; deployments using APM strictly as an OAuth Client or Resource Server (without OAuth authorization server profiles) are not affected. The vulnerability exists in the data plane with no control plane exposure.

Forced Integer Overflow

Github Advisory

my.f5.com

quantum_security_management

multi-domain_security_management

management_server

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Quantum Security Management

checkpoint

A directory traversal and file upload vulnerability in Check Point Management Server allows attackers to upload and execute arbitrary scripts on the server.

Path Traversal

Using Slashes and URL Encoding Combined to Bypass Validation Logic

Manipulating Web Input to File System Calls

Using Escaped Slashes in Alternate Encoding

Using Slashes in Alternate Encoding

support.checkpoint.com

blog.checkpoint.com

identity_services_engine_passive_identity_connector

identity_services_engine

Incorrect Use of Privileged APIs

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.

This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

Cisco Identity Services Engine Software

Cisco

Cisco ISE Passive Identity Connector

A vulnerability in an API of Cisco Identity Services Engine (ISE) allows bypass of authentication due to insufficient authentication control on an API endpoint. An attacker can exploit this by sending a crafted request to the affected API endpoint, gaining unauthorized access to the device and bypassing the web-based management interface.

Cross Site Tracing

Hijacking a privileged process

sec.cloudapps.cisco.com

DIR-825

dir-825

Improper Restriction of Operations within the Bounds of a Memory Buffer

Out-of-bounds Write

A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname  leads to out-of-bounds write. The attack may be initiated remotely.

D-Link

An out-of-bounds write vulnerability exists in the tunnel_set_params function of the rp-l2tp component in D-Link DIR-825 3.00b32. The vulnerability is triggered through manipulation of the peer_hostname argument.

Buffer Overflow via Environment Variables

Overflow Buffers

Buffer Manipulation

Client-side Injection-induced Buffer Overflow

Filter Failure through Buffer Overflow

MIME Conversion

Overflow Binary Resource File

Buffer Overflow via Symbolic Links

Overflow Variables and Tags

Buffer Overflow via Parameter Expansion

Buffer Overflow in an API Call

Buffer Overflow in Local Command-Line Utilities

gaia_os

gaia_embedded

quantum_security_gateway

Improper Certificate Validation

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Quantum Security Gateway

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway allows an attacker to bypass SSL/TLS certificate verification and establish unauthorized VPN connections to the Gateway.

Creating a Rogue Certification Authority Certificate

Signature Spoofing by Improper Validation

WordPress

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

WordPress Foundation

An unauthenticated attacker can exploit the `get_page_template()` function to resolve and include a chosen readable local `.php` file located outside the active theme directories. When specific server and active theme preconditions are met, this can lead to remote code execution.

PHP Remote File Inclusion

The exploit leverages missing path containment in WordPress's `get_page_template()` function to traverse outside the theme directory and include an arbitrary readable local PHP file. When the included file is PEAR's pearcmd.php (a gadget), attacker-controlled data is serialized into a writable directory; a second request includes that written file, executing embedded PHP code with web-server privileges.

The exploit leverages unauthenticated path traversal in WordPress's get_page_template() function via double URL-encoded directory traversal sequences in the pagename parameter. An attacker crafts a malicious pagename query parameter with encoded traversal sequences to include arbitrary PHP files from outside the active theme directory, potentially achieving RCE if conditions are met.

bugzilla.redhat.com

velocloud_orchestrator

Improper Input Validation

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

VeloCloud Orchestrator (VCO) On-Prem

Arista Networks

VeloCloud Orchestrator (VCO) on-premises has a security vulnerability that allows remote attackers to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Server Side Include (SSI) Injection

Cross Zone Scripting

Command Line Execution through SQL Injection

Object Relational Mapping Injection

SQL Injection through SOAP Parameter Tampering

Double Encoding

Subverting Environment Variable Values

Format String Injection

LDAP Injection

Input Data Manipulation

Flash Injection

XSS Using MIME Type Mismatch

Exploiting Trust in Client

File Content Injection

Serialized Data with Nested Payloads

Oversized Serialized Data Payloads

XML Injection

Impair Command History Logging

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

www.arista.com

suneditor

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

JiHong88

The sanitizer in SunEditor versions prior to 2.47.11 fails to consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute arbitrary JavaScript in the application's browser origin.

DOM-Based XSS

Reflected XSS

Stored XSS

Cross-Site Scripting (XSS)

AJAX Footprinting

An attacker crafts HTML content containing namespaced or custom elements (e.g., <a:b>) with event-handler attributes (onclick, onmouseover). The SunEditor sanitizer fails to consistently strip these attributes from non-standard elements, allowing the handler to execute when a user interacts with the rendered element in the browser.

Search CVEs by ID

Trending vulnerabilities

Latest security advisories

Apache Security Advisories - 2026-09-23: 6 critical vulnerabilities amid 22 CVEs

Adobe Patch Day 2026-09-22: 10 critical vulnerabilities amid 29 CVEs

Apache Security Advisories - 2026-09-21: 3 critical vulnerabilities amid 6 CVEs

Browse

Be the first to know about critical vulnerabilities