Apache Security Advisories - 2026-09-15

Oracle Critical Security Patch Update Advisory - September 2026

Apache Security Advisories - 2026-09-14

asyncos

secure_email_gateway

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.

Cisco Secure Email

Cisco

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device.

Command Line Execution through SQL Injection

Object Relational Mapping Injection

SQL Injection through SOAP Parameter Tampering

Expanding Control over the Operating System from the Database

SQL Injection

Blind SQL Injection

Github Advisory

sec.cloudapps.cisco.com

gitea

Improper Control of Generation of Code ('Code Injection')

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Gitea

Code Injection

Leverage Executable Code in Non-Executable Files

Manipulating User-Controlled Variables

github.com

gitlab

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

GitLab

GitLab CE/EE contains an improper path confinement and missing authentication enforcement vulnerability in the repository commits API. This allows unauthorized access to read arbitrary files from the GitLab server under certain conditions.

Path Traversal

Using Slashes and URL Encoding Combined to Bypass Validation Logic

Manipulating Web Input to File System Calls

Using Escaped Slashes in Alternate Encoding

Using Slashes in Alternate Encoding

The exploit bypasses authentication and path confinement checks in the GitLab repository commits API by appending suffixes (.json or trailing /) to the endpoint URL and manipulating file.path parameters to read arbitrary files from the server filesystem. Two bypass methods are demonstrated: one using a .json suffix to evade authentication, and one using a trailing slash with form-encoded data to bypass path validation.

The exploit bypasses authentication checks in the GitLab repository commits and files API endpoints by using URL-encoded path segments and parameter injection techniques. It crafts specially-formed requests that reach the file-read handler before authentication validation occurs, allowing arbitrary local file reads via improper path confinement.

The exploit leverages missing authentication enforcement in GitLab's Repository Commits and Files APIs before the file path is resolved. An unauthenticated attacker sends a POST request to endpoints like /api/v4/projects/{id}/repository/commits or /api/v4/projects/{id}/repository/files/{name} with a crafted file.path parameter pointing to an arbitrary file on the server. The vulnerable code evaluates the file path and processes it (reading content, checking existence, or parsing JSON/form-data) before authentication is enforced, allowing information disclosure through error messages or status codes.

The exploit bypasses authentication and path confinement in GitLab's repository commits API by crafting a POST request to /api/v4/projects/{id}/repository/commits/ with a trailing slash that skips Workhorse rewrite rules. It passes an attacker-controlled file path in the file.path parameter, triggering a parser error that echoes the attempted path or file contents in the error message, allowing arbitrary file read.

The exploit bypasses authentication in GitLab's repository commits and files APIs by crafting malformed URL-encoded parameters that are decoded by Puma but bypass Workhorse regex checks. Rails then opens files before enforcing authentication, and invalid %-encoding sequences in the file path are echoed in the 400 error response, leaking the file contents.

chrome

Use After Free

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Chrome

Google

Use after free vulnerability in Workers in Google Chrome prior to version 153.0.8010.47. This vulnerability allows a remote attacker to potentially execute arbitrary code outside the sandbox via a specially crafted HTML page.

Google Chrome chrome-153.0.8010.47

secret_server

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.

Secret Server (On-Prem)

Delinea

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker in Delinea Secret Server.

XSS Using MIME Type Mismatch

DOM-Based XSS

Reflected XSS

Stored XSS

Cross-Site Scripting (XSS)

AJAX Footprinting

edge_chromium

edge

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

Microsoft Edge (Chromium-based)

Microsoft

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.


langflow

Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.

Langflow OSS

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow attackers to execute arbitrary Python code with root privileges by submitting components containing socket or urllib imports. The scanner validation mechanism incorrectly returns "validated": true, providing a false security signal that bypasses intended safety checks.

Server Side Request Forgery

The exploit submits a custom component containing a Python code string with `urllib.request.urlopen()` to the `/api/v1/custom_component` endpoint. The Langflow code scanner fails to block socket and urllib imports, allowing the malicious code to execute in the context of the Langflow process. The attacker extracts the result from the `display_name` field in the response.

flowise

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks.

Search CVEs by ID

Trending vulnerabilities

Latest security advisories

Apache Security Advisories - 2026-09-15: 1 critical vulnerabilities amid 18 CVEs

Oracle Critical Security Patch Update Advisory - September 2026: 10 critical vulnerabilities amid 672 CVEs

Apache Security Advisories - 2026-09-14: 10 critical vulnerabilities amid 20 CVEs

Browse

Be the first to know about critical vulnerabilities