Vendor patched but no KEV, PoC, or in-wild signal; chatter is automated feed noise.
What: Input validation flaw in macOS (Golden Gate 27, Sequoia 15.8, Tahoe 26.7) allowing remote code execution or app crash; CVSS 8.8 HIGH.
Why it matters: Apple released patches on 2026-09-14, indicating vendor acknowledgment of severity. No KEV listing, no public PoC confirmed in social chatter. Two posts cite the NVD description verbatim without exploitation details or defender triage reports.
Where it's seen: Automated CVE feed posts on Bluesky; no analyst commentary, researcher PoC, or defender questions visible. Posts appear to be syndicated NVD republication rather than organic security discussion.
Vendor advisory + active exploitation claimed; no KEV list or public PoC yet limits to likely-hack range.
What: Linux local privilege escalation (CVSS 7.8) in Acronis backup plugins for cPanel, WHM, and Plesk affecting server hosting control panel integrations.
Why it matters: Acronis disclosed active limited exploitation in the wild; vendor has issued patches (1.9.3 HF3, 1.8.11+). Social chatter reflects legitimate advisory coverage and defender urgency to patch affected backup integrations.
Where it's seen: Bleeping Computer coverage of Acronis advisory; multiple posts flagging patch versions and active exploitation; no public PoC confirmed yet but vendor disclosure confirms real-world attacks.
Also trending
- 4 CVE-2026-78225 score 2 · 1 posthype unscored hack
- 5 CVE-2026-73807 CRITICAL · 9.8 score 2 · 1 posthype LIKELY HACK · 68 hack
What: mySCADA myPRO Manager command API lacks authentication enforcement for privileged functions, allowing unauthenticated network attackers to access management controls (CVSS 9.8 CRITICAL).
Why it matters: Published yesterday with critical CVSS score; social chatter references patch availability (version 2.2) and ICS/OT relevance. Not yet KEV-listed, but urgent patching language and restricted API guidance suggest active defender triage. No confirmed public PoC mentioned in posts.
Where it's seen: Bluesky posts from security vendors and threat intel accounts emphasizing patch urgency, API restriction mitigations, and cross-reference to related CVE-2026-82567. Discourse focuses on OT/ICS impact and version-specific guidance rather than speculation.
- 6 CVE-2026-61560 score 2 · 1 posthype unscored hack
- 7 CVE-2026-78456 score 2 · 1 posthype unscored hack
- 8 CVE-2026-83549 HIGH · 7.8 KEV score 2 · 1 posthype ACTIVE HACK · 89 hack
What: Post-authentication OS command injection in SonicWall SMA1000 Appliance Management Console (CVSS 7.8) allowing remote code execution by authenticated administrators.
Why it matters: KEV-listed as of 2026-09-02 with active exploitation confirmed. CERT-FR and SonicWall vendor advisories report in-the-wild attacks. Rapid7 and security outlets covering active exploitation status same-day post-disclosure.
Where it's seen: International CERT alerts (CERT-FR), vendor security advisories, Bluesky discussion linking CVE-2026-83548 and 83549 as twin SMA1000 flaws. Defender and practitioner alerts emphasizing immediate patching required. No public PoC yet but exploitation campaigns reported.
- 9 CVE-2026-83269 CRITICAL · 9.8 score 2 · 1 posthype unscored hack
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- 10 CVE-2026-83283 CRITICAL · 9.8 score 2 · 1 posthype unscored hack
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- 11 CVE-2026-73431 score 2 · 1 posthype unscored hack
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did not track whether a token had already been successfully used. As a result, a captured activation or password-recovery link remained valid for the entire configured TOKEN_VALIDITY_PERIOD, even after the associated password had been changed. An attacker who obtains a valid activation or recovery token could therefore replay it multiple times during its validity period to set a new password and repeatedly take control of the affected account. In addition, tokens were not bound to a specific purpose, allowing the same token mechanism to be used across activation and recovery workflows. The patch introduces purpose-bound tokens and a random nonce whose SHA-256 digest is stored with the user account. The nonce is invalidated after a successful password change, making tokens single-use, while issuing a new token invalidates any previously issued token. The password-setting operation now explicitly consumes the token before committing the account change. Successful exploitation requires the attacker to obtain a currently valid activation or recovery link, but does not require knowledge of the victim's existing password or an authenticated session.
- 12 CVE-2026-80973 score 2 · 1 posthype unscored hack
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire_comm_receiver_handler() forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if (!urb->status) { if (rt->receiver_buffer[0] == 0x10) /* midi in event */ if (midi_rt) midi_rt->in_received(midi_rt, rt->receiver_buffer + 2, rt->receiver_buffer[1]); } receiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so only 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the device chooses, so a device that answers with 0x10 and a length of 0xFF makes snd_rawmidi_receive() read 255 bytes starting two bytes into a 64-byte object. The bytes past the buffer are handed to userspace through the rawmidi read path. urb->actual_length is not consulted either, so a short transfer leaves both the type byte and the length byte at their previous values and the handler acts on stale data. The receiver URB is submitted from usb6fire_comm_init() at probe, so the read happens on plug with no user action; forwarding to userspace also needs a MIDI input substream open, since usb6fire_midi_in_received() only calls snd_rawmidi_receive() when rt->in is set. KASAN on 7.2.0-rc5 (arm64), single packet from an emulated device: BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive Read of size 255 at addr ffff000009f64682 by task bash/183 __asan_memcpy snd_rawmidi_receive usb6fire_midi_in_received [snd_usb_6fire] usb6fire_comm_receiver_handler [snd_usb_6fire] Allocated by task 11: usb6fire_comm_init [snd_usb_6fire] usb6fire_chip_probe [snd_usb_6fire] The buggy address is located 2 bytes inside of allocated 64-byte region [ffff000009f64680, ffff000009f646c0) Reject the event when the length exceeds the bytes that follow the header, and require the transfer to have delivered the header plus that many bytes. The receiver URB is submitted with a 64-byte transfer_buffer_length, so a genuine device cannot deliver an event longer than those 62 bytes and nothing valid is dropped. Discovered by XBOW, triaged by Baul Lee <[email protected]>
- 13 CVE-2026-83232 CRITICAL · 9.8 score 2 · 1 posthype MIXED · 48 hack
What: Unauthenticated remote code execution in Oracle Data Integrator Console (versions 12.2.1.4.0, 14.1.2.0.0) via HTTP; CVSS 9.8 CRITICAL.
Why it matters: Published 16 hours ago; CVSS 9.8 severity with no authentication required and network-accessible attack vector. However, not yet KEV-listed, and no public PoC or confirmed in-the-wild exploitation chatter observed. Oracle likely issuing urgent patch guidance imminently given criticality window.
Where it's seen: Social posts amplifying NVD description with alarm emoji; hyperlinks to CVE aggregators but no PoC repositories, proof-of-concept code, or defender triage questions yet.
- 14 CVE-2026-83261 CRITICAL · 9.8 score 2 · 1 posthype MIXED · 42 hack
What: Unauthenticated remote code execution in Oracle Product Lifecycle Analytics 3.6.1 (Core component) via HTTP; CVSS 9.8 CRITICAL.
Why it matters: Published 24 hours ago with no PoC, no KEV listing, and no vendor advisory signal yet visible in social chatter. Early-stage disclosure; Oracle Supply Chain deployments are common attack surface. No confirmed in-the-wild exploitation reported.
Where it's seen: Bluesky posts summarizing NVD metadata; generic vulnerability aggregator links; no defender triage questions or PoC repositories yet.
- 15 CVE-2026-83201 CRITICAL · 9.1 score 2 · 1 posthype MIXED · 52 hack
What: Unauthenticated remote code execution and data manipulation in Oracle Siebel CRM Deployment versions 17.0–26.7 via HTTP; CVSS 9.1 CRITICAL.
Why it matters: Published yesterday with CRITICAL severity and zero authentication required. Not yet KEV-listed, but high CVSS and network-accessible attack surface suggest rapid triage priority for Oracle Siebel customers. No public PoC or in-the-wild reports visible in social chatter, but vendors typically patch urgently at this severity level.
Where it's seen: Social posts flagging the NVD entry and CVSS score; minimal technical detail or exploitation discussion; primarily awareness amplification rather than hands-on researcher engagement.
- 16 CVE-2026-83202 CRITICAL · 9.1 score 2 · 1 posthype MOSTLY HYPE · 28 hack
What: Unauthenticated network-accessible remote code/data manipulation in Oracle Siebel CRM Deployment (versions 17.0–26.7), Server Infrastructure component. CVSS 9.1 CRITICAL.
Why it matters: Published 15 Sept 2026, not yet KEV-listed. No public PoC or in-the-wild exploitation confirmed in chatter. Oracle has not issued urgent patches. Social posts are brief, lack technical depth, and mostly echo the CVE description. Early signal but no defender triage activity visible.
Where it's seen: Bluesky posts restating CVSS/affected versions; reference to a third-party CVE aggregator. No vendor advisory, no researcher PoC, no defender questions.
- 17 CVE-2026-69829 CRITICAL · 9.8 score 1 · 1 posthype unscored hack
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
- 18 CVE-2026-69730 CRITICAL · 9.8 score 1 · 1 posthype MIXED · 48 hack
What: Use-after-free in Windows DNS enabling remote code execution (CVSS 9.8 CRITICAL). Affects Windows systems including version 1607.
Why it matters: Critical severity and network-exploitable RCE vector warrant immediate patching. However, CVE not yet KEV-listed; first post conflates this with two other CVEs (CVE-2026-81963, CVE-2026-85880) reportedly exploited in-the-wild, creating attribution confusion. No confirmed PoC or active exploitation signal for CVE-2026-69730 itself isolated from the noise.
Where it's seen: Security researcher and threat intel social posts aggregating Patch Tuesday disclosures. Posts emphasize severity but lack independent exploitation confirmation. One post references suspicious third-party CVE tracker site.
- 19 CVE-2026-83154 CRITICAL · 9.1 score 1 · 1 posthype unscored hack
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
- 20 CVE-2026-83151 CRITICAL · 9.8 score 1 · 1 posthype unscored hack
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- 21 CVE-2026-79993 score 1 · 1 posthype unscored hack
- 22 CVE-2024-3094 CRITICAL · 10.0 EPSS 86% score 1 · 1 posthype MIXED · 42 hack
What: Malicious code injected into xz/liblzma (versions 5.6.0+) via obfuscated build process, enabling data interception in any linked software. CVSS 10.0 CRITICAL, EPSS 0.85.
Why it matters: This is the infamous xz backdoor discovered March 2024—a supply-chain attack that nearly reached production OpenSSH. No KEV listing yet, but the vuln is real, widely analyzed, and patches exist. Social chatter is dominated by post-hoc technical debate (GNU IFUNC blame-shifting) rather than active exploitation signals or new PoCs.
Where it's seen: Hacker News discussion threads recycling analysis; blame-shifting toward GNU IFUNC as "root cause" rather than focusing on xz malware itself; no fresh PoC or in-the-wild exploitation claims in this batch.
- 23 CVE-2026-83104 CRITICAL · 9.1 score 1 · 1 posthype unscored hack
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Forms. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data as well as unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
- 24 CVE-2026-83108 CRITICAL · 9.8 score 1 · 1 posthype unscored hack
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Forms. Successful attacks of this vulnerability can result in takeover of Oracle Forms. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- 25 CVE-2026-85706 CRITICAL · 10.0 KEV score 1 · 1 posthype ACTIVE HACK · 92 hack
What: Unauthenticated path traversal in GitLab CE/EE repository commits API (versions 18.7–19.3.1) enabling arbitrary file read; CVSS 10.0 CRITICAL.
Why it matters: KEV-listed as of 2026-09-11; CISA confirmed active exploitation within hours of disclosure. Patches released (19.1.8, 19.2.6, 19.3.2). In-the-wild reconnaissance probes observed immediately post-patch. No authentication required; affects all self-managed deployments in vulnerable ranges.
Where it's seen: Security news outlets and threat intel platforms reporting confirmed exploitation; CISA advisory; vendor patch releases; defenders triaging urgently across social channels.