60
60
The Apple Security Update Review for September 2026
Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.
ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.
75
Containers on fire: from container escapes to supply chain attacks
60
60
60
60
60
60
Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS
60
60
60
60
60
Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection
Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.
Okta disclosed on September 8, 2026 three vulnerabilities: CVE-2026-85982, a CVSS 9.0 stored XSS in Auth0 AD/LDAP Connector before 8.0.0; CVE-2026-78626, a CVSS 8.1 Protected Rule authorization bypass in Access Gateway before 2026.9.1; and CVE-2026-78623, a CVSS 7.7 SQL injection in Access Gateway advanced-mode datastores. Exploitation requires authenticated access and specific configurations. Fixes require upgrading the connector to 8.0.0+ and Access Gateway to 2026.9.1+.
62
Dell Secure Connect Gateway Vulnerabilities Allow Hackers to Gain Unauthorized Access
Dell patches three critical flaws (CVSS up to 9.8) in Secure Connect Gateway 5.0 enabling admin token replay, unauthenticated RCE, and root escalation.
Dell disclosed three critical vulnerabilities in Secure Connect Gateway 5.0 appliance and application deployments. CVE-2026-80172 (CVSS 9.8) lets unauthenticated attackers replay captured requests, which lack nonce validation and time limits, to repeatedly mint administrator access and refresh tokens. CVE-2026-61410 (9.4) is a missing-authorization flaw enabling unauthenticated remote command execution, and CVE-2026-80238 (9.3) is an exposed Docker socket allowing local privilege escalation to root and container escape. Fixes ship in appliance 5.36.00.16 and application 5.36.00.00.
68
60
60
60
60
60
60
60
February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January
60
60
60
60
60
BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
60
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero
60
⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
60
60
60
60
60
60
60
HPE Issues Critical Security Patches for Aruba Access Point Vulnerabilities
60
60
60