55
55
55
55
60
30
55
35
55
42
60
55
42
30
55
35
55
30
30
42
30
55
42
55
Critical ArangoDB Bugs Expose Entire Databases and Enable Remote Code Execution as Root
Two critical ArangoDB flaws (CVSS 9.8/9.9) allow unauthenticated API access and root-level code execution; fixed in 3.12.11.
Remedio researchers reported two critical ArangoDB flaws on August 23, 2026: an authentication bypass via URL-encoded underscores (%5f) in path parsing (GHSA-rrgq-978q-36mq, CVSS 9.8) and a task-execution flaw where a client-controlled isSystem flag lets JavaScript run in the internal context (GHSA-rvhw-4hpw-9vrx, CVSS 9.9). Chained, they allow unauthenticated database access, theft of root password hashes, and root-level code execution when arangod runs as root, such as in the official container image. Patches shipped August 31 in ArangoDB 3.12.11, with GitHub Security Advisories published September 6; CVE identifiers were pending at disclosure time.
72
Six Maximum
Cisco patched nine critical flaws, six rated CVSS 10.0, in Crosswork platforms and Secure Workload, none known to be exploited.
Cisco released fixes for nine critical vulnerabilities in its Crosswork platforms and Secure Workload software, discovered during an internal security review that used advanced AI models. Six flaws carry CVSS 10.0 ratings, including SQL injection CVE-2026-20030 and missing authentication CVE-2026-20357 in Crosswork, and access control CVE-2026-20315 and authentication flaws CVE-2026-20317 in Secure Workload. Fixes shipped in Crosswork 7.2.1-SP, Secure Workload 3.10.9.1, and 4.0.4.16. Cisco says no exploitation has been observed.
62
60
60
30
55
30
30
30
55
42
55
Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
Google released Chrome 153 (153.0.8010.47/48) for Windows, macOS, and Linux, patching 42 security vulnerabilities including three rated critical: CVE-2026-91726 (out-of-bounds read in WebGL), CVE-2026-91721 (use-after-free in Internals), and CVE-2026-91749 (use-after-free in Workers). Twenty-eight fixes are rated high severity, covering use-after-free, type confusion, race condition, integer overflow, and authorization flaws across components like V8, Skia, DOM, ServiceWorker, PDF, and Extensions. Google's bulletin indicates no vulnerabilities are currently being exploited in the wild, and external researchers earned rewards up to $1,500 for reported issues. Enterprises are advised to verify fleet-wide deployment via browser-management consoles and enable automatic updates.
55
VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability
ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.
CERT/CC published VU#943094 for a server-side request forgery in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12, tracked as CVE-2026-84282. The /apps/onlyoffice/ajax/settings/address endpoint does not validate the user-supplied document server URL, so an authenticated administrator can make the ownCloud server send arbitrary requests to localhost and internal hosts. Differences in error responses (connection failures vs SSL/TLS errors) let attackers enumerate open and closed TCP ports for internal reconnaissance. The vendor could not be reached, so no official patch is available; CERT recommends disabling the plugin and applying egress filtering until a fix ships.
32
42
55