47
42
47
42
42
42
CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.
A remote attacker can exploit pre-authentication handling of the Openwire protocol to result in queue deletion on affected Apache Artemis and ActiveMQ Artemis brokers. Affected components include artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0 through 2.56.0, and artemis-openwire-protocol 1.0.0 through 2.44.0 plus artemis-jakarta-openwire-protocol 2.32.0 through 2.44.0 in ActiveMQ Artemis. Apache rates the issue important.
45
47
47
47
42
42
42
60
47
42
42
ZDI-26-528: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI advisory ZDI-26-528 discloses CVE-2026-28220, a CVSS 9.9 deserialization RCE in Wazuh's cluster DAPI protocol exploitable by network-adjacent attackers.
Wazuh contains a deserialization-of-untrusted-data flaw in its cluster DAPI protocol, tracked as CVE-2026-28220 with CVSS 9.9. Network-adjacent attackers can execute arbitrary code on affected installations, but must first obtain the ability to execute low-privileged code on a worker node. The vulnerability was disclosed through ZDI advisory ZDI-26-528.
50
47
42
47
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.
Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.
85
42
57
57
47
42
47
ZDI-26-527: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI discloses CVE-2026-44901, a 9.9-rated deserialization RCE in Wazuh cluster DAPI requiring low-privileged code on a worker node.
ZDI-26-527 describes a deserialization of untrusted data flaw in Wazuh's cluster DAPI protocol allowing network-adjacent attackers to execute arbitrary code. Exploitation requires the attacker to first obtain low-privileged code execution on a worker node. ZDI assigned a CVSS score of 9.9, and the flaw is tracked as CVE-2026-44901.
55
42
42
47
42
47
47
42
42
47
47
42