ZDI publishes ten advisories on 2026-09-16/17: six unpatched 0days (Airbyte, BusyBox, CrewAI, MindsDB, Windows HTTP Proxy) plus Cisco FMC, NoMachine, GIMP and Samsung rlottie flaws

ZDI published ten advisories on 2026-09-16 and 2026-09-17 covering RCE, privilege escalation, SSRF and file-creation flaws with CVSS scores of 5.3-8.8; six are flagged 0day with no vendor patch referenced, including CVSS 8.8 RCEs in CrewAI (CVE-2026-92206),…

The Zero Day Initiative published nine advisories on 2026-09-16 (ZDI-26-703 through ZDI-26-710 plus ZDI-26-713) and one on 2026-09-17 (ZDI-26-714); ZDI-26-711 and ZDI-26-712 do not appear in the reports. Six advisories carry the 0day flag in their titles with no vendor patch referenced: ZDI-26-703 (CVE-2026-92203) and ZDI-26-704 (CVE-2026-92204), both CVSS 7.7, describe server-side request forgery in the _get_shared_drive_object function of Airbyte's SharePoint and OneDrive connectors, each letting authenticated remote attackers trigger arbitrary server-side requests for information disclosure. ZDI-26-705 (CVE-2026-92205, CVSS 6.1) details a symlink directory traversal in BusyBox's libarchive enabling arbitrary file creation, requiring user interaction such as visiting a malicious page or opening a malicious file. ZDI-26-706 (CVE-2026-92206, CVSS 8.8) describes an unsafe reflection remote code execution flaw in the CrewAI framework, exploited when the target loads a malicious agent configuration from the repository. ZDI-26-707 (CVE-2026-92207, CVSS 8.8) covers an authenticated code injection RCE in MindsDB's OpenBBtable feature. ZDI-26-708 details an unpatched local privilege escalation in Microsoft Windows HTTP Proxy (CVSS 5.3) requiring prior low-privileged code execution; no CVE id is listed in that bulletin. Four advisories do not carry the 0day flag and their patch status is not stated: ZDI-26-709 describes unauthenticated deserialization of untrusted data in Cisco Secure Firewall Management Center's CommandSinkRmi component enabling RCE (CVE-2026-20242, CVSS 8.1); ZDI-26-710 describes an unauthenticated, network-adjacent heap-based buffer overflow in NoMachine's mDNS service enabling RCE (CVE-2026-92208, CVSS 8.8); ZDI-26-713 describes a stack-based buffer overflow in GIMP's APNG file parsing enabling RCE (CVE-2026-92183, CVSS 7.8), requiring user interaction such as visiting a malicious page or opening a malicious file; and ZDI-26-714, published 2026-09-17, describes a stack-based buffer overflow in Samsung's rlottie animation library enabling RCE (CVE-2026-91826, CVSS 7.8), where exploitation requires interaction with the library and attack vectors vary by implementation. None of the advisories mention exploitation in the wild or public PoCs. CVSS scores range from 5.3 (Windows HTTP Proxy) to 8.8 (CrewAI, MindsDB, NoMachine mDNS). Source discrepancy: the MindsDB report's summary text cites ZDI-26-708, while its title and points identify the…