DEV Community: Freedom Coder

CVE-2026-42018: JFrog Artifactory Improper Authentication Vulnerability

Freedom Coder — Fri, 11 Sep 2026 22:06:06 +0000

CVE ID

CVE-2026-42018

Vulnerability Name

JFrog Artifactory Improper Authentication Vulnerability

Project: JFrog
Product: Artifactory

Date

Date Added: 2026-09-11
Due Date: 2026-09-25

Description

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Additional Notes

https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42018

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-42016: JFrog Artifactory Incorrect Authorization Vulnerability

Freedom Coder — Fri, 11 Sep 2026 22:03:36 +0000

CVE ID

CVE-2026-42016

Vulnerability Name

JFrog Artifactory Incorrect Authorization Vulnerability

Project: JFrog
Product: Artifactory

Date

Date Added: 2026-09-11
Due Date: 2026-09-25

Description

JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

Freedom Coder — Fri, 11 Sep 2026 22:01:05 +0000

CVE ID

CVE-2026-84869

Vulnerability Name

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

Project: ConnectWise
Product: ScreenConnect

Date

Date Added: 2026-09-11
Due Date: 2026-09-14

Description

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-84869

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2021-38003: Google Chromium V8 Memory Corruption Vulnerability

Freedom Coder — Fri, 11 Sep 2026 11:30:03 +0000

CVE ID

CVE-2021-38003

Vulnerability Name

Google Chromium V8 Memory Corruption Vulnerability

Project: Google
Product: Chromium V8

Date

Date Added: 2021-11-03
Due Date: 2021-11-17

Description

Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply updates per vendor instructions.

CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability

Freedom Coder — Fri, 11 Sep 2026 01:07:47 +0000

CVE ID

CVE-2026-87491

Vulnerability Name

Google Chromium V8 Out of Bounds Write Vulnerability

Project: Google
Product: Chromium V8

Date

Date Added: 2026-09-09
Due Date: 2026-09-23

Description

Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87491

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2025-25249: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Freedom Coder — Fri, 11 Sep 2026 01:06:06 +0000

CVE ID

CVE-2025-25249

Vulnerability Name

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Project: Fortinet
Product: Multiple Products

Date

Date Added: 2026-09-09
Due Date: 2026-09-12

Description

Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://fortiguard.fortinet.com/psirt/FG-IR-25-084 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-25249

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Freedom Coder — Fri, 11 Sep 2026 01:04:25 +0000

CVE ID

CVE-2026-19490

Vulnerability Name

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Project: Citrix
Product: NetScaler

Date

Date Added: 2026-09-09
Due Date: 2026-09-12

Description

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-19490

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-67277: MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

Freedom Coder — Fri, 11 Sep 2026 01:02:45 +0000

CVE ID

CVE-2026-67277

Vulnerability Name

MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

Project: MikroTik
Product: RouterOS

Date

Date Added: 2026-09-10
Due Date: 2026-09-13

Description

MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://mikrotik.com/supportsec/september-2026-vulnerability/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-67277

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-86060: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

Freedom Coder — Fri, 11 Sep 2026 01:01:03 +0000

CVE ID

CVE-2026-86060

Vulnerability Name

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

Project: MikroTik
Product: RouterOS

Date

Date Added: 2026-09-10
Due Date: 2026-09-13

Description

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86060

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Freedom Coder — Thu, 10 Sep 2026 18:32:35 +0000

CVE ID

CVE-2021-42287

Vulnerability Name

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Project: Microsoft
Product: Active Directory

Date

Date Added: 2022-04-11
Due Date: 2022-05-02

Description

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply updates per vendor instructions.

Additional Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-42287

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2021-42278: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Freedom Coder — Thu, 10 Sep 2026 18:30:04 +0000

CVE ID

CVE-2021-42278

Vulnerability Name

Microsoft Active Directory Domain Services Privilege Escalation Vulnerability

Project: Microsoft
Product: Active Directory

Date

Date Added: 2022-04-11
Due Date: 2022-05-02

Description

Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply updates per vendor instructions.

Additional Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-42278

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2023-21674: Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability

Freedom Coder — Wed, 09 Sep 2026 14:38:27 +0000

CVE ID

CVE-2023-21674

Vulnerability Name

Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability

Project: Microsoft
Product: Windows

Date

Date Added: 2023-01-10
Due Date: 2023-01-31

Description

Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply updates per vendor instructions.

Additional Notes

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674; https://nvd.nist.gov/vuln/detail/CVE-2023-21674

Related Security News

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List