2026-09-15

This month

Web3 Security Vulnerability Disclosures (Last 48 Hours)

Over the past 48 hours, several critical vulnerabilities have been disclosed across key web3 and enterprise security tools. These include path traversal issues in GitLab, improper authentication and a…

RESEARCH: Web3 Security Vulnerability Disclosures (Last 48 Hours)

Summary

Over the past 48 hours, several critical vulnerabilities have been disclosed across key web3 and enterprise security tools. These include path traversal issues in GitLab, improper authentication and authorization flaws in JFrog Artifactory, privilege management gaps in ConnectWise ScreenConnect, and missing authentication vulnerabilities in MikroTik RouterOS. The disclosures highlight ongoing risks to enterprise systems and emphasize the need for rapid remediation.

Key Developments

  • 2026-09-11 — GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability (CVE-2026-85706) that allows an unauthenticated user to read arbitrary files due to improper path confinement and missing authentication enforcement in the repository commits API. CISA Known Exploited Vulnerabilities Catalog
  • 2026-09-11 — JFrog Artifactory has an improper authentication vulnerability (CVE-2026-42018) that could return an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, potentially exposing sensitive resources. CISA Known Exploited Vulnerabilities Catalog
  • 2026-09-11 — JFrog Artifactory also suffers from an incorrect authorization vulnerability (CVE-2026-42016) enabling privilege escalation due to a validation check of the token signature/issuer instead of its scope. CISA Known Exploited Vulnerabilities Catalog
  • 2026-09-11 — ConnectWise ScreenConnect includes both improper privilege management and missing authorization vulnerabilities (CVE-2026-84869) that may allow attackers to perform file transfers and execute code through active remote sessions without authorization. CISA Known Exploited Vulnerabilities Catalog
  • 2026-09-10 — MikroTik RouterOS has a missing authentication vulnerability for the btest service (CVE-2026-67277) that enables kernel memory disclosure and denial of service. CISA Known Exploited Vulnerabilities Catalog
  • 2026-09-10 — MikroTik RouterOS also exhibits an improper neutralization of argument delimiters in a command vulnerability (CVE-2026-86060) leading to privilege escalation. CISA Known Exploited Vulnerabilities Catalog
  • 2026-09-09 — Cisco Secure Firewall Management Center and Security Cloud Control Firewall Management have an authentication bypass vulnerability (CVE-2026-20079) allowing unauthenticated, remote attackers to execute scripts and gain root access. CISA Known Exploited Vulnerabilities Catalog
  • 2026-09-09 — Google Chromium V8 contains an out-of-bounds write vulnerability (CVE-2026-87491) that could enable remote attackers to execute arbitrary code via crafted HTML pages. CISA Known Exploited Vulnerabilities Catalog

Sources