This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Overview of notable vulnerabilities
below you will find an overview of notable vulnerabilities that we did not have time to cover in more detail: Apache fixes vulnerabilities in Airflow and ZooKeeper [1][2][3][4][5][6][7][8][9][10][11][12][13]. Arista fixes a number of vulnerabilities in its products [14]. Atlassian fixes 161 vulnerabilities in its products [15]. Citrix fixes 2 vulnerabilities in Citrix Workspace app for Windows [16]. CPython contains 2 vulnerabilities [17] [18]. F5 fixes one vulnerability in NGINX Open Source [19]. FRRouting FRR contains one medium-severity vulnerability in versions up to 8.5 [20]. The patch can be found at [21]. GDCM contains 6 vulnerabilities, not yet fixed. Possible mitigations can be found at [22]. GNU fixes 4 vulnerabilities in GNU C Library [23]. Google Chrome/Chromium versions 153.0.8010.47/.48 for Windows and Mac and 153.0.8010.47 for Linux fix a number of vulnerabilities [24]. GRUB2 (grub-efi-amd64-signed) contains 1 low-severity vulnerability [25]. A PoC can be found at [26]. HPE fixes a number of vulnerabilities in various products [27]. Jetty fixes 2 vulnerabilities [28][29]. MCP Atlassian fixes one vulnerability in the mcp-atlassian package (pip) [30]. Microsoft fixes a large number of vulnerabilities in Windows [31]. MikroTik versions 7.22.2 (stable) and 7.21.4 (long-term) fix one vulnerability [32]. MISP version 2.5.46 fixes a critical vulnerability [33] [34]. Mozilla Foundation fixes a number of vulnerabilities with product versions Thunderbird 153.3 [35], Thunderbird 140.16 [36], Thunderbird 156 [37], Firefox ESR 153.3 [38], Firefox ESR 140.16 [39], Firefox ESR 115.41 [40], Firefox 156 [41]. MySQL MCP Server fixes a critical vulnerability in the mysql-mcp-server package (pip) [42]. Nagios XI version 5.9.3 fixes three vulnerabilities [43]. Netbox version 4.7.1 fixes multiple vulnerabilities [44][45]. Open5GS fixes a vulnerability [46]. The patch can be found at [47]. WSO2 API Manager contains a vulnerability (CVE-2026-5430) [48] that has been observed being actively exploited [49].
Links
- [1] https://www.openwall.com/lists/oss-security/2026/09/15/15
- [2] https://www.openwall.com/lists/oss-security/2026/09/15/14
- [3] https://www.openwall.com/lists/oss-security/2026/09/15/13
- [4] https://www.openwall.com/lists/oss-security/2026/09/15/12
- [5] https://www.openwall.com/lists/oss-security/2026/09/15/11
- [6] https://www.openwall.com/lists/oss-security/2026/09/15/10
- [7] https://www.openwall.com/lists/oss-security/2026/09/15/9
- [8] https://www.openwall.com/lists/oss-security/2026/09/15/8
- [9] https://www.openwall.com/lists/oss-security/2026/09/15/7
- [10] https://www.openwall.com/lists/oss-security/2026/09/15/6
- [11] https://www.openwall.com/lists/oss-security/2026/09/15/5
- [12] https://www.openwall.com/lists/oss-security/2026/09/15/4
- [13] https://www.openwall.com/lists/oss-security/2026/09/15/3
- [14] https://www.arista.com/en/support/advisories-notices/securityadvisory
- [15] https://confluence.atlassian.com/security/security-bulletin-september-15-2026-1822852209.html
- [16] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697034&articleTitle=Citrix_Workspace_app_for_Windows_Security_Bulletin_CVE_2026_78546_and_CVE_2026_78547
- [17] https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/
- [18] https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/
- [19] https://my.f5.com/manage/s/article/K000162604?utm_source=f5support&utm_medium=RSS
- [20] https://www.cve.org/CVERecord?id=CVE-2022-42917
- [21] https://github.com/FRRouting/frr/commit/972cdc560e339d70c0ee5fb70ec636ab78f00bca
- [22] https://www.openwall.com/lists/oss-security/2026/09/10/13
- [23] https://www.openwall.com/lists/oss-security/2026/09/14/31
- [24] https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html
- [25] https://www.openwall.com/lists/oss-security/2026/09/13/5
- [26] https://github.com/Luppa90/grub-serial-mmio-lockdown-bypass
- [27] https://support.hpe.com/connect/s/securitybulletinlibrary?language=en_US&archive=false#sort=%40hpescuniversaldate%20descending&layout=table&numberOfResults=25&f:@kmdoclanguagecode=[cv1871440]&hpe=1
- [28] https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
- [29] https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
- [30] https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-489g-7rxv-6c8q
- [31] https://msrc.microsoft.com/update-guide/vulnerability
- [32] https://mikrotik.com/supportsec/cve-2026-52346/
- [33] https://www.cve.org/CVERecord?id=CVE-2026-90961
- [34] https://github.com/MISP/MISP/commit/0ee058548
- [35] https://www.mozilla.org/en-US/security/advisories/mfsa2026-96/
- [36] https://www.mozilla.org/en-US/security/advisories/mfsa2026-95/
- [37] https://www.mozilla.org/en-US/security/advisories/mfsa2026-94/
- [38] https://www.mozilla.org/en-US/security/advisories/mfsa2026-93/
- [39] https://www.mozilla.org/en-US/security/advisories/mfsa2026-92/
- [40] https://www.mozilla.org/en-US/security/advisories/mfsa2026-91/
- [41] https://www.mozilla.org/en-US/security/advisories/mfsa2026-90/
- [42] https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2
- [43] https://www.nagios.com/security-disclosures/nagios-xi/nagios-xi-5-9/
- [44] https://nvd.nist.gov/vuln/detail/cve-2026-86175
- [45] https://nvd.nist.gov/vuln/detail/cve-2026-86176
- [46] https://www.rapid7.com/db/vulnerabilities/cve-2026-90707/
- [47] https://github.com/open5gs/open5gs/commit/ddd683a35f8aaac2b7b9884a24cd53bddfc65238
- [48] https://www.cve.org/CVERecord?id=CVE-2026-5430
- [49] https://www.cisa.gov/news-events/bulletins/sb26-222
By CESNET, z.s.p.o. Táňa Macháčková on 17. 9. 2026.