Overview of notable vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Overview of notable vulnerabilities

below you will find an overview of notable vulnerabilities that we did not have time to cover in more detail: Acronis fixes a high-severity vulnerability in Acronis Backup plugin for cPanel & WHM (Linux), Acronis Backup extension for Plesk (Linux) and Acronis Backup plugin for DirectAdmin (Linux) [1]. CheckPoint fixes a critical vulnerability in Check Point Security Management and Log Servers [2]. Dell fixes multiple vulnerabilities in its products [3]. Drupal fixes a number of vulnerabilities in its products [4]. GNU libextractor version 1.15 fixes a high-severity vulnerability [5]. A PoC can be found at [6]. Google Chrome/Chromium versions 153.0.8010.52/.53 for Windows and Mac and 153.0.8010.52 for Linux fix a number of vulnerabilities [7]. Grafana Labs fixes a high-severity vulnerability in Geomap MapLibre XSS with versions 12.3.0, 13.0.0, 13.1.0, 13.2.0 and 13.2.2 [8]. Imager version 1.036 fixes 2 vulnerabilities [9][10]. Jenkins fixes 20 vulnerabilities [11]. Jetty fixes 3 vulnerabilities with package versions org.eclipse.jetty.http2:http2-common (11.0.32, 10.0.32, 9.4.64), org.eclipse.jetty.http2:jetty-http2-common (12.1.11, 12.1.12), org.eclipse.jetty:jetty-http (12.1.12, 12.0.38, 11.0.32, 10.0.32, 9.4.64), org.eclipse.jetty.websocket:websocket-core-common (12.1.12, 12.0.38, 11.0.32, 10.0.32) [12][13][14]. Linux fixes a critical "guest-to-host escape" vulnerability in the kernel's KVM module [15]. The patch can be found at [16]. Linux fixes the DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) and DiagSpill (CVE-2026-74469) vulnerabilities, which allow local escalation to root privileges [17]. PoCs can be found at [18][19][20][21]. Neuvector versions 5.6.2, 5.5.4 and 5.4.11 fix 5 vulnerabilities in the Go package [22][23][24][25][26]. Nextcloud fixes a vulnerability in Nextcloud and Nextcloud Enterprise [27]. NoMachine fixes 3 vulnerabilities [28][29][30]. Oracle fixes a number of vulnerabilities in its products as part of Patch Tuesday [31]. Rabbitmq-c version 0.18.0 fixes a high-severity vulnerability [32]. Red Hat fixes a number of vulnerabilities in its products [33]. SSH.NET (.NET library) version 2026.0.0 fixes 4 vulnerabilities [34][35][36][37]. Synology fixes 8 vulnerabilities in DSM [38]. WordPress has released version 7.1.1, which fixes 11 vulnerabilities [39].

Links

By CESNET, z.s.p.o. Táňa Macháčková on 18. 9. 2026.

Report feedback

[TLP:CLEAR] Overview of notable vulnerabilities

Links