Executive assessment
Today's brief leads with Check Point CVE-2026-91843 unauthenticated root RCE in management and log servers. All 15 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Finding 06 should lead today because it is critical unauthenticated remote code execution with in-the-wild exploitation and a fixed Chamilo LMS 2.0.1 release listed. That gives security leads the clearest immediate action before the broader set of critical and PoC-backed issues. Themes: Unauthenticated RCE and account takeover; PoC or active exploitation; Management-plane and OT isolation. Patch order: Finding 06 (Critical unauthenticated remote code execution is being exploited in the wild, and Chamilo LMS 2.0.1 is fixed); Finding 03 (Critical Grav vulnerabilities have PoC exploitation and a fixed Grav 2.0.16 release); Finding 01 (Critical unauthenticated root RCE affects Check Point management and log servers, with LivePatch takes available); Finding 04 (Critical SQL injection has PoC exploitation and no fixed version listed, making the documented input restrictions urgent until an upgrade path is confirmed); Finding 02 (Critical Unbound DNSSEC validator RCE can be triggered via a malicious DNS zone, and Unbound 1.26.1 is fixed).
Finding 01 — Check Point CVE-2026-91843 unauthenticated root RCE in management and log servers
What changed: Check Point advisory sk1000155 (via NHS England cyber alert CC-4854): CVE-2026-91843 is a stack-based buffer overflow that permits unauthenticated remote code execution with root privileges on affected Check Point management and log servers; CVSS v3.1 is 9.8.
Technical evidence: CVE-2026-91843; CVSS v3.1 9.8; weakness CWE-121; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Restrict Trusted Clients (GUI clients) to trusted IP addresses/subnets and do not use "Any" as a Client Type. Monitor SmartConsole Audit and Admin login logs for "Administrator failed to log in: Username too long". ([support.checkpoint.com](https://support.checkpoint.com/results/sk/sk1000155), [community.checkpoint.com](https://community.checkpoint.com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/td-p/282409/jump-to/first-unread-message))
Affected: R82.20; R82.10 Jumbo Hotfix Take 44 or lower; R82 Jumbo Hotfix Take 126 or lower; R81.20 Jumbo Hotfix Take 166 or lower; R81.10 Jumbo Hotfix Take 190 or lower (EoS). ([support.checkpoint.com](https://support.checkpoint.com/results/sk/sk1000155))
Fix: Check Point LivePatch: take 29 for R82.20; take 28 for R82.10, R82 and R81.20. ([support.checkpoint.com](https://support.checkpoint.com/results/sk/sk1000155))
Panel assessment: Patch now: this is unauthenticated remote code execution as root on Check Point management and log servers, so any reachable affected server has high blast radius even though exploitation is not reported. The likely path is a crafted GUI/admin login attempt using an overlong username, reaching the management or log server itself and therefore the security-management plane and log data it holds. (priority: patch now)
Action: Map CVE-2026-91843 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: digital.nhs.uk](https://digital.nhs.uk/cyber-alerts/2026/cc-4854)
Finding 02 — Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
What changed: Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trigger it, enabling remote code execution.
Technical evidence: CVE-2026-81642; CVSS v4.0 9.1; weakness CWE-122; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: CISA's ADP Vulnrichment marks exploitation as 'none'. ([nlnetlabs.nl](https://nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt), [raw.githubusercontent.com](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81642.json))
Affected: Unbound up to and including version 1.26.0. ([nlnetlabs.nl](https://nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt))
Fix: Unbound 1.26.1. ([nlnetlabs.nl](https://nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt))
Action: Map CVE-2026-81642 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: thehackernews.com](https://thehackernews.com/2026/09/critical-unbound-dnssec-validator-flaw.html)
Finding 03 — Multiple vulnerabilities in Grav
What changed: CVE coverage: CVE-2026-61449, CVE-2026-75837, CVE-2026-75834, CVE-2026-75827, CVE-2026-75828, CVE-2026-74907, CVE-2026-72695, CVE-2026-72697, CVE-2026-76839, CVE-2026-76846, CVE-2026-72698, CVE-2026-72701, CVE-2026-72702, CVE-2026-75831, CVE-2026-72832, CVE-2026-69089, CVE-2026-69088. The cited advisories disclose: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer; Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin; Single invalid UTF-8 byte disables every rule in Security::detectXss , bypassing the page-content XSS safety gate; Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write; detectXss misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS; Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server; Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion; media_directory Twig function allows filesystem path traversal and file content disclosure from sandboxed page content; UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet; The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths; Non constant time nonce comparison in Utils::verifyNonce used for CSRF protection; Origin validation bypass in Uri::referrer and Pages::referrerRoute via unanchored prefix match; Stored XSS via Markdown audio/video media URL; Stored XSS via quoted-attribute bypass in detectXss; Path Traversal in ImageMedium::watermark — arbitrary file disclosure via publicly-cached images; Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure.
Technical evidence: CVE-2026-75837; CVSS v4.0 9.3; weakness CWE-269; technical confidence Medium.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until patching, disable the optional plugin-asset-map.php static-asset fast path and disable twig_content.process_enabled and twig_content.config_access. Temporarily remove page-editing, blueprint-configuration, media-management and delegated admin.users permissions from non-essential accounts. The getgrav/grav GitHub security advisories publish a live PoC and report reproduction against Grav 2.0.11. ([github.com](https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m), [github.com](https://github.com/getgrav/grav/security/advisories/GHSA-xjw5-q542-3vmr), [github.com](https://github.com/getgrav/grav/security/advisories/GHSA-f8wv-xp27-6gq7), +3 more)
Affected: Grav <= 2.0.15. ([github.com](https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55))
Fix: Grav 2.0.16. ([github.com](https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55))
Action: Map CVE-2026-75837 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-8h9x-89f2-m7x3)
Finding 04 — Marten's LINQ provider has SQL injection via unescaped string literals
What changed: GitHub Advisory Database published GHSA-rfx3-98h7-v3xp for CVE-2026-75513: SQL Injection, CVSS v3.1 9.1; affected: Marten versions >= 7.0.0 and <= 9.12.0.
Technical evidence: CVE-2026-75513; CVSS v3.1 9.1; weakness CWE-89; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Until upgrading, do not pass untrusted input as a dictionary indexer key, ContainsKey argument, Select constant, or tenant ID into projection teardown or provisioning. Disable multi-statement command batching to limit blast radius. The Marten maintainers' GitHub advisory reports an executed proof-of-concept demonstrating authorisation bypass and blind data exfiltration. ([github.com](https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp), [github.com](https://github.com/JasperFx/marten/releases/tag/9.13.0))
Affected: Marten versions >= 7.0.0 and <= 9.12.0. ([github.com](https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp))
Action: Map CVE-2026-75513 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: github.com](https://github.com/advisories/GHSA-rfx3-98h7-v3xp)
Finding 05 — Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
What changed: GitHub Advisory Database published GHSA-6j36-r6pr-59x4 for CVE-2026-63472: Improper Authentication, CVSS v3.1 9.1; affected: @vendure/core versions earlier than 3.7.0.
Technical evidence: CVE-2026-63472; CVSS v3.1 9.1; weakness CWE-287; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Until patched, disable external/social AuthenticationStrategy implementations and use only built-in native email/password authentication. If external authentication must remain enabled, accept only provider-verified emails and set verified: true. ([github.com](https://github.com/advisories/GHSA-6j36-r6pr-59x4))
Affected: @vendure/core versions earlier than 3.7.0. ([github.com](https://github.com/advisories/GHSA-6j36-r6pr-59x4))
Fix: @vendure/core 3.7.0. ([github.com](https://github.com/advisories/GHSA-6j36-r6pr-59x4))
Action: Map CVE-2026-63472 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-6j36-r6pr-59x4)
Finding 06 — Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
What changed: GitHub Advisory Database published GHSA-g4c3-4g96-6g4m for CVE-2026-45140: Path Traversal, CVSS v3.1 9.8; affected: Chamilo LMS versions up to and including 2.0.0.
Technical evidence: CVE-2026-45140; CVSS v3.1 9.8; weakness CWE-22, CWE-94, CWE-219, CWE-434; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: If patching is not immediately possible, block unauthenticated access to public/plugin/CStudio/editor/import-project/inc/big-upload.php at the reverse proxy or WAF. Loginsoft Vulnerability Intelligence reports active in-the-wild exploitation. ([github.com](https://github.com/advisories/GHSA-g4c3-4g96-6g4m), [github.com](https://github.com/chamilo/chamilo-lms/commit/4bdba1b9a8820bd70c0809317775d7f6eaa79844), [vi.loginsoft.com](https://vi.loginsoft.com/cve/CVE-2026-45140))
Affected: Chamilo LMS versions up to and including 2.0.0. ([github.com](https://github.com/advisories/GHSA-g4c3-4g96-6g4m))
Fix: Chamilo LMS 2.0.1. ([github.com](https://github.com/advisories/GHSA-g4c3-4g96-6g4m))
Action: Map CVE-2026-45140 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-g4c3-4g96-6g4m)
Finding 07 — Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Settings
What changed: Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs.
Technical evidence: CVE-2026-15688; CVSS v4.0 9.2; weakness CWE-303; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Keep affected workstations within a LAN and block remote login from untrusted networks, hosts and users. Use a firewall or VPN to prevent unauthorised access and permit remote login only to trusted users. ([mitsubishielectric.com](https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-007_en.pdf))
Affected: GX Works3: all versions; Motion Control Setting: all versions. ([mitsubishielectric.com](https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-007_en.pdf))
Panel assessment: Prioritise this week: exploitation is not reported and the attacker needs local execution, but all listed versions are affected and successful abuse reaches control programs, where tampering or deletion can have operational blast radius. The likely path is access to an engineering workstation, including via exposed remote login, then running the affected product, altering its executable module in memory, bypassing the block password, and viewing or changing control logic. (priority: this week)
Action: Map CVE-2026-15688 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-02)
Finding 08 — Multiple vulnerabilities in Hitachi Energy FACTS Control Platform (FCP)
What changed: Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availability of the product.
Technical evidence: CVE-2024-4872; CVSS v3.1 9.9; weakness CWE-943; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Remove direct internet exposure from control-system devices. Place control-system networks behind firewalls and isolate them from business networks. CISA's SSVC assessment reports no evidence of active exploitation and no public proof of concept. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-03), [cisa.gov](https://www.cisa.gov/ssvc-calculator))
Affected: FCP 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-03))
Action: Map CVE-2024-4872 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-03)
Finding 09 — Multiple vulnerabilities in Schneider Electric
What changed: CVE coverage: CVE-2026-13336, CVE-2026-13337, CVE-2025-6625, CVE-2026-13348, CVE-2026-81861. The cited advisories disclose: NetBotz 5 750/755; Modicon M340 Controller and Communication Modules; PowerChute Serial Shutdown; SCADAPack x70 Products.
Technical evidence: CVE-2026-13336; CVSS v4.0 7.3; weakness CWE-78; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Disable FTP on the Modicon modules when unused, firewall unauthorised access to port 21/FTP, and use VPN tunnels for required remote access. For SCADAPack 47x devices, replace Secure Lock with RBAC and enable the RTU firewall service to restrict unauthorised device-service access. ([se.com](https://www.se.com/ww/en/work/support/cybersecurity/security-notifications/), [download.schneider-electric.com](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-05.pdf), [download.schneider-electric.com](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-223-02.pdf), +3 more)
Affected: NetBotz 5 750/755 5.5.2 and prior; PowerChute Serial Shutdown 1.5 and prior; Modicon M340 before SV3.70; BMXNOR0200H before SV1.7 IR27; BMXNGD0100 and BMXNOC0401 all versions; BMXNOE0100 before 3.60. ([se.com](https://www.se.com/ww/en/work/support/cybersecurity/security-notifications/), [download.schneider-electric.com](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-251-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-251-03.json))
Fix: NetBotz 5 750/755 5.6.0; PowerChute Serial Shutdown 1.6; Modicon M340 SV3.70; BMXNOR0200H SV1.7 IR27; BMXNOE0100 3.60; BMXNOE0110 6.80. ([download.schneider-electric.com](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-223-02.pdf), [download.schneider-electric.com](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-223-01.pdf), [download.schneider-electric.com](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-05.pdf))
Action: Map CVE-2026-13336 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-05)
Finding 10 — Vulnerability in Siemens Mendix SAML
What changed: Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.
Technical evidence: CVE-2026-80465; CVSS v3.1 8.7; weakness CWE-347; technical confidence Medium.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Minimise network exposure and ensure affected systems are not internet-accessible. Place them behind firewalls, isolate them from business networks and require an up-to-date VPN for remote access. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-06), [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-887643.html), [aviatrix.ai](https://aviatrix.ai/threat-research-center/siemens-mendix-saml-authentication-bypass-cve-2026-80465/))
Affected: Mendix SAML versions earlier than V3.6.27 for Mendix 9.24, and earlier than V4.2.3 for Mendix 10 and 11. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-06))
Action: Map CVE-2026-80465 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-06)
Finding 11 — Samsung rlottie Stack-based Buffer Overflow Remote Code Execution Vulnerability
What changed: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung rlottie. Interaction with the rlottie library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
Technical evidence: CVE-2026-91826; CVSS v3.1 4.4; weakness CWE-121; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Validate and sanitise vector-animation inputs before processing, restrict file uploads that feed rLottie, and run rLottie in a sandboxed environment. ([feedly.com](https://feedly.com/cve/CVE-2026-91826), [raw.githubusercontent.com](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91826.json), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-91826), +1 more)
Affected: rLottie revision 480a2ad0c5d2e45458c545b8213279e9e8b71e39. ([cve.org](https://www.cve.org/CVERecord?id=CVE-2026-91826))
Fix: Nixpkgs rlottie 0.2-unstable-2026-09-11. ([github.com](https://github.com/NixOS/nixpkgs/pull/563957))
Action: Map CVE-2026-91826 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: zerodayinitiative.com](http://www.zerodayinitiative.com/advisories/ZDI-26-714/)
Finding 12 — Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameter
What changed: GitHub Advisory Database published GHSA-q8hw-4fvp-9rwv for CVE-2026-61793: Improper Input Validation, CVSS v4.0 6.9; affected: nuxt-og-image versions >= 6.0.2 and < 6.7.0.
Technical evidence: CVE-2026-61793; CVSS v4.0 6.9; weakness CWE-20, CWE-441, CWE-749, CWE-918, CWE-1188; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: If patching is delayed, block external access to /_og/d/ and /_og/s/, and set a non-empty security.secret so the existing signature branch is used. GitHub's advisory publishes a one-request, unauthenticated exploit script and reports end-to-end demonstration on a stock installation. ([github.com](https://github.com/advisories/GHSA-q8hw-4fvp-9rwv))
Affected: nuxt-og-image versions >= 6.0.2 and < 6.7.0. ([github.com](https://github.com/advisories/GHSA-q8hw-4fvp-9rwv))
Fix: nuxt-og-image 6.7.0. ([github.com](https://github.com/advisories/GHSA-q8hw-4fvp-9rwv))
Action: Map CVE-2026-61793 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-q8hw-4fvp-9rwv)
Finding 13 — Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
What changed: GitHub Advisory Database published GHSA-hpj9-grjp-7vc7 for CVE-2026-73245: Missing Authentication for Critical Function, CVSS v3.1 6.5; affected: GitHub’s current advisory lists versions before 2.0.0 as affected; CVE.org and NVD instead state versions before 2.0.0-rc6.
Technical evidence: CVE-2026-73245; CVSS v3.1 6.5; weakness CWE-306; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Require authentication for port 8081 management endpoints and bind port 8081 to loopback only; do not expose it to untrusted networks. The Kestra GitHub advisory reports live reproduction on v1.3.29 with basic authentication enabled on the main API. ([github.com](https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-73245), [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-73245))
Affected: GitHub’s current advisory lists versions before 2.0.0 as affected; CVE.org and NVD instead state versions before 2.0.0-rc6. ([github.com](https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7), [cve.org](https://www.cve.org/CVERecord?id=CVE-2026-73245))
Fix: GitHub’s current advisory lists 2.0.0 and later as patched; CVE.org and NVD instead state the issue was fixed in 2.0.0-rc6. ([github.com](https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7), [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-73245))
Action: Map CVE-2026-73245 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-hpj9-grjp-7vc7)
Finding 14 — vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
What changed: GitHub Advisory Database published GHSA-8pw2-6jv3-mj5j for CVE-2026-69147: Uncontrolled Resource Consumption, CVSS v3.1 6.5; affected: vLLM versions earlier than 0.28.0.
Technical evidence: CVE-2026-69147; CVSS v3.1 6.5; weakness CWE-400, CWE-770; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: Block untrusted requests from setting media_io_kwargs.video.video_backend="pynvvideocodec". If dynamic selection is required, permit only CPU/software decoders by default and require an explicit operator allowlist for GPU decoders. ([github.com](https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j), [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-69147))
Affected: vLLM versions earlier than 0.28.0. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-69147))
Fix: vLLM 0.28.0 and later. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-69147))
Action: Map CVE-2026-69147 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-8pw2-6jv3-mj5j)
Finding 15 — Siemens Teamcenter: Cross-site Scripting
What changed: A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious URL. Successful exploitation may enable the attacker to read data or perform actions within the victim's Teamcenter session.
Technical evidence: CVE-2026-58113; CVSS v3.1 6.1; weakness CWE-79; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Minimise network exposure, prevent internet access, place Teamcenter behind firewalls and isolate it from business networks. Use an up-to-date VPN where remote access is required. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07), [cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-157465.html))
Affected: Teamcenter V2412 before V2412.0013; V2506 before V2506.0010; V2512 before V2512.2607; V2606 before V2606.2607. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07))
Fix: V2412.0013 or later; V2506.0010 or later; V2512.2607 or later; V2606.2607 or later. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-157465.html))
Action: Map CVE-2026-58113 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-07)