CISA Adds Four Actively Exploited Vulnerabilities in GitLab, ConnectWise ScreenConnect and JFrog Artifactory to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that they are being actively exploited.
The first issue, CVE-2026-85706, affects GitLab Community Edition and GitLab Enterprise Edition. It is a path traversal vulnerability in the repository commit API that bypasses path restrictions and authentication checks, allowing unauthenticated attackers to read arbitrary files.
The second vulnerability, CVE-2026-84869, impacts ConnectWise ScreenConnect. The flaw resides in authorization and permission management, enabling attackers to transfer and execute files on the host without user confirmation through an active remote session.
CISA has instructed U.S. federal agencies to remediate both GitLab and ScreenConnect issues, including conducting compromise assessments, no later than September 14, 2026.
Two additional vulnerabilities were added for JFrog Artifactory: CVE-2026-42018 and CVE-2026-42016. These authentication-related flaws can result in token disclosure and privilege escalation. Agencies must address them by September 25, 2026.
Related articles
Critical Vulnerability in ConnectWise ScreenConnect Enables Unauthorized File Transfers
ConnectWise has disclosed a serious vulnerability in its remote access product ScreenConnect that allows attackers to transfer and execute files from active remote sessions without requiring authorization or host-side confirmation. The flaw, tracked as CVE-2026-84869, impacts both Support and Access session types and carries a CVSS v3.1 base score of 9.9, placing it in the Critical severity category. The company rated the issue as Important in its three-tier scale and assigned it the highest priority of High. Exploitation of the vulnerability has already been confirmed in the wild, increasing the urgency for organizations using the product. ConnectWise published the security advisory on September 8, 2026, urging users to apply available mitigations promptly. The vulnerability stems from improper handling in the file transfer process within the client component.
Can IDOR Vulnerabilities Be Found Through Static Analysis? New Python Kernel Aims to Answer the Question
A researcher has developed a static analysis module for detecting Insecure Direct Object Reference (IDOR) vulnerabilities in Python web applications. The tool moves beyond simple heuristics by tracking the relationship between user-controlled identifiers, database objects, and authorization checks. It supports Django, Django REST Framework, Flask, and FastAPI, using a custom taint-tracking system called SIAOD to label data origins. Existing approaches such as OpenAPI specifications, broad AST heuristics, Semgrep, and CodeQL were analyzed and found insufficient for capturing the precise semantics of IDOR. Testing on 150 small repositories yielded 48 true positives out of 112 findings, while analysis of 12 million lines of production code from 15 companies produced only five confirmed issues amid hundreds of false positives caused by authorization logic residing outside handler functions. The work demonstrates both the feasibility and current limitations of deterministic static detection for this vulnerability class.
Fuzzy Logic in Cybersecurity: Reducing Vulnerability Queue by 7.5 Times with CVSS, EPSS and FSTEC Comparison
An information security specialist has developed a fuzzy logic system that prioritizes vulnerabilities far more effectively than traditional scoring methods. The approach uses linguistic variables and membership functions to handle the inherent uncertainty in exploitability and impact assessments. By integrating EPSS probability data with CVSS impact scores and vulnerability age, the model reduces the actionable backlog by a factor of 7.5. The implementation relies on the Mamdani inference algorithm and trapezoidal membership functions to produce smooth, human-interpretable urgency ratings. Detailed coverage checks and rule-base validation ensure no gaps exist in the decision space. Real-world testing on CVE-2025-49113 in Roundcube Webmail demonstrated practical advantages over rigid threshold logic. The method is positioned as a practical enhancement rather than a replacement for existing standards.
VLC Media Player Hit by Two Memory Corruption Flaws Exploitable via Malicious PNG and Rogue RealRTSP Server
Two vulnerabilities have been discovered in the VLC media player that allow out-of-bounds memory access. The issues affect versions from 3.0.0 through 3.0.23. CVE-2026-56711, rated 8.6 on CVSS 4.0, stems from an integer overflow when calculating image buffer sizes in PNG files, enabling attackers to trigger writes beyond allocated memory simply by opening a crafted image or loading it from a playlist. CVE-2026-73324, scored 6.9, resides in the RealRTSP module and permits a malicious server to send an oversized response string that causes reads past the end of a buffer due to a missing null terminator. Both flaws are present in official VideoLAN builds, although some distributions may exclude the RealRTSP component. No special configuration or plugins are required to trigger the issues. Until patched releases appear, users are advised to avoid opening images or playlists from untrusted sources and to refrain from connecting to unknown RealRTSP streams.