8 stories · “vulnerability”.
VulnCheck logged reconnaissance-grade exploitation attempts against CVE-2026-61500, a 9.3-rated Rejetto HFS authentication bypass that an AI model helped find.
Atlassian's out-of-band fix for CVE-2026-21589 covers eight self-hosted products, and researchers saw exploitation attempts within two hours of a public PoC.
Microsoft disclosed CVE-2026-85889, a CVSS 10.0 missing-authentication flaw in Azure AI Foundry, on 17 September 2026 and says it is already mitigated.
Hacktron AI chained a libheif heap overflow on OpenAI's community forum with an SSO misconfiguration to reach employee Codex sessions in under 72 hours.
CVE-2026-93993 is a CVSS 8.8 remote-code-execution flaw in Mistral Vibe. Its --worktree flag ran a repo's post-checkout git hook before trust validation.
Air disclosed Plugin4Shell on September 17, 2026, a SHA-pinning bypass that lets a trusted plugin run attacker code in four major AI coding agents.
Cisco disclosed nine Identity Services Engine vulnerabilities on September 16; an unauthenticated 10.0 bypass is already being exploited in the wild.
Cisco disclosed CVE-2026-76461, a 9.8 SQL injection in Secure Email Gateway that is already exploited; CISA set a September 17 patch deadline.
