IT security 2026-09-02

Level Critical — 83/100 — 2026-09-02

Critical day: 15 stories ranked, 7 of the top 10 reported as actively exploited, 7 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Kestra OSS OS Command Injection Vulnerability (69/100).

1. Kestra OSS OS Command Injection Vulnerability — 69/100 (CVE-2026-49869)
2. JFrog Artifactory Improper Authentication Vulnerability — 68/100 (CVE-2026-82329)
3. Sangoma Switchvox SQL Injection Vulnerability — 67/100 (CVE-2026-9586)
4. SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability — 67/100 (CVE-2026-83548)
5. BerriAI LiteLLM Improper Authentication Vulnerability — 65/100 (CVE-2026-59822)
6. SonicWall SMA1000 Appliances OS Command Injection Vulnerability — 63/100 (CVE-2026-83549)
7. Kludex Starlette HTTP Request/Response Smuggling Vulnerability — 61/100 (CVE-2026-48710)
8. hpe arubaos-cx: Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed inpu… — 30/100 (CVE-2026-73749)
9. CVE-2026-79687 — Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. — 30/100 (CVE-2026-79687)
10. hpe arubaos-cx: A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative acc… — 29/100 (CVE-2026-73778)