IT security 2026-09-11

Level Critical — 89/100 — 2026-09-11

Critical day: 11 stories ranked, 6 of the top 10 reported as actively exploited, 6 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability (87/100).

  1. GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability — 87/100 (CVE-2026-85706)
  2. ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability — 67/100 (CVE-2026-84869)
  3. MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability — 66/100 (CVE-2026-86060)
  4. MikroTik RouterOS Missing Authentication for Critical Function Vulnerability — 65/100 (CVE-2026-67277)
  5. JFrog Artifactory Incorrect Authorization Vulnerability — 64/100 (CVE-2026-42016)
  6. JFrog Artifactory Improper Authentication Vulnerability — 61/100 (CVE-2026-42018)
  7. apache opennlp: The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGE… — 39/100 (CVE-2026-82617)
  8. CVE-2026-9163 — Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Inf… — 29/100 (CVE-2026-9163)
  9. CVE-2026-88007 — Traefik is an open source HTTP reverse proxy and load balancer. — 28/100 (CVE-2026-88007)
  10. CVE-2026-88056 — Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScrip… — 26/100 (CVE-2026-88056)