IT security 2026-09-23

Level Critical — 80/100 — 2026-09-23

Critical day: 19 stories ranked, 4 of the top 10 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Check Point Multiple Products Path Traversal Vulnerability (70/100).

1. Check Point Multiple Products Path Traversal Vulnerability — 70/100 (CVE-2026-93616)
2. F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability — 67/100 (CVE-2026-94127)
3. Check Point Multiple Products Improper Certificate Validation Vulnerability — 67/100 (CVE-2026-85102)
4. Arista VeloCloud Orchestrator Improper Input Validation Vulnerability — 67/100 (CVE-2026-93952)
5. CVE-2026-95848 — Moquette is a lightweight Java MQTT broker. — 36/100 (CVE-2026-95848)
6. CVE-2026-96755 — orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator th… — 36/100 (CVE-2026-96755)
7. broadcom rabbitmq server: RabbitMQ is a messaging and streaming broker. — 35/100 (CVE-2026-67231)
8. claris filemaker server: An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially c… — 35/100 (CVE-2026-86930)
9. CVE-2026-65130 — NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command… — 33/100 (CVE-2026-65130)
10. CVE-2026-89276 — Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vuln… — 31/100 (CVE-2026-89276)