#PatchNow

securityonline.info

Pega Platform SAML Authentication Bypass: Critical 9.5 Flaw Patched

TL;DR Pega disclosed a Pega Platform SAML authentication bypass on September 18, 2026. It covers two flaws, one Critical (CVSS 9.5) and one High (CVSS 7.0). Pega has released patches and hotfixes. No compromise has been reported so far. Why This Pega Platform SAML Bypass Matters Pega Platform runs core workflows at many large enterprises, banks, and government agencies. SSO ties those apps to a single sign-on layer.

www.yazoul.net

SW1wZXJpYWwgSGVhbHRoY2FyZSBTb2x1dGlvbnNAcWlsaW4=

www.yazoul.net

bWFua2F0b2NsaW5pYy5jb21AY2hhb3M=

securityonline.info

Synology DSM Patches 8 Flaws, Two Critical Unauthenticated

TL;DR Synology patched eight Synology DSM vulnerabilities in advisory SA_26_13. Two are critical and need no login. Both let a remote attacker read or write files and cause denial of service on DiskStation Manager devices. Why these Synology DSM vulnerabilities matter DiskStation Manager runs Synology NAS devices worldwide. These boxes hold backups, files, and business data. A remote flaw there puts that storage at direct risk.

steelwise.uk

Nobody wants to hack your website. They want to use it | Steelwise

Elementor Pro CVE-2026-32475 lets attackers upload code via ordinary forms. Hacked WordPress sites now run crime operations. What to do, and keep doing.

securityonline.info

WordPress 7.1.1 Fixes 11 Security Flaws, Update Now

TL;DR WordPress 7.1.1 landed as a maintenance and security release. It fixes 11 security issues in the popular CMS, including stored cross-site scripting. The WordPress security team urges site owners to update at once. Why the WordPress 7.1.1 release matters WordPress powers a large share of the web. A single flaw can therefore reach millions of sites. This WordPress security release closes 11 holes at the core level.

cyber.netsecops.io

CISA Adds Actively Exploited Cisco and Acronis Flaws to KEV Catalog

CISA adds two actively exploited vulnerabilities, CVE-2026-76460 in Cisco ISE and CVE-2026-87886 in Acronis Backup, to its KEV catalog, requiring urgent...

securityonline.info

Cisco Patches 18 Secure Firewall Flaws, Several Root RCE

TL;DR Cisco fixed 18 Cisco Secure Firewall vulnerabilities on September 16, 2026. Several are critical and allow remote code execution as root. The flaws span Firewall Management Center, ASA, and Threat Defense software. Why these Cisco Secure Firewall vulnerabilities matter Firewalls guard the edge of nearly every enterprise network. A root compromise there breaks that first line of defense. These Cisco Secure Firewall vulnerabilities include several paths to full device takeover.

securityonline.info

Jenkins Patches 20 Plugin Flaws, Sandbox Bypasses Lead RCE

TL;DR Jenkins fixed 20 plugin vulnerabilities in its September 16, 2026 advisory. Seven of them let attackers break out of the Script Security sandbox and run code on the controller. Most of these Jenkins plugin vulnerabilities are rated high severity. Why these Jenkins plugin vulnerabilities matter Jenkins runs at the heart of many software build pipelines. A controller compromise can poison every build it manages.

steelwise.uk

If you self-host GitLab, patch it today: this one is CVSS 10 | Steelwise

CVE-2026-85706: unauthenticated file read on self-hosted GitLab, CVSS 10, under active attack. Patch to 19.3.2, 19.2.6 or 19.1.8 now.