Monday, September 7, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Browser engines and network edge devices dominate Sunday's disclosures, with Google Chrome carrying three critical CVEs (CVE-2026-84353, CVE-2026-84333, CVE-2026-85043) alongside a CVSS 9.8 flaw in Mozilla Firefox and Thunderbird (CVE-2026-84134). Critical CVEs fell 39% to 20 from 33 the prior day, while high-priority CVEs rose 4% to 56, for a total of 76 vulnerabilities. Other notable critical entries include CVE-2026-84147 (CVSS 10) in the Manacle Technologies Multi-tenant ERP System, CVE-2026-79697 and CVE-2026-79698 (CVSS 9.9) in Advantech WISE-6610 series industrial gateways, and CVE-2026-51693 (CVSS 9.8) in the TOTOLINK T6 router. The pattern favors internet-facing and remote-access infrastructure: 10 CVEs are confirmed actively exploited, including SonicWall SMA1000 appliances, PaperCut MF/NG, JFrog Artifactory, Kestra, Sangoma Switchvox, and the Python web stack (Starlette, LiteLLM). Prioritize updating browsers and restricting management interfaces on SonicWall, Advantech, and TOTOLINK devices to trusted networks, and confirm fix status for each product in the vendor advisory before assuming coverage.

  • Google Chrome leads with three critical CVEs (CVSS 9.1 to 9.6) plus one actively exploited flaw, joined by a CVSS 9.8 Mozilla Firefox and Thunderbird vulnerability
  • 20 critical CVEs, down 39% from 33 the prior day
  • 56 high-priority CVEs, up 4% from 54 the prior day
  • Critical flaws in industrial and network edge gear: Advantech WISE-6610 series (CVSS 9.9), TOTOLINK T6 (CVSS 9.8), NEC UNIVERGE IX-R/IX-V (CVSS 9.3), and a CVSS 10 flaw in Manacle Technologies Multi-tenant ERP
  • Check first: Chrome and Firefox deployments, SonicWall SMA1000, PaperCut MF/NG, JFrog Artifactory, and applications built on Starlette or LiteLLM
  • 10 CVEs carry confirmed active exploitation, concentrated in remote-access appliances, print management, CI/CD tooling, and Python web frameworks

Immediate action: Push updates to Google Chrome, Mozilla Firefox, and Thunderbird fleet-wide, and treat SonicWall SMA1000, PaperCut MF/NG, JFrog Artifactory, Kestra, and Sangoma Switchvox as the highest-priority patch targets given confirmed exploitation. Development teams should inventory services using Starlette and LiteLLM and update them promptly. Confirm fix status and affected version ranges for each product in the vendor's advisory, and restrict exposed management interfaces on Advantech, TOTOLINK, and NEC devices until updates are applied.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation