Fix First 10

Ranked daily from confirmed exploitation, not raw CVE counts · updated 22 September 2026

1
▲
CVE-2026-7273 — Zyxel GS1900 Series Switches
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CVSS 8.8EPSS 2.0%CISA deadline 2026-09-24on list 6d
2
▲
CVE-2026-42016 — JFrog Artifactory
JFrog Artifactory Incorrect Authorization Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CISA deadline 2026-09-25on list 6d
3
▲
CVE-2026-42018 — JFrog Artifactory
JFrog Artifactory Improper Authentication Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CISA deadline 2026-09-25on list 6d
4
▼
CVE-2026-76461 — Cisco Secure Email Gateway
Cisco Secure Email Gateway SQL Injection Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CISA deadline 2026-09-17on list 6d
5
–
CVE-2026-87491 — Google Chromium V8
Google Chromium V8 Out of Bounds Write Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CISA deadline 2026-09-23on list 6d
6
NEW
CVE-2025-39964 — Linux Kernel
Linux Kernel Race Condition Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CVSS 7.8EPSS 0.8%CISA deadline 2026-09-21on list 1d
linux
7
NEW
CVE-2026-53266 — Linux Kernel
Linux Kernel Out-of-Bounds Write Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CVSS 8.8EPSS 0.3%CISA deadline 2026-09-21on list 1d
linux
8
–
CVE-2026-85706 — GitLab Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CISA deadline 2026-09-14on list 6d
9
–
CVE-2026-86060 — MikroTik RouterOS
MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CISA deadline 2026-09-13on list 6d
10
–
CVE-2026-67277 — MikroTik RouterOS
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
Do this: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo
CISA deadline 2026-09-13on list 2d

Ranking rule published at /trust/ · data: fixfirst.json