This briefing covers 16 cybersecurity and geopolitics stories published around Sunday, September 6, 2026, and 15 disclosed vulnerabilities (CVE-2026-10196, CVE-2026-32475, CVE-2026-59346, CVE-2026-67281 and others). Each entry links to the original reporting.
Attackers began exploiting an unpatched Magento/Adobe Commerce zero-day on September 4, enabling unauthenticated remote code execution on e-commerce servers, per Sansec. No patch exists, leaving thousands of merchants exposed during peak retail season.
CVE-2026-86167 allows remote OS command injection via the formgponConf function in Tenda HG10 firmware 300001138, with a public exploit already available at CVSS 9.9. Exposed home-gateway devices become footholds for ISP-level network compromise.
CVE-2026-86166 exposes a remotely exploitable buffer overflow in Tenda HG10's formWanRedirect function, publicly disclosed at CVSS 9.0. Clustered with sibling CVEs, the flaws represent a systematic attack surface across Tenda's consumer router line.
CVE-2026-86165 carries a perfect 10.0 severity score, enabling remote buffer overflow via Tenda HG10's formURL function with a public exploit in circulation. Combined with CVE-2026-86166 and CVE-2026-86167, Tenda HG10 is functionally indefensible without vendor patches.
Broadcom patched CVE-2026-59346 (CVSS 9.3), an integer-overflow flaw in VMware Workstation and Fusion letting privileged local attackers execute code on the host OS. VM-escape primitives in hypervisors are high-value targets for ransomware operators and nation-state actors pivoting through virtualized infrastructure.
CVE-2026-32475 (CVSS 9.8), an arbitrary file upload bug in Elementor Pro's form handler, is being actively exploited to compromise WordPress sites. With Elementor Pro installed on millions of sites, mass exploitation at scale is the expected trajectory.
CVE-2026-86153 (CVSS 9.4) allows remote improper privilege escalation via Tenda CP3's SetRedirectEnable function in firmware 27.5.57.101. Part of a same-day cluster of critical Tenda CP3 CVEs, signaling systematic vulnerability research targeting this device line.
CVE-2026-86151 (CVSS 9.4) enables remote OS command injection through Tenda CP3's Network Configuration Management component in firmware 27.5.57.101. Three critical RCE-class flaws disclosed simultaneously across CP3 suggest coordinated research or adversarial reconnaissance of this device family.
CVE-2026-86148 (CVSS 9.4) allows remote OS command injection via the AlarmVoiceURL argument in Tenda CP3's SystemAsh function, firmware 27.5.57.101. Four critical CVEs disclosed across Tenda CP3 and HG10 in 24 hours indicate the product line is under active vulnerability scrutiny with no patches announced.
CVE-2026-67281 lets unauthenticated attackers read arbitrary files from MikroTik RouterOS via a stale pointer flaw in WebFig's /jsproxy path, exploitable through directory-traversal in encrypted URIs.
grav-plugin-api before 1.0.20 lets non-super managers create invitations with dot-keyed super flags that stripSuperFlags() fails to catch, granting full admin access. The bypass exploits a logic gap in flag normalization, meaning any user with api.users.write can self-elevate to superadmin.
grav-plugin-api before 1.0.20 fails to check group-inherited super permissions, allowing api.users.write holders to overwrite superadmin passwords and seize full control. Scored 8.7 HIGH, this pairs with CVE-2026-86195 to form a complete privilege-escalation chain in the same plugin.
AVideo's videoViewsInfo endpoint returns full user records—password hashes, recovery tokens, live session IDs—to anyone supplying a hash parameter, enabling unauthenticated session hijacking including administrator accounts.
AVideo's notify.ffmpeg.json.php accepts an attacker-controlled path and a replayed ciphertext notifyCode—never validated—to write files anywhere on the filesystem without authentication. Arbitrary file write pre-auth is typically a one-step path to remote code execution on affected hosts.
Lara Dashboard before 1.3.0 authenticates any user by email alone via GET /screenshot-login/{email} when APP_ENV is not set to production, handing attackers full session access. Misconfigured staging and dev deployments—routinely exposed to the internet—are directly exploitable with zero credentials.
Mail Mint up to version 1.31.0 deserializes untrusted input in handle_form_submission, and a present POP chain turns the flaw into unauthenticated remote code execution on any WordPress site running the plugin.