Daily Brief - 2026-09-19

2026-09-19 · 5 vulnerabilities · 6 min listen

CVE-2026-69843

critical · CVSS 10 · Microsoft Fabric

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

Authentication Bypass
Privilege Escalation
cloud platform

CVE-2026-84082

critical · CVSS 9.8 · IBM Guardium Data Protection

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

SQL Injection
web application
data protection

CVE-2026-93605

critical · CVSS 10 · vm2

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

Remote Code Execution
Sandbox Escape
nodejs
javascript
sandboxing

CVE-2026-93762

critical · CVSS 9.8 · Mongoid

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.

Information Disclosure
Data Deletion
object-document mapper
database

CVE-2026-93839

critical · CVSS 9.8 · LightLLM

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.

Authentication Bypass
Denial Of Service
machine learning
websockets