Eleven stories ran today, and the loudest of them were loud on the numbers: a 10.0, two 9.9s, a pair of 9.8s on a perimeter VPN appliance, and seventeen CVE records for one project landing in the same minute. None of that is what to deal with first. Two flaws already on CISA’s Known Exploited Vulnerabilities catalog come due Monday, September 14 — ConnectWise ScreenConnect and GitLab — and both carry BOD 26-04’s forensic-triage obligation, which means a federal agency has to remediate inside the window and also determine whether the asset was already compromised. That is about 48 hours, on the weekend, and it is the only thing on today’s wire with a clock attached. A 9.8 with a patch available can wait until Monday morning; these two cannot. The ScreenConnect item is also the one most likely to be misread: the flaw is in the client, not the server, so cloud-hosted customers told “no action is required” for their server still have to update every host client and access agent they run.
The day had a thread, and it was GitLab. One patch release, September 10, produced three separate stories in eighteen hours, and the vendor supplied none of the new facts in any of them. Overnight, the CISA coordinator block attached to the NVD record marked exploitation “active” while GitLab’s own advisory said nothing about exploitation at all. By the afternoon the catalog itself carried Thursday’s addition and Monday’s deadline — a date this site declined to report twelve hours earlier and has since corrected on the story that got it wrong. And by evening the record for a second flaw in the same release, CVE-2026-87719, named the two things the release notes had left out: the entry condition is an authenticated user with Duo Chat access, not an administrator, and what they come away with is Advanced Search instance configurations and credentials.
After the deadlines, the perimeter. Check Point’s two 9.8s let an unauthenticated attacker run code on a VPN appliance, and neither record names a fixed version — the boundary is a Jumbo Hotfix take number, and the Spark appliance line the advisories cover is missing from the records entirely. Frontegg SAML SSO accepts unsigned SAML responses at 9.8 with no fix at all, the plugin having been closed on WordPress.org on September 4. The Events Calendar took three releases to close two unauthenticated 9.8 remote code execution flaws on a plugin installed on more than 600,000 sites, and no changelog line says so.
Below that, three records that describe a flaw better than they describe a remedy. AVideo’s seventeen all draw the affected line at the same git commit hash, with the last tagged release dating to April 2024. vLLM and Socket Firewall make an unflattering pair, because in both the thing that failed was the safeguard: a trust_remote_code flag that vanished into **kwargs, and a firewall that did not verify TLS to the registries it exists to police. Flatpak’s Critical sandbox escape waited 32 days for an identifier, and the one Flatpak CVE issued in the meantime was a different bug.
Still open at the end of the day: NVD’s record for the GitLab 10.0 does not carry cisaExploitAdd or cisaActionDue, so the single most authoritative machine-readable source an operator is likely to query still does not say the flaw is on KEV with a deadline two days out. GitLab has said nothing about exploitation since the patch release. Frontegg has no fixed version to offer, AVideo has no release to upgrade to, and Check Point’s records still omit Spark.