SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
CVE Research
Patch Analysis & Exploitation Timeline: Three CVEs, One Deadline, CISA's September 16, 2026 KEV Additions for Google Pixel, Cisco ISE, and Acronis Backup
An analysis of three vulnerabilities added to CISA’s Known Exploited Vulnerabilities Catalog on September 16, 2026, covering Google Pixel, Cisco Identity Services Engine, and Acronis Backup, including their technical impact, vulnerability classifications, and three-day remediation deadlines.
CVE Research
Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately
Plex has released security updates for Plex Media Server and Plex Desktop and is urging users to upgrade immediately. Plex Media Server v1.43.2 and earlier should be moved to version 1.43.3; Plex Desktop should be updated to 1.115.0. CVE identifiers have been requested, and full technical details are not public yet. This article covers the fixed versions, how to update across Windows, macOS, Linux, NAS, Docker, and other platforms, and what administrators should do now.
CVE Research
Active Exploitation Imminent: Two Critical Check Point Flaws (CVE-2026-85102, CVE-2026-85103) Allow Unauthenticated Remote Code Execution on VPN-Enabled Security Gateways and Management Appliances
CVE-2026-85102 and CVE-2026-85103 are critical vulnerabilities in Check Point VPN products that can allow unauthenticated remote code execution. The first flaw involves improper validation of certificate data during VPN negotiation on Security Gateways and Spark Firewalls using Site-to-Site or Remote Access VPN. The second is a heap overflow in ASN.1 certificate decoding that can affect Security Gateways, Security Management Servers, and Spark Firewalls. This article covers how the issues work, the affected products and versions, available LivePatch and Jumbo Hotfix fixes, and temporary Site-to-Site VPN mitigations.
