WordPress 4.6.1 is now available for download. This is a security release for all old versions. It is highly recommendable by WordPress to update your sites immediately.
This security release is addressing two issues which are affecting WordPress 4.6 and older versions. a cross-site scripting vulnerability via image filename and a path traversal vulnerability in the upgrade package uploader.
Besides of the security issue, WordPress 4.6.1 fixes 15 bugs from 4.6.