WordPress 4.6.1 Security and Maintenance Release is now available. You can update using your WordPress Dashboard!
WordPress 4.6.1 Bug Fixes:
-a cross-site scripting vulnerability via image filename
-a path traversal vulnerability in the upgrade package uploader
More info about WordPress 4.6.1 at https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/