Monday, July 27, 2026 · generated · about 3 min read
Morning Brief
Patch today vendors with the most new CVEs today
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Register Security Google goes it alone with a new cybercrime crew taxonomy
Google has created a new taxonomy to describe cybercrime outfits, seemingly abandoning a Microsoft-led effort to create consistent names. The Big G announced its new schema on Saturday in a post that notes its 2022 acquisition of Mandiant and its subsequent incorporation into a new team called the Google Threat Intelligence Group (CTIG). Now that two have become one, Google reckons they need consistent naming conventions to describe cybercrime crews. The result is a two-word schema in which the first word “is a unique and memorable term chosen to represent the specific actor.” If security…
Also in Malwarebytes Labs
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| On CISA KEV 1added in the brief's window | |||||||||
| CVE-2026-16812 | Velocloud OrchestratorArista Networks | Critical | 10.0 | 0.9% | KEV | — | — | KEVEPSS 0.9%CVSS 10.0 | |
What it isVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrit… Attack
Exploitation
|
|||||||||
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-12394 | MemberGlutWordPress | Critical | 9.8 | 0.3% | — | — | — | EPSS 0.3%CVSS 9.8 | |
What it isThe MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compr… Attack
Exploitation
|
|||||||||
| CVE-2026-13714 | Realtyna Organic IDX plugin + WPL Real EstateWordPress | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isThe Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardco… Attack
Exploitation
|
|||||||||
| CVE-2026-64534 | LinuxLinux | Critical | 9.8 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.8 | |
What it isIn the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is ca… Attack
Exploitation
|
|||||||||
| CVE-2026-64535 | LinuxLinux | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isIn the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch… Attack
Exploitation
|
|||||||||
| CVE-2026-55971 | ThriftApache | Critical | 9.8 | 1% | — | — | — | EPSS 1%CVSS 9.8 | |
What it isHeap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. Attack
Exploitation
|
|||||||||
| CVE-2026-13332 | Masteriyo LMSWordPress | Critical | 9.1 | 0.2% | — | — | — | EPSS 0.2%CVSS 9.1 | |
What it isThe Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of an… Attack
Exploitation
|
|||||||||
| CVE-2026-13597 | 微信二维码登陆WordPress | Critical | 9.1 | 0.3% | — | — | — | EPSS 0.3%CVSS 9.1 | |
What it isThe 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to… Attack
Exploitation
|
|||||||||
| CVE-2026-48144 | ThriftApache | Critical | 9.1 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.1 | |
What it isImproper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. Attack
Exploitation
|
|||||||||
| CVE-2026-58023 | ThriftApache | Critical | 9.1 | 1% | — | — | — | EPSS 1%CVSS 9.1 | |
What it isOut-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. Attack
Exploitation
|
|||||||||
| CVE-2026-58662 | ThriftApache | Critical | 9.1 | 1% | — | — | — | EPSS 1%CVSS 9.1 | |
What it isImproper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.