Tuesday, July 28, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Apple 56 critical 167
- WordPress 3 critical 45
- Linux 2 critical 19
- Unknown 3 critical 13
- jfrog 11
- Red Hat 8
- vercel 8
- Progress 5
- joomshaper.com 1 critical 5
- Microsoft 5
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost
Microsoft has launched its first cybersecurity-specific model inside MDASH, its multi-model vulnerability identification and remediation harness. The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims the configuration costs 50% less than its current best MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. Access is limited to approved
Also in Infosecurity Magazine Sophos Threat Research Ars Technica Security +2
-
Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local
Also in CISA Alerts & Advisories CISA ICS Advisories The Register Security
-
Tons of Peoples’ Claude Chats and Creations are Exposed on Google
Claude is exposing a wealth of users’ chats and creations in Google search results, meaning anyone can dig through conversations or other material that people used Claude to make but may not have realized were publicly available for strangers to see.
Also in Malwarebytes Labs Dark Reading Malwarebytes Labs
-
ABB KNX Update Tool
View CSAF Summary ABB has been contacted by a researcher who identified a vulnerability in one of its products. ABB has been contacted by a researcher who identified a vulnerability in one of its products. The vulnerability report has been shared in responsible disclosure. An attacker who successfully exploited this vulnerability could cause the product to become unusable. ABB confirms the vulnerability but at the same time acknowledges that the issue affects exclusively classic KNX devices that are not supporting the latest KNX Secure standard. Due to a lack of security in legacy KNX…
Also in CISA ICS Advisories
-
Siemens Desigo CC
View CSAF Summary OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Desigo CC are affected: Desigo CC family V7 vers:all/* (CVE-2025-15467) Desigo CC family V8 vers:all/* (CVE-2025-15467) Desigo…
Also in CISA ICS Advisories
-
Siemens SIMATIC S7-PLCSIM Advanced
View CSAF Summary SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens SIMATIC S7-PLCSIM Advanced are affected: SIMATIC S7-PLCSIM Advanced vers:all/* (CVE-2026-54429) CVSS Vendor Equipment Vulnerabilities v3 7.4 Siemens Siemens SIMATIC S7-PLCSIM Advanced Allocation of Resources Without Limits or Throttling Background Critical Infrastructure Sectors: Critical…
Also in CISA Alerts & Advisories CISA ICS Advisories CISA ICS Advisories
-
igloohome Smart Lock Mobile Application
View CSAF Summary Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. The following versions of igloohome Smart Lock Mobile Application are affected: Smart Lock Mobile Application (Android) 3.2.3 (CVE-2026-16581) CVSS Vendor Equipment Vulnerabilities v3 5.3 igloohome igloohome Smart Lock Mobile Application Inclusion of Sensitive Information in Source Code Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Singapore Vulnerabilities Expand All +…
Also in CISA ICS Advisories
-
MikroTik RouterOS and Cloud Hosted Router
View CSAF Summary Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access. The following versions of MikroTik RouterOS and Cloud Hosted Router are affected: RouterOS vers:all/* (CVE-2026-16347) Cloud Hosted Router vers:all/* (CVE-2026-16347) CVSS Vendor Equipment Vulnerabilities v3 8.8 MikroTik MikroTik RouterOS and Cloud Hosted Router Improper Restriction of Excessive Authentication Attempts Background Critical Infrastructure Sectors: Information Technology, Commercial Facilities Countries/Areas Deployed: Worldwide…
Also in CISA ICS Advisories
-
Arista patches actively exploited VeloCloud bug as CISA puts admins on the clock
A critical flaw in Arista's VeloCloud Orchestrator has gone from zero to KEV in short order, with the networking giant confirming attackers are already exploiting it. The vulnerability, tracked as CVE-2026-16812, carries a maximum CVSS score of 10.0 and affects VeloCloud Orchestrator On-Prem, the self-hosted version of the software that enterprises use to centrally manage VeloCloud software-defined wide area networks (SD-WANs) connecting branch offices, datacenters, and clouds environments. According to Arista's security advisory, the flaw is an OS command injection vulnerability that allows…
Also in The Hacker News
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-16812 | Velocloud OrchestratorArista Networks | Critical | 10.0 | 0.9% | KEV | — | — | KEVEPSS 0.9%CVSS 10.0 | |
What it isVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrit… Attack
Exploitation
|
|||||||||
| CVE-2026-11756 | Station Launcher App in 3DEXPERIENCE platformDassault Systèmes | Critical | 10.0 | 0.4% | — | — | — | EPSS 0.4%CVSS 10.0 | |
What it isA Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution. Attack
Exploitation
|
|||||||||
| CVE-2026-48030 | pheditorpheditor | Critical | 9.9 | 2% | — | — | — | EPSS 2%CVSS 9.9 | |
What it isPheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS command… Attack
Exploitation
|
|||||||||
| CVE-2026-61511 | vBulletinvBulletin | Critical | 9.8 | 1% | — | — | — | EPSS 1%CVSS 9.8 | |
What it isvBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code… Attack
Exploitation
|
|||||||||
| CVE-2026-65879 | SP Page Builder extension for Joomlajoomshaper.com | Critical | 9.8 | 0.3% | — | — | — | EPSS 0.3%CVSS 9.8 | |
What it isJoomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms. Attack
Exploitation
|
|||||||||
| CVE-2026-51303 | Apple | Critical | 9.8 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.8 | |
What it isA use-after-free (UAF) vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListDelete and then subsequently accesses the dangling pointer of … Attack
Exploitation
|
|||||||||
| CVE-2026-63077 | TeamCityJetBrains | Critical | 9.8 | 0.7% | — | — | — | EPSS 0.7%CVSS 9.8 | |
What it isIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol Attack
Exploitation
|
|||||||||
| CVE-2026-55579 | pheditorpheditor | Critical | 9.8 | 0.6% | — | — | — | EPSS 0.6%CVSS 9.8 | |
What it isPheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a … Attack
Exploitation
|
|||||||||
| CVE-2026-28911 | MacosApple | Critical | 9.8 | 0.3% | — | — | — | EPSS 0.3%CVSS 9.8 | |
What it isThe issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to corrupt memory of a system process. Attack
Exploitation
|
|||||||||
| CVE-2026-28928 | IpadosApple | Critical | 9.8 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.8 | |
What it isA use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.