Tuesday, August 4, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 22
- Microsoft 1 critical 21
- Unknown 1 critical 19
- HashiCorp 3 critical 12
- Red Hat 10
- TP-Link Systems Inc. 7
- Adobe 6 critical 7
- Eclipse Foundation 7
- Apache 5
- GL-iNet 5 critical 5
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Register Security Google dev kit spurs first-ever agent-on-agent violence
In what they call the first-ever real-world agent-to-agent exploitation method, Pillar Security researchers say they discovered an exploit in the repository behind Google's Agent Development Kit for Python that could allow attackers to compromise supply chains. In other words, now we know that one AI agent can be used to control and compromise another one that has more privileges. The security snafu existed in google/adk-python, an open source Python toolkit with more than 90 million downloads used to build and deploy AI agents. Google has since fixed the underlying issue in the repository…
Also in Dark Reading Malwarebytes Labs SecurityWeek +3
-
CISA Warns of N-able N-central Authentication Bypass Vulnerability Exploited in Attacks
CISA has warned that attackers are actively exploiting a critical authentication bypass vulnerability in N-able N-central. Tracked as CVE-2026-18577 , the flaw affects N-central servers running versions earlier than 2026.3.1.7. N-central is a remote monitoring and management platform widely used by managed service providers to administer customer systems. Because the platform provides centralized access to many endpoint devices, a compromise could enable attackers to move across managed environments. CVE-2026-18577 is classified as an authentication bypass vulnerability via an alternate path…
Also in Rapid7 Blog Dark Reading Bleeping Computer +2
-
Hackers Can Weaponize Microsoft Copilot to Hijack CEO Accounts and Redirect Wire Transfers
A new proof-of-concept reveals how attackers can turn Microsoft Copilot, the AI assistant embedded in Microsoft 365, into an unwitting accomplice for business email compromise (BEC) and large-scale wire fraud. The demonstration shows that a single compromised employee account can escalate, with alarming speed, into full CEO account takeover and the theft of a quarter of a million dollars, with minimal technical effort from the attacker. The attack begins the moment threat actors gain access to a regular employee’s inbox. Rather than relying on traditional “living off the land” techniques like…
Also in 404 Media Cyber Security News The Register Security +3
-
Mallory Unifies Threat Intelligence, Exposure Context, and Response Into One Architecture for Security Teams
Las Vegas, United States, August 4th, 2026, CyberNewswire As AI-assisted attackers compress exploitation timelines to hours, Mallory turns live adversary intelligence into prioritized, policy-governed action across the tools security teams already run Mallory , the AI-native Threat and Exposure Management platform, today introduced a unified context and intelligence layer for security teams. The architecture has three parts: a context graph that correlates attack surface, threat, and vulnerability data; an intelligent reasoning layer that determines what matters and why; and a policy and…
Also in Wiz Research The Hacker News The Hacker News +1
.webp?ssl=1)
-
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect. The campaign has been codenamed SMOKE#SCREEN by Securonix Threat
Also in CCCS Alerts & Advisories
-
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied
Also in Bleeping Computer
-
Bypassing AI guardrails is so easy a script kiddie can do it
If you want to bypass AI guardrails designed to stop models from assisting with cyberattacks, you often just have to ask the right way, according to researchers from Cisco Talos. Simply claiming you own the servers you're targeting or that you're taking part in a capture-the-flag or bug bounty exercise was often enough to persuade models to cooperate. Talos researchers have been poring over prompt logs and artifacts recovered from threat-actor endpoints running tools such as Claude Code, Codex, Cursor, and Gemini to learn how suspected threat actors are abusing LLMs. The big takeaway from…
Also in Infosecurity Magazine
-
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-9198 IBM Langflow Code Injection Vulnerability CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on…
Also in CCCS Alerts & Advisories
-
Apple launches new legal challenge against UK over iCloud access
Seeking to protect users' iCloud accounts, Apple is reportedly mounting a new challenge to British legal demands for ways around the company's Advanced Data Protection feature.
Also in The Hacker News
-
New DOUBLECUP ClickFix service hides malware in browser cache images
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.
Also in SANS Internet Storm Center
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-48323 | Adobe Campaign ClassicAdobe | Critical | 10.0 | 0.6% | — | — | — | EPSS 0.6%CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit t… Attack
Exploitation
|
|||||||||
| CVE-2026-48330 | Adobe Campaign ClassicAdobe | Critical | 10.0 | 0.7% | — | — | — | EPSS 0.7%CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker … Attack
Exploitation
|
|||||||||
| CVE-2026-48331 | Adobe Campaign ClassicAdobe | Critical | 10.0 | 0.5% | — | — | — | EPSS 0.5%CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed. Attack
Exploitation
|
|||||||||
| CVE-2026-48326 | Adobe Campaign ClassicAdobe | Critical | 9.9 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.9 | |
What it isAdobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privil… Attack
Exploitation
|
|||||||||
| CVE-2026-18602 | GL-MT3000GL.iNet | Critical | 9.8 | 2% | — | — | — | EPSS 2%CVSS 9.8 | |
What it isA vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Host… Attack
Exploitation
|
|||||||||
| CVE-2026-41452 | laravel-crmkrayin | Critical | 9.8 | 0.7% | — | — | — | EPSS 0.7%CVSS 9.8 | |
What it isKrayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Reque… Attack
Exploitation
|
|||||||||
| CVE-2026-18612 | GL-MT3000GL-iNet | Critical | 9.8 | 2% | — | — | — | EPSS 2%CVSS 9.8 | |
What it isA flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes comm… Attack
Exploitation
|
|||||||||
| CVE-2026-18613 | GL-MT3000GL-iNet | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isA vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.set_config of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be … Attack
Exploitation
|
|||||||||
| CVE-2026-18614 | GL-MT3000GL-iNet | Critical | 9.8 | 2% | — | — | — | EPSS 2%CVSS 9.8 | |
What it isA vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command in… Attack
Exploitation
|
|||||||||
| CVE-2026-18615 | GL-MT3000GL-iNet | Critical | 9.8 | 2% | — | — | — | EPSS 2%CVSS 9.8 | |
What it isA vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argumen… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
8 Best Password Managers (2026), Tested and Reviewed
Keep your logins locked down with our favorite password management apps for PC, Mac, Android, iPhone, and web browsers.
Also in Bleeping Computer
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.