Wednesday, August 5, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 3 critical 32
- FlowiseAI 18
- Unknown 1 critical 17
- NVIDIA 1 critical 16
- HashiCorp 3 critical 14
- open-webui 12
- Qualcomm 1 critical 11
- Veeam 10
- H3C 8
- Apache 8
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News 1-Click RCE Flaw in Cursor, VS Code, and Google Antigravity Exposes 50M Developers to Cyberattacks
A critical one-click remote code execution (RCE) vulnerability affects three of the world’s most widely used code editors: Cursor, Microsoft VS Code, and Google Antigravity . The flaw, uncovered by AISLE, exposes an estimated 50 million software developers at risk of silent, total system compromise with nothing more than a single click on a malicious link. The vulnerability has since been patched across all three platforms, but its discovery highlights how quickly security flaws can propagate across AI-native developer tooling. 1-Click RCE Vulnerability in Code Editors The exploit hinged on a…
Also in Dark Reading Malwarebytes Labs Proofpoint Threat Insight +3
-
Microsoft Defender Stops QNET Ransomware Attack in 128 Seconds With Automatic Device Isolation
Ransomware can turn one careless click into a business-wide emergency. An incident at QNET shows how quickly that risk can grow when attackers use trusted Windows tools to launch a second stage of an intrusion. The attack began after a user opened a malicious file, likely delivered through email or a browser download. It launched mshta.exe, a legitimate Windows utility, which contacted attacker-controlled infrastructure to collect a remote payload and prepare persistent activity. Microsoft analysts noted that the operation used a living-off-the-land method, meaning it relied on a built-in…
Also in Bleeping Computer Cyber Security News 404 Media +3
-
CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild
Overview On August 2, 2026, N-able published a security advisory for CVE-2026-18577 , an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass issue, CVE-2026-18556 was disclosed. CVE-2026-18577 allows a remote unauthenticated attacker to bypass authentication and obtain administrative control of vulnerable N-central servers in affected deployments. N-able N-central is a widely deployed Remote Monitoring and Management (RMM) platform used by managed service providers (MSPs) and…
Also in Sophos Threat Research Dark Reading Bleeping Computer +2
-
7-Zip Mark-of-the-Web Bypass Lets Malicious Files Evade Windows SmartScreen
Windows can protect users before a suspicious download runs. But a newly documented 7-Zip behavior can remove an important warning layer and allow a malicious program to start without a Windows SmartScreen prompt. ZIP archives are common in phishing campaigns. The gap grows when an archive looks like an invoice, update, or shared document. An attacker sends a link or attachment that leads to an archive, persuades the recipient to extract it with 7-Zip, then relies on the unmarked file being launched. This is not a newly disclosed exploit in 7-Zip code, but a security-control gap caused by the…
Also in The Hacker News Bleeping Computer Microsoft Security
-
Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent. The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied
Also in SecurityWeek CyberScoop Bleeping Computer
-
8 Best Password Managers (2026), Tested and Reviewed
Keep your logins locked down with our favorite password management apps for PC, Mac, Android, iPhone, and web browsers.
Also in Malwarebytes Labs Bleeping Computer
-
Mallory Unifies Threat Intelligence, Exposure Context, and Response Into One Architecture for Security Teams
Las Vegas, United States, August 4th, 2026, CyberNewswire As AI-assisted attackers compress exploitation timelines to hours, Mallory turns live adversary intelligence into prioritized, policy-governed action across the tools security teams already run Mallory , the AI-native Threat and Exposure Management platform, today introduced a unified context and intelligence layer for security teams. The architecture has three parts: a context graph that correlates attack surface, threat, and vulnerability data; an intelligent reasoning layer that determines what matters and why; and a policy and…
Also in Wiz Research The Hacker News The Hacker News +1
.webp?ssl=1)
-
Apple launches new legal challenge against UK over iCloud access
Seeking to protect users' iCloud accounts, Apple is reportedly mounting a new challenge to British legal demands for ways around the company's Advanced Data Protection feature.
Also in Malwarebytes Labs The Hacker News
-
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2026-9198 (CVSS score: 9.8) - A code injection vulnerability in Langflow that allows unauthenticated attackers to achieve full remote
Also in SecurityWeek
-
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect. The campaign has been codenamed SMOKE#SCREEN by Securonix Threat
Also in CCCS Alerts & Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-16618 | Improve SEOWordPress | Critical | 9.8 | 0.2% | — | — | — | EPSS 0.2%CVSS 9.8 | |
What it isThe Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauth… Attack
Exploitation
|
|||||||||
| CVE-2026-14175 | HUMANIST Digital Human ResourcesHashiCorp | Critical | 9.8 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.8 | |
What it isUnrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resource… Attack
Exploitation
|
|||||||||
| CVE-2026-15721 | HUMANIST Digital Human ResourcesHashiCorp | Critical | 9.8 | 0.2% | — | — | — | EPSS 0.2%CVSS 9.8 | |
What it isCleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. Attack
Exploitation
|
|||||||||
| CVE-2026-61514 | IP CameraPuwell Technology Inc. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isPuwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentia… Attack
Exploitation
|
|||||||||
| CVE-2026-61515 | IP CameraPuwell Technology Inc. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isPuwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell i… Attack
Exploitation
|
|||||||||
| CVE-2026-69098 | kotaemonCinnamon | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it iskotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ f… Attack
Exploitation
|
|||||||||
| CVE-2025-29296 | Unknown | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isH3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /… Attack
Exploitation
|
|||||||||
| CVE-2026-63455 | EdgeConnect SD-WAN OrchestratorHP | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isMultiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow… Attack
Exploitation
|
|||||||||
| CVE-2026-63456 | EdgeConnect SD-WAN OrchestratorHP | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isMultiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow… Attack
Exploitation
|
|||||||||
| CVE-2026-24254 | DynamoNVIDIA | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isNVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, da… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.