Monday, August 10, 2026 · generated · about 4 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 47
- code-projects 5
- Apple 4
- Unknown 3
- MingSoft 3
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Apple Private Cloud Compute Flaw Enables Root File Writes and AI Inference Telemetry Leakage
CVE-2026-20685 is a path traversal vulnerability affecting Apple’s Private Cloud Compute (PCC), potentially allowing attackers to write files as root during node boot and redirect sensitive AI inference telemetry to an external server. Sentry Security researcher Drinor received a $150,000 Apple Security Bounty for discovering and reporting CVE-2026-20685, a flaw that could expose sensitive data and allow unauthorized access. PCC is Apple’s server-side platform for Apple Intelligence requests that are too complex to run entirely on an iPhone, iPad, or Mac. Apple describes the system as an…
-
Ransomware Operators Disable EDR, Backup Software and Windows Telemetry Before Encryption
Ransomware crews are increasingly trying to blind a victim before they encrypt anything. Analysis shows that attackers can disable endpoint detection and response tools, interrupt Windows telemetry, and target backup services to reduce the chance that defenders spot or contain the intrusion in time. The findings focus on ten ransomware families that were least often prevented in 2026 testing data. Play had the lowest prevention score at 13 percent, followed by BlackByte at 25 percent, while LockBit, BabLock, Magniber, FAUST, Sodinokibi or REvil, Hive, BlackKingdom, and Maori also featured in…
Also in Cyber Security News The Hacker News
-
Valve Steam Hardware Buyers Hit by CEVA Logistics Data Breach
Valve has confirmed that a cyberattack on CEVA Logistics, its European shipping partner for Steam hardware such as the Steam Deck, Steam Machine, and Steam Controller, exposed customer data belonging to buyers across Europe. The breach occurred between July 29 and August 1, 2026, and Valve says it learned of the compromise on August 7, prompting the company to notify all customers it believes were affected through a direct security email. According to Valve’s disclosure, the attacker likely accessed delivery-related information that CEVA retains for up to ninety days after an order is placed…
Also in Bleeping Computer
-
Payroll Pirates AiTM Phishing Hijacks Microsoft 365 Sessions and Targets Payroll Emails
Payroll Pirates are using phishing emails to seize Microsoft 365 sessions and search payroll-related mailboxes. The campaign turns a voicemail alert into a route for financial fraud, even when multi-factor authentication is enabled. The messages imitate an automated call notification and invite recipients to open a voicemail portal. A click passes through redirect services before reaching a fake sign-in page that relays the real Microsoft login process, as in the new AiTM attack campaign . Arctic Wolf analysts identified activity across healthcare, education, manufacturing, government, and…
Also in The Hacker News
-
Levi Strauss & Co. says hackers stole corporate data in cyberattack
Levi Strauss & Co. (Levi's) says that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines.
Also in SecurityWeek
-
Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was
Also in SecurityWeek
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-19348 | M300 Wi-Fi RepeaterShenzhen Aitemi | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulati… Attack
Exploitation
|
|||||||||
| CVE-2026-19346 | CH22Tenda | High | 8.8 | — | — | — | — | CVSS 8.8 | |
What it isA vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated re… Attack
Exploitation
|
|||||||||
| CVE-2026-19381 | FURY CTRL RGB Control SoftwareKingston | High | 7.8 | — | — | — | — | CVSS 7.8 | |
What it isA security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper priv… Attack
Exploitation
|
|||||||||
| CVE-2026-19387 | Red Hat Enterprise Linux 10Red Hat | High | 7.6 | — | — | — | — | CVSS 7.6 | |
What it isA heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV fil… Attack
Exploitation
|
|||||||||
| CVE-2026-19342 | Task Management Systemcode-projects | High | 7.3 | 0.4% | — | — | — | EPSS 0.4%CVSS 7.3 | |
What it isA vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Password results in improper authentication. … Attack
Exploitation
|
|||||||||
| CVE-2026-19343 | Task Management Systemcode-projects | High | 7.3 | 0.3% | — | — | — | EPSS 0.3%CVSS 7.3 | |
What it isA flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injecti… Attack
Exploitation
|
|||||||||
| CVE-2026-19344 | Task Management Systemcode-projects | High | 7.3 | 0.4% | — | — | — | EPSS 0.4%CVSS 7.3 | |
What it isA vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_count_user.php. The manipulation of the argument task_id leads to sql injection. It i… Attack
Exploitation
|
|||||||||
| CVE-2026-19351 | node-sql-querydresende | High | 7.3 | — | — | — | — | CVSS 7.3 | |
What it isA vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Per… Attack
Exploitation
|
|||||||||
| CVE-2026-19355 | MCMSMingSoft | High | 7.3 | — | — | — | — | CVSS 7.3 | |
What it isA vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead… Attack
Exploitation
|
|||||||||
| CVE-2026-19374 | api-mcpApple | High | 7.3 | — | — | — | — | CVSS 7.3 | |
What it isA security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of t… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.