Wednesday, August 12, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Microsoft 8 critical 483
- Adobe 6 critical 52
- WordPress 1 critical 39
- Unknown 36
- Red Hat 3 critical 31
- MongoDB 25
- Linux 20
- Siemens 1 critical 17
- n8n-io 16
- baptisteArno 1 critical 11
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Record Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery
This month’s update features about five times the volume of patches Microsoft was shipping in a typical month before AI-assisted vulnerability discovery took hold.
Also in Bleeping Computer The Record Bleeping Computer +3
-
Nightmare-Eclipse Drops ShieldBreak Windows Defender 0-day Vulnerability
The prolific and controversial security researcher known as Nightmare-Eclipse (also tracked under the alias Chaotic Eclipse) has released a ninth Windows zero-day exploit called ShieldBreak, and this time the target is Microsoft’s own fix. ShieldBreak demonstrates a complete bypass of the patch Microsoft shipped for RoguePlanet, the Windows Defender elevation-of-privilege flaw tracked as CVE-2026-50656 , proving that the underlying weakness in the Microsoft Malware Protection Engine was never fully closed. RoguePlanet was originally disclosed as a race condition in mpengine.dll, the core…
Also in SecurityWeek Fortinet PSIRT Microsoft Security +3
-
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026. "Kimwolf v7 adds an HTTP/2-based
Also in Bleeping Computer CyberScoop CISA Alerts & Advisories +1
-
CAV3RN Uses Google Apps Script as C2 Relay to Hide Malware Traffic Behind Google Infrastructure
CAV3RN is a modular espionage framework that is becoming harder to see on a network. Its newest communication component hides remote-control traffic behind Google Apps Script, a service many organizations use legitimately. That design can make a harmful connection look less unusual at first glance. The framework has been used against targets in Israel and has continued to gain new components. Researchers have not described the initial infection route in this update, but once installed, its modules can exchange messages, collect software details, receive tasks, and update parts of the toolkit…
Also in CCCS Alerts & Advisories Cyber Security News Kaspersky Securelist
-
Top 10 Best Business VPN Solutions in 2026
The best business VPN solutions in 2026 are increasingly the ones that aren’t traditional VPNs at all. Twingate and Tailscale lead for modern least-privilege remote access, Cisco Secure Client (AnyConnect) and Palo Alto GlobalProtect remain the enterprise incumbents, and NordLayer offers the most approachable published pricing for small teams. A business VPN encrypts remote connections into your corporate network but because traditional VPN appliances have become a primary target for attackers, modern organizations are shifting toward Zero Trust architecture principles to restrict access by…
Also in Zero Day Initiative CCCS Alerts & Advisories
-
Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development
AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage dependencies, prioritize fixes, and control risk at human speed. When software output jumps 10 to 50 times, the problem is no longer just finding vulnerabilities. It is keeping security from becoming the bottleneck, or worse, losing control of what gets shipped.
Also in Microsoft Security Microsoft Security Blog CyberScoop
-
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild. The high-severity flaw, tracked as CVE-2026-20349 (CVSS score: 8.6), is a case of insufficient error checking when processing HTTP requests that could allow an unauthenticated, remote attacker to trigger
Also in Bleeping Computer Cisco Security Advisories
-
Top 10 Best DDoS Protection Services in 2026
Cloudflare is the best DDoS protection service for most organizations in 2026, scoring highest in our evaluation on the combination of network capacity, always-on mitigation speed, and cost predictability it publicly absorbed a record 31.4 Tbps attack in Q4 2025 without metering customers for the privilege. Akamai Prolexic scores highest for enterprise scrubbing, and AWS Shield leads for AWS-native estates. DDoS protection services detect and filter denial-of-service traffic before it exhausts your bandwidth or servers. Here are the ten best, scored. The 2026 DDoS Protection Scorecard Each…
Also in The Register Security Bleeping Computer
-
Ivanti EPM Update Patches Remotely Exploitable Flaws
The vulnerabilities could be exploited to leak credentials for external SQL connections or crash an agent service.
Also in CCCS Alerts & Advisories
-
ClickFix Attack Abuses Signed IBM SPSS IDE to Deploy New CNCMachineRMS RAT
ClickFix campaigns are once again turning an ordinary user action into the opening move of a serious intrusion. A newly documented chain uses a fake fix prompt to lead victims toward CNCMachineRMS, a previously undocumented remote access trojan that gives an attacker lasting control of a Windows device. The campaign stands out because it hides behind software that is both legitimate and signed. After the ClickFix lure, attackers launch IBM SPSS WinWrap Basic IDE and steer its scripting function toward malicious files, allowing the activity to blend in with trusted software rather than an…
Also in CCCS Alerts & Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-58231 | SAP Commerce Cloud (Data Hub Adapter)SAP | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isSAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execut… Attack
Exploitation
|
|||||||||
| CVE-2026-58115 | SIMATIC IoT2050 AdvancedSiemens | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). Affected devices do not enforce authentication on the Node-RED HTTP interface, all… Attack
Exploitation
|
|||||||||
| CVE-2026-48056 | streamberttruelockmc | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isStreambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to e… Attack
Exploitation
|
|||||||||
| CVE-2026-17061 | SIMULIA Execution EngineDassault Systèmes | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution. Attack
Exploitation
|
|||||||||
| CVE-2026-48362 | ColdFusion 2025Adobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploi… Attack
Exploitation
|
|||||||||
| CVE-2026-27302 | Adobe Campaign ClassicAdobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. E… Attack
Exploitation
|
|||||||||
| CVE-2026-71398 | Adobe Campaign ClassicAdobe | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isAdobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. E… Attack
Exploitation
|
|||||||||
| CVE-2026-45618 | liquidjsharttle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isLiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue. Attack
Exploitation
|
|||||||||
| CVE-2026-72603 | wg-easywg-easy | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAn OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client … Attack
Exploitation
|
|||||||||
| CVE-2026-48765 | typebot.iobaptisteArno | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isTypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuth… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Chrome adopts what may be the best protection yet against account takeovers
Google’s Chrome browser has added a new feature that could go a long way in preventing a form of account takeover that’s grown increasingly common as users adopt two-factor authentication, passkeys, and similar protections. The new Chrome protection is known as device-bound session credentials (DBSCs). The measure stores a unique encryption key in a silicon-resident fortress that’s built into the device running the browser. On Windows machines, this fortress is called a TPM, short for Trusted Platform Module. On macOS and iOS, it’s known as a secure enclave. Other platforms have differing…
Also in Malwarebytes Labs
-
CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)
Overview Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the second vulnerability in this chain, the RCE vulnerability CVE-2026-63520. The first vulnerability in the chain, CVE-2026-55040, was disclosed by Rapid7 and Microsoft last month. Our full disclosure timeline for the exploit chain can be seen below in Figure 1. Figure 1: The road to…
Also in Microsoft Security
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.