Thursday, August 13, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- IBM 6 critical 68
- jfrog 25
- Unknown 24
- siyuan-note 22
- Red Hat 4 critical 17
- Apache 17
- WordPress 16
- GitLab 13
- Palo Alto 12
- Microsoft 4 critical 11
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and
Also in SecurityWeek Malwarebytes Labs The Record +3
-
Kimwolf v7 Botnet Uses Chrome Browser Fingerprints to Hide HTTP/2 DDoS Attacks
Kimwolf v7 is raising the stakes for attacks launched from everyday Android TV boxes and set-top devices. The latest version can make disruptive web traffic look more like a real visitor browsing a site, making defensive filtering harder at a critical moment. The botnet has been active under related names since 2024, moving from Linux internet-connected devices to Android targets in 2025. It reaches exposed Android Debug Bridge services through residential proxy networks, allowing attackers to install malware without authentication. Unit 42 said in a report shared with Cyber Security News…
Also in Malwarebytes Labs Bleeping Computer Bleeping Computer +3
-
Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor
Akira ransomware has added a new way to weaken Windows security before it tries to lock files. In a recent intrusion, an affiliate rebooted a compromised system into Safe Mode with Networking, leaving the device connected while most third-party protections stayed offline. The operation began with a credential-spraying attack against an exposed SonicWall SSL VPN that had no multi-factor authentication. A valid account opened the door, after which the intruder used remote desktop access, mapped the network, collected files, and prepared them for upload. This route echoes the risks described in…
Also in SecurityWeek Bleeping Computer Microsoft Security +3
-
Passwords stored in public Google Doc then showed up in search results
PWNED Welcome, once again, to PWNED, the weekly column where we highlight others’ security failures. Hopefully, there’s a lesson in all this, but it could just be “stop shooting yourself in the foot.” Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story today comes courtesy of Siim Kostabi, co-founder of Pageloot, a company that provides QR codes businesses can use for marketing. Kostabi’s tale of tech terror reminds us that credentials, even for a staging server, have a lot of value in the…
Also in Malwarebytes Labs CCCS Alerts & Advisories The Hacker News +1
-
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
The ransomware-as-a-service operation is finding success against critical infrastructure targets with leaked Conti code and old flaws in firewalls and VPN appliances.
Also in SecurityWeek CCCS Alerts & Advisories Infosecurity Magazine +1
-
Critical WordPress RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File
WordPress has released version 7.0.4, a security-focused update that closes a remote code execution vulnerability affecting sites that process images with the Imagick extension and Ghostscript. The WordPress security team is urging site owners to update immediately, either through the Dashboard’s Updates screen or by downloading the release directly from WordPress.org, since sites with automatic background updates should already be receiving the patch. The flaw, tracked as CVE-2026-65640 and detailed in GHSA-8vr3-7mxf-gx8w, was responsibly disclosed by researchers at pwn.ai and allows an…
Also in The Hacker News Sophos Threat Research Infosecurity Magazine +1
-
Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development
AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage dependencies, prioritize fixes, and control risk at human speed. When software output jumps 10 to 50 times, the problem is no longer just finding vulnerabilities. It is keeping security from becoming the bottleneck, or worse, losing control of what gets shipped.
Also in Dark Reading SecurityWeek Microsoft Security +1
-
Critical Adobe Commerce Vulnerabilities Allows Hackers to Execute Arbitrary Code
Adobe has released an urgent security update for Adobe Commerce and Magento Open Source, fixing several vulnerabilities that could allow attackers to bypass security controls, gain higher privileges, and execute arbitrary code. The most serious issue is CVE-2026-71362, an incorrect authorization vulnerability rated 9.1 out of 10 under the CVSS scoring system. The flaw could allow an unauthenticated remote attacker to escalate privileges without requiring administrator access. Adobe classified the vulnerability as critical because it could expose sensitive data and allow attackers to make…
Also in Bleeping Computer CCCS Alerts & Advisories The Hacker News
-
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure. The extensions, published across at least 40 Chrome Web Store developer accounts, racked up 75,486 installs. Of those identified, 274 have been found to impersonate 66
Also in Bleeping Computer Ars Technica Security Malwarebytes Labs
-
Researchers found a way to hijack devices through Zoom screen sharing
As AI models gain advanced capabilities to find vulnerabilities in software, develop ways to exploit them , and even carry out autonomous hacking sprees , researchers offered a sobering new example on Tuesday, disclosing vulnerabilities in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim. Researchers from the digital defense firm A Security…
Also in Malwarebytes Labs The Hacker News
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-73299 | promptyMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isPrompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled … Attack
Exploitation
|
|||||||||
| CVE-2024-27253 | DOORS NextIBM | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isIBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities. Attack
Exploitation
|
|||||||||
| CVE-2026-73263 | prowlerKubernetes | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isProwler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth … Attack
Exploitation
|
|||||||||
| CVE-2026-73294 | semaphoresemaphoreui | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isSemaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{… Attack
Exploitation
|
|||||||||
| CVE-2026-16860 | iIBM | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isIBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element. Attack
Exploitation
|
|||||||||
| CVE-2026-19656 | ScadaLTSSCADA-LTS | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Suc… Attack
Exploitation
|
|||||||||
| CVE-2026-62420 | LXDCanonical | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAn authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via P… Attack
Exploitation
|
|||||||||
| CVE-2026-63293 | LXDCanonical | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symboli… Attack
Exploitation
|
|||||||||
| CVE-2026-63294 | LXDCanonical | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml fi… Attack
Exploitation
|
|||||||||
| CVE-2026-63296 | LXDCanonical | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAn authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without valid… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
ZDI-26-538: (Pwn2Own) Microsoft Exchange Improper Authorization Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of Microsoft Exchange. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-62911.
Also in Microsoft Security Infosecurity Magazine Zero Day Initiative +1
-
ZDI-26-533: Cisco Secure Firewall Management Center login.cgi Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-20316.
Also in CCCS Alerts & Advisories CCCS Alerts & Advisories
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.