Friday, August 14, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- IBM 3 critical 74
- Elastic 48
- Gitea 47
- Unknown 36
- RsyncProject 1 critical 28
- WordPress 3 critical 24
- Priority 5 critical 9
- FlowiseAI 9
- silabs.com 9
- Tenda 1 critical 9
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Download More RAM Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing
A new attack dubbed “Download More RAM” can bypass Windows Virtualization-Based Security (VBS), weaken Hypervisor-Enforced Code Integrity (HVCI), and disable Microsoft Defender. Microsoft tracked the issue as CVE-2026-23670 and released mitigations in its April 2026 security update. The attack abuses improperly protected Serial Presence Detect (SPD) data on certain consumer DDR4 and DDR5 memory modules. SPD is configuration data stored on a RAM module that specifies the system’s capacity, speed, and operating parameters. If the SPD chip is writable, an attacker with local administrator…
Also in Bleeping Computer The Register Security The Hacker News +3
-
Passwords stored in public Google Doc then showed up in search results
PWNED Welcome, once again, to PWNED, the weekly column where we highlight others’ security failures. Hopefully, there’s a lesson in all this, but it could just be “stop shooting yourself in the foot.” Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story today comes courtesy of Siim Kostabi, co-founder of Pageloot, a company that provides QR codes businesses can use for marketing. Kostabi’s tale of tech terror reminds us that credentials, even for a staging server, have a lot of value in the…
Also in SecurityWeek Infosecurity Magazine Malwarebytes Labs +2
-
Malware Crypter Services Sell Windows Defender, EDR and SmartScreen Bypasses to Cybercriminals
Criminal services that hide malware are becoming easier to buy. These services, known as crypters, change a malicious file so that security tools struggle to recognize it. Their operators promise customers a way around Windows Defender, endpoint detection and response tools, and Microsoft SmartScreen. The change helps attackers move familiar malware past controls that would otherwise flag it early. The danger is not a single new malware family. It is a commercial layer that helps many kinds of malware reach victims with less scrutiny. Criminals can package remote access tools, stealers, or…
Also in Kaspersky Securelist Cyber Security News Microsoft Security +3
-
HACKERAI Malware Turns GitHub Gists Into a Command-and-Control Channel
A newly identified malware framework called HACKERAI C2 Agent is using GitHub Gists as a hidden channel for attacker commands and stolen data. The technique lets operators blend malicious traffic with a service that many organizations allow on their networks. The malware appeared during an investigation into a wider espionage campaign aimed at telecom, government, defense, energy, and critical infrastructure organizations in South Asia. Victims were lured with files that impersonated trusted telecom services, government updates, and software installers. Researchers at Acronis identified…
Also in Bleeping Computer Wiz Research
-
AWS key exposed in JavaScript may have lit way to Beacon's charity data
Beacon, a CRM provider for charities and nonprofits, says an AWS access key "potentially exposed in public JavaScript build artifacts" is the leading suspect in its July breach. The revelation came in the company's first update on the attack in more than a week. If the access key was exposed in public build artifacts, it raises questions about why Beacon's development pipeline and code review controls failed to catch it. Beacon used stronger wording about the potential data loss, confirming that a copy of the database was made and assessing that it was probably downloaded in readable form…
Also in SecurityWeek Infosecurity Magazine
-
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
The ransomware-as-a-service operation is finding success against critical infrastructure targets with leaked Conti code and old flaws in firewalls and VPN appliances.
Also in CCCS Alerts & Advisories Infosecurity Magazine CISA Alerts & Advisories +1
-
In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities
Noteworthy stories that might have slipped under the radar: government AI platform deal sparks outrage, North Korean IT worker breaches federal agency, DEF CON attendee blamed for Delta flight disruption.
Also in CCCS Alerts & Advisories
-
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulnerability in ColdFusion that could
Also in SecurityWeek CCCS Alerts & Advisories
-
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild. The high-severity flaw, tracked as CVE-2026-20349 (CVSS score: 8.6), is a case of insufficient error checking when processing HTTP requests that could allow an unauthenticated, remote attacker to trigger
-
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026. "Kimwolf v7 adds an HTTP/2-based
Also in Malwarebytes Labs CyberScoop
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-15413 | Link FactoryWordPress | Critical | 10.0 | 0.3% | — | — | — | EPSS 0.3%CVSS 10.0 | |
What it isThe Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a h… Attack
Exploitation
|
|||||||||
| CVE-2026-59500 | Portal Generator addon to Priority ERP (developed by Soft Solutions)Priority | Critical | 10.0 | 0.4% | — | — | — | EPSS 0.4%CVSS 10.0 | |
Attack
Exploitation
|
|||||||||
| CVE-2026-27544 | QA AnalyticsQuarkA | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-61962 | WP BASE BookingHakan Ozevin | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-72851 | serverbudibase | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isBudibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads tha… Attack
Exploitation
|
|||||||||
| CVE-2026-73656 | trigger.devtriggerdotdev | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isTrigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/… Attack
Exploitation
|
|||||||||
| CVE-2026-72841 | luciopenwrt | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isluci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious pay… Attack
Exploitation
|
|||||||||
| CVE-2026-72842 | luciopenwrt | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isluci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E`… Attack
Exploitation
|
|||||||||
| CVE-2026-49827 | WebErpMesv2SMEWebify | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isWebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Cod… Attack
Exploitation
|
|||||||||
| CVE-2026-28008 | OAuth Single Sign On – SSO (OAuth Client)miniOrange | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
Researchers found a way to hijack devices through Zoom screen sharing
As AI models gain advanced capabilities to find vulnerabilities in software, develop ways to exploit them , and even carry out autonomous hacking sprees , researchers offered a sobering new example on Tuesday, disclosing vulnerabilities in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim. Researchers from the digital defense firm A Security…
Also in Malwarebytes Labs The Hacker News
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.