Saturday, August 15, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Linux 657
- WordPress 2 critical 26
- Apple 25
- IBM 4 critical 18
- HashiCorp 3 critical 17
- Microsoft 1 critical 17
- getgrav 3 critical 12
- Red Hat 11
- Tenable, Inc. 3 critical 11
- TOTOLINK 9
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News VINclarity Publishes Investigation Into Alleged Scam and Fraud Reputation Attack Across Search and AI
Selidan, USA, August 14th, 2026, CyberNewswire New report examines suspicious Reddit activity, coordinated YouTube content and BBB Scam Tracker entries influencing how the vehicle history platform appears across Google and AI systems VINclarity has published a new investigation into what researchers describe as a coordinated online reputation attack targeting the vehicle history platform across Reddit, YouTube, Google Search and AI-powered discovery systems. The investigation, “VINclarity Becomes the Next Target: Inside the Coordinated Reputation Attack Playbook” , examines a cluster of…
Also in Bleeping Computer SecurityWeek Infosecurity Magazine +3
-
Microsoft to Make Passkeys Default in Entra ID and Retires SMS and Voice Authentication
Microsoft will make passkeys the default authentication experience in Microsoft Entra ID as part of a broader move away from phishing-prone sign-in methods. The company will also retire Microsoft-provided SMS and voice authentication for multifactor authentication, pushing organizations toward phishing-resistant credentials. Beginning September 1, 2026, users currently enabled for SMS or voice authentication will be automatically enabled for passkeys. During a future MFA sign-in, these users will see prompts encouraging them to register a passkey. Microsoft will manage the passkey…
Also in Bleeping Computer The Register Security The Hacker News +2
-
Vulnerability giving attackers full control of Macs is under active exploitation
Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation. “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the Netherlands National Cyber Security Centrum warned earlier this week. “In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.” Do you know if your screen sharing is on? The vulnerability, tracked as…
Also in Bleeping Computer Infosecurity Magazine SecurityWeek
-
Malware Crypter Services Sell Windows Defender, EDR and SmartScreen Bypasses to Cybercriminals
Criminal services that hide malware are becoming easier to buy. These services, known as crypters, change a malicious file so that security tools struggle to recognize it. Their operators promise customers a way around Windows Defender, endpoint detection and response tools, and Microsoft SmartScreen. The change helps attackers move familiar malware past controls that would otherwise flag it early. The danger is not a single new malware family. It is a commercial layer that helps many kinds of malware reach victims with less scrutiny. Criminals can package remote access tools, stealers, or…
Also in Microsoft Security Microsoft Security Microsoft Security +1
-
ZDI-26-576: Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.
Also in Infosecurity Magazine Zero Day Initiative Zero Day Initiative +1
-
HACKERAI Malware Turns GitHub Gists Into a Command-and-Control Channel
A newly identified malware framework called HACKERAI C2 Agent is using GitHub Gists as a hidden channel for attacker commands and stolen data. The technique lets operators blend malicious traffic with a service that many organizations allow on their networks. The malware appeared during an investigation into a wider espionage campaign aimed at telecom, government, defense, energy, and critical infrastructure organizations in South Asia. Victims were lured with files that impersonated trusted telecom services, government updates, and software installers. Researchers at Acronis identified…
Also in Bleeping Computer Wiz Research
-
AWS key exposed in JavaScript may have lit way to Beacon's charity data
Beacon, a CRM provider for charities and nonprofits, says an AWS access key "potentially exposed in public JavaScript build artifacts" is the leading suspect in its July breach. The revelation came in the company's first update on the attack in more than a week. If the access key was exposed in public build artifacts, it raises questions about why Beacon's development pipeline and code review controls failed to catch it. Beacon used stronger wording about the potential data loss, confirming that a copy of the database was made and assessing that it was probably downloaded in readable form…
Also in SecurityWeek Infosecurity Magazine
-
Citrix NetScaler Heap Overflow Flaw Lets Remote Attackers Execute Code as Root – PoC Released
A working proof-of-concept (PoC) exploit demonstrating how a pre-authentication heap overflow in Citrix NetScaler ADC and NetScaler Gateway can be turned into unauthenticated root-level remote code execution (RCE). The vulnerability was originally addressed in Cloud Software Group’s June 30 security bulletin CTX696604, where Citrix described CVE-2026-8452 as a memory overflow that could result in denial-of-service (DoS) or “unpredictable behavior.” However, independent analysis confirms that the flaw is far more severe, granting remote attackers direct control over the core packet-processing…
Also in watchTowr Labs
-
Apple now uses iPhone alerts for targets of mercenary spyware
Apple has expanded its threat-notification system for targets of mercenary spyware . Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page. In the explanation, Apple states: “Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”…
Also in Bleeping Computer
-
RingCentral data breach exposed info of 1.6 million accounts
The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned.
Also in SecurityWeek
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-72811 | siyuansiyuan-note | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isSiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into… Attack
Exploitation
|
|||||||||
| CVE-2026-19188 | Haiwell IoT Cloud HMI GatewayHaiwell | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to … Attack
Exploitation
|
|||||||||
| CVE-2026-73678 | Minds PlatformMindsDB | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isMindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /… Attack
Exploitation
|
|||||||||
| CVE-2026-19626 | Security CenterTenable, Inc. | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsaf… Attack
Exploitation
|
|||||||||
| CVE-2026-19681 | Security CenterTenable, Inc. | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAn authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution o… Attack
Exploitation
|
|||||||||
| CVE-2026-19682 | Security CenterTenable, Inc. | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account. Attack
Exploitation
|
|||||||||
| CVE-2026-17186 | Db2 Mirror for iIBM | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isIBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command. Attack
Exploitation
|
|||||||||
| CVE-2026-72822 | gravgetgrav | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely … Attack
Exploitation
|
|||||||||
| CVE-2026-72824 | gravHashiCorp | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-… Attack
Exploitation
|
|||||||||
| CVE-2026-72826 | gravgetgrav | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline … Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
ZDI-26-582: Cisco Identity Services Engine PatchUpdateListener Directory Traversal Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20148.
Also in CCCS Alerts & Advisories Zero Day Initiative Zero Day Initiative +1
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.