Sunday, August 16, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Linux 127
- WordPress 8 critical 56
- siyuan-note 7 critical 10
- Unknown 8
- code-projects 7
- Apache 4
- Microsoft 4
- SourceCodester 4
- Apple 3
- HashiCorp 1 critical 3
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Ars Technica Security Vulnerability giving attackers full control of Macs is under active exploitation
Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation. “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple systems on which port 5900 was accessible from the Internet,” the Netherlands National Cyber Security Centrum warned earlier this week. “In all these cases, root had been accessed on the affected system and a Monero crypto miner had been placed.” Do you know if your screen sharing is on? The vulnerability, tracked as…
Also in Bleeping Computer Infosecurity Magazine SecurityWeek
-
Microsoft to Make Passkeys Default in Entra ID and Retires SMS and Voice Authentication
Microsoft will make passkeys the default authentication experience in Microsoft Entra ID as part of a broader move away from phishing-prone sign-in methods. The company will also retire Microsoft-provided SMS and voice authentication for multifactor authentication, pushing organizations toward phishing-resistant credentials. Beginning September 1, 2026, users currently enabled for SMS or voice authentication will be automatically enabled for passkeys. During a future MFA sign-in, these users will see prompts encouraging them to register a passkey. Microsoft will manage the passkey…
Also in Bleeping Computer The Register Security
-
VINclarity Publishes Investigation Into Alleged Scam and Fraud Reputation Attack Across Search and AI
Selidan, USA, August 14th, 2026, CyberNewswire New report examines suspicious Reddit activity, coordinated YouTube content and BBB Scam Tracker entries influencing how the vehicle history platform appears across Google and AI systems VINclarity has published a new investigation into what researchers describe as a coordinated online reputation attack targeting the vehicle history platform across Reddit, YouTube, Google Search and AI-powered discovery systems. The investigation, “VINclarity Becomes the Next Target: Inside the Coordinated Reputation Attack Playbook” , examines a cluster of…
Also in Bleeping Computer SecurityWeek Infosecurity Magazine
-
New Evooo1Bot Linux botnet turns routers into traffic relay nodes
A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes.
Also in Infosecurity Magazine
-
Hackers Started to Exploit Critical SAP Commerce Cloud, Still No Public PoC
Threat actors have begun actively probing and attempting to exploit a maximum-severity flaw in SAP Commerce Cloud, just three days after official security fixes were released. Defused honeypot telemetry captured the first wave of unauthenticated remote-execution traffic circulating across the web, despite the complete absence of a public proof of concept. Tracked as CVE-2026-58231 , the security defect carries a critical CVSS score of 10.0, representing the highest possible severity rating for enterprise software. The vulnerability enables unauthenticated adversaries to execute arbitrary code…
Also in Bleeping Computer
-
APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
Introduction CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. Since its first public disclosure by Sophos in 2022 and subsequent analysis by Trend Micro in 2023 , CoolClient has continued to evolve. In 2025 , we analyzed a newer variant that introduced clipboard theft and HTTP traffic…
Also in Microsoft Security Microsoft Security Microsoft Security
-
Citrix NetScaler Heap Overflow Flaw Lets Remote Attackers Execute Code as Root – PoC Released
A working proof-of-concept (PoC) exploit demonstrating how a pre-authentication heap overflow in Citrix NetScaler ADC and NetScaler Gateway can be turned into unauthenticated root-level remote code execution (RCE). The vulnerability was originally addressed in Cloud Software Group’s June 30 security bulletin CTX696604, where Citrix described CVE-2026-8452 as a memory overflow that could result in denial-of-service (DoS) or “unpredictable behavior.” However, independent analysis confirms that the flaw is far more severe, granting remote attackers direct control over the core packet-processing…
Also in watchTowr Labs
-
Apple now uses iPhone alerts for targets of mercenary spyware
Apple has expanded its threat-notification system for targets of mercenary spyware . Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page. In the explanation, Apple states: “Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”…
Also in Bleeping Computer
-
RingCentral data breach exposed info of 1.6 million accounts
The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned.
Also in SecurityWeek
-
Over 1,000 Charities Hit by Beacon CRM Data Breach
The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts.
Also in Infosecurity Magazine
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-15826 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role EditorWordPress | Critical | 9.8 | 0.8% | — | — | — | EPSS 0.8%CVSS 9.8 | |
What it isThe User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_inse… Attack
Exploitation
|
|||||||||
| CVE-2026-16142 | TrueBooker – Appointment Booking and Scheduler SystemWordPress | Critical | 9.8 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.8 | |
What it isThe TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary… Attack
Exploitation
|
|||||||||
| CVE-2026-19598 | Pods – Custom Content Types and FieldsWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels … Attack
Exploitation
|
|||||||||
| CVE-2026-73046 | siyuanHashiCorp | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isSiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAu… Attack
Exploitation
|
|||||||||
| CVE-2026-19924 | AC10Tenda | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be ini… Attack
Exploitation
|
|||||||||
| CVE-2026-16098 | ProSolution WP ClientWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Conten… Attack
Exploitation
|
|||||||||
| CVE-2026-18432 | Frontend Admin by DynamiAppsWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_us… Attack
Exploitation
|
|||||||||
| CVE-2026-18855 | Link LibraryWordPress | Critical | 9.1 | — | — | — | — | CVSS 9.1 | |
What it isThe Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthentic… Attack
Exploitation
|
|||||||||
| CVE-2026-14524 | ProSolution WP ClientWordPress | Critical | 9.1 | — | — | — | — | CVSS 9.1 | |
What it isThe ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible fo… Attack
Exploitation
|
|||||||||
| CVE-2026-18316 | Solace ExtraWordPress | Critical | 9.1 | — | — | — | — | CVSS 9.1 | |
What it isThe Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_a… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign.
Also in Bleeping Computer
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.