Tuesday, August 18, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Mozilla 58
- Unknown 9 critical 35
- Apple 35
- JetBrains 1 critical 18
- ArcadeData 4 critical 14
- getgrav 1 critical 12
- Mattermost 11
- Microsoft 10
- Zabbix 10
- HashiCorp 1 critical 8
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Windows 11 File Explorer Gets Faster, Customizable Right-Click Menu With App Extension Controls
Microsoft has introduced a redesigned File Explorer context menu for Windows 11 Insiders , promising faster right-click performance, less clutter, and new controls over built-in commands and third-party app extensions. The update is part of Microsoft’s wider effort to improve File Explorer’s responsiveness, stability, and day-to-day usability. File Explorer is central to everyday Windows activity, including browsing folders, copying files, renaming documents, and accessing cloud-stored content. Microsoft said it has focused on reducing freezes, loading delays, visual flashes, and other…
Also in Bleeping Computer Any.Run Malware Analysis Bleeping Computer +3
-
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below - ubnuler ubnlder ri18nr reaker rakier orakw joxn
Also in Cyber Security News Bleeping Computer Microsoft Security +1
-
Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks
A critical security flaw in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload malicious PHP files , potentially enabling them to take full control of vulnerable websites. The issue, tracked as CVE-2026-15748, affects Forminator Forms versions 1.56.1 and earlier and carries a CVSS severity score of 9.8. Forminator Forms is a widely used drag-and-drop plugin for building contact, payment, poll, quiz, and file-upload forms. With more than 600,000 active installations, the vulnerability poses a significant risk to WordPress administrators who have not yet…
-
Video Call Exploit Chains Two Flaws in Unisoc Modems
Researchers found that by combining two vulnerabilities, they could take over an Android device by delivering a payload and getting the victim to answer their phone.
Also in The Hacker News Malwarebytes Labs Microsoft Security
-
Crook hawks millions of records allegedly plundered from corporate Azure tenants
A cybercrook claims to have siphoned millions of employee records from the Microsoft Azure environments of major companies including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services. The alleged haul spans nine organizations and is being advertised for sale by a threat actor using the name "TheHatman," according to research published by Hudson Rock. McDonald's accounts for the largest alleged dataset on TheHatman's shopping list, with 1.7 million records purportedly up for grabs. Another 800,000 records supposedly come from Tata Consultancy Services, 425,000 from Vodafone, and…
-
Apple Patches iOS and macOS, (Mon, Aug 17th)
Apple today released updates for iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and comes about two weeks after the much smaller macOS update that addressed the single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.
Also in CCCS Alerts & Advisories SANS Internet Storm Center Malwarebytes Labs
-
Critical GitLab GraphQL Vulnerability Allow Attackers to Delete Public Projects
GitLab has released urgent security updates to fix a critical GraphQL vulnerability that could allow unauthenticated attackers to modify or delete public projects and user data remotely. The issue, tracked as CVE-2026-19478, affects GitLab Community Edition and Enterprise Edition installations across several supported release branches. The vulnerability was addressed in GitLab versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, released on August 17, 2026. GitLab strongly recommends that administrators of self-managed instances upgrade immediately. GitLab.com and GitLab Dedicated have already…
Also in SecurityWeek The Hacker News
-
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a
Also in Bleeping Computer Wiz Research
-
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Cybersecurity researchers have traced the continued evolution of the Cavern (aka Cav3rn) command-and-control (C2) framework used by Iranian nation-state hackers in attacks targeting entities in Israel. Russian cybersecurity company Kaspersky said its ongoing monitoring of the threat activity cluster since December 2025 has led to the discovery of previously unreported components that expand the
Also in Malwarebytes Labs
-
CISA Warns of Ray-Project Ray Code Injection Vulnerability Exploited in Attacks
CISA has added a critical Ray-Project Ray vulnerability, tracked as CVE-2025-62593 , to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The flaw can allow remote code execution on systems where vulnerable Ray development environments are running. Ray is an open-source distributed computing framework widely used by Python developers and AI teams for scaling machine learning, data processing, and application workloads. The issue affects Ray versions before 2.52.0 and is especially dangerous for developers using Firefox or Safari. At the same time, Ray is…
Also in CISA Alerts & Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-66792 | Multicluster Global HubRed Hat | Critical | 9.9 | 0.3% | — | — | — | EPSS 0.3%CVSS 9.9 | |
What it isA flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation g… Attack
Exploitation
|
|||||||||
| CVE-2026-47686 | vm2patriksimek | Critical | 9.9 | 0.3% | — | — | — | EPSS 0.3%CVSS 9.9 | |
What it isvm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sand… Attack
Exploitation
|
|||||||||
| CVE-2026-65974 | erpnextHashiCorp | Critical | 9.9 | 0.6% | — | — | — | EPSS 0.6%CVSS 9.9 | |
What it isERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forci… Attack
Exploitation
|
|||||||||
| CVE-2026-75843 | arcadedbArcadeData | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers ca… Attack
Exploitation
|
|||||||||
| CVE-2026-75851 | arcadedbArcadeData | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on … Attack
Exploitation
|
|||||||||
| CVE-2026-32444 | CwiclyCwicly | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isContributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-32463 | Sync Post With Other SiteKamlesh Parmar | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isContributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-50768 | Unknown | Critical | 9.8 | 0.6% | — | — | — | EPSS 0.6%CVSS 9.8 | |
What it isFile Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function. Attack
Exploitation
|
|||||||||
| CVE-2026-47698 | vm2patriksimek | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isvm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing san… Attack
Exploitation
|
|||||||||
| CVE-2026-75110 | MemOSMemTensor | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isMemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request()… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.