Wednesday, August 19, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Oracle 144 critical 891
- Mozilla 5 critical 58
- WordPress 48
- Unknown 37
- mybb 2 critical 18
- Google 18
- Red Hat 3 critical 14
- ArcadeData 4 critical 14
- Netflix 1 critical 13
- HashiCorp 12
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Palo Alto Unit 42 Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)
In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks.
Also in Bleeping Computer Bleeping Computer CCCS Alerts & Advisories +3
-
Apple plugs image-processing hole ripe for spyware abuse
Apple has released a batch of vulnerability fixes for iPhones, iPads, and Macs, including an image-processing flaw that experts say has the hallmarks of a spyware delivery vector. The most notable patch is for CVE-2026-65346, a defect in the ImageIO framework Apple uses to parse image files. Discovered and reported by Nik Tsytsarkin of Meta's Red Team X, CVE-2026-65346 is an integer-overflow bug that could allow arbitrary code execution when an affected device processes an image. The bug affects macOS Tahoe, iPhone 11 and later, and supported iPad Pro, iPad Air, iPad, and iPad mini models…
Also in SecurityWeek CCCS Alerts & Advisories Malwarebytes Labs +3
-
Hackers Use Fake Claude Install Guide to Deploy MacSync Stealer and Trojanize Crypto Wallet Apps
Mac users searching for help with Claude Code are being lured into a malware campaign that turns a routine installation task into a full device compromise. The operation uses paid Google search results and a convincing shared Claude conversation to persuade victims to run a command in Terminal. The campaign puts everyday Mac users at serious risk. The page is hosted on Claude.ai, which gives the lure an air of legitimacy, but it is not an official installation guide. It tells visitors to copy and paste a curl command that downloads MacSync, an information stealer built to collect credentials…
Also in Cyber Security News Malwarebytes Labs The Hacker News +1
-
Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000
A ransomware affiliate calling itself Ransom Busters has been spotted proactively sending emails to victim organizations and claims to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000. "In these messages, the third-party offers to help the victim recover from ransomware attack. This immediately stands out as anomalous," GuidePoint Research
Also in Bleeping Computer CISA Alerts & Advisories The Register Security
-
BeyondTrust Windows EPM Vulnerabilities Allows Attackers to Escalate Privileges
BeyondTrust has disclosed two high-severity vulnerabilities in its Endpoint Privilege Management (EPM) product for Windows that could allow attackers with local access to elevate privileges or bypass anti-tamper controls. Tracked as CVE-2026-40144 and CVE-2026-40145, the flaws affect all versions of BeyondTrust Endpoint Privilege Management (Windows Deployment) released before version 26.1.2. The company published the advisory, BT26-04, on August 17, 2026. BeyondTrust said the vulnerabilities were discovered internally during security assessment activities using frontier AI models and…
Also in Cyber Security News Microsoft Security Microsoft Security +3
-
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software
Also in Check Point Research The Hacker News Infosecurity Magazine
-
Oracle Releases 943 Security Patches Including Critical WebLogic Full Takeover Vulnerability
Oracle has released 943 new security patches in its August 2026 Critical Security Patch Update , addressing flaws across its enterprise software portfolio. The release includes several critical Oracle WebLogic Server vulnerabilities that could allow an unauthenticated remote attacker to take complete control of affected servers. The update, published on August 18, covers Oracle Database, Fusion Middleware, E-Business Suite, Java SE, MySQL, Enterprise Manager, PeopleSoft, Communications products, and many other platforms. Oracle strongly urged customers to apply the updates without delay…
Also in SecurityWeek Tenable Blog
-
Google Fixes Two Critical Chrome Flaws in WebGL and Dawn — Update Your Browser
Google has released a new Chrome Stable channel update that fixes two critical security vulnerabilities affecting graphics-related components. Users should update their browsers as soon as the release becomes available for their device. The update moves Chrome to version 151.0.7922.169/.170 on Windows and macOS, while Linux users receive version 151.0.7922.169. Google said the rollout will occur gradually over the coming days and weeks. The two critical issues are tracked as CVE-2026-76034 and CVE-2026-76036. Both are buffer overflow vulnerabilities, a memory-safety flaw that can occur when…
Also in Malwarebytes Labs SecurityWeek
-
Crook hawks millions of records allegedly plundered from corporate Azure tenants
A cybercrook claims to have siphoned millions of employee records from the Microsoft Azure environments of major companies including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services. The alleged haul spans nine organizations and is being advertised for sale by a threat actor using the name "TheHatman," according to research published by Hudson Rock. McDonald's accounts for the largest alleged dataset on TheHatman's shopping list, with 1.7 million records purportedly up for grabs. Another 800,000 records supposedly come from Tata Consultancy Services, 425,000 from Vodafone, and…
Also in Microsoft Security Bleeping Computer Tenable Blog +1
-
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a
Also in Infosecurity Magazine Bleeping Computer Wiz Research
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-75874 | FirefoxMozilla | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isSandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154. Attack
Exploitation
|
|||||||||
| CVE-2026-73343 | WP CompressAresIT | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isUnauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-75784 | TEW-WLC100F5 | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in st… Attack
Exploitation
|
|||||||||
| CVE-2026-61241 | Oracle Internet DirectoryOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated a… Attack
Exploitation
|
|||||||||
| CVE-2026-70880 | Oracle Hyperion Data Relationship ManagementOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticate… Attack
Exploitation
|
|||||||||
| CVE-2026-70921 | Oracle Hyperion Financial ManagementOracle | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with net… Attack
Exploitation
|
|||||||||
| CVE-2026-76008 | CF-N1-SComfast | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer … Attack
Exploitation
|
|||||||||
| CVE-2026-75843 | arcadedbArcadeData | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers ca… Attack
Exploitation
|
|||||||||
| CVE-2026-75851 | arcadedbArcadeData | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on … Attack
Exploitation
|
|||||||||
| CVE-2026-32444 | CwiclyCwicly | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isContributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.