Monday, August 24, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- EmilStenstrom 2 critical 10
- Unknown 10
- itsourcecode 5
- Microsoft 2 critical 5
- SourceCodester 4
- code-projects 3
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Hackers Infect Android Car Screens Through Their Built-In Software Update System
A newly uncovered Android malware campaign has turned car infotainment screens into an unexpected target. Rather than tricking drivers into installing a suspicious app, attackers used the software update path already built into Android-based head units. The malware is a multi-stage downloader for ad fraud and a proxy botnet. It targets connected vehicle screens that handle music, navigation, and some vehicle functions, exploiting the same internet access that enables routine software updates. That makes a trusted maintenance feature the entry point for a wider criminal operation. Analysts at…
Also in The Record Bleeping Computer Bleeping Computer +1
-
AWS Network Firewall Now Displays Count of Triggered Security Rules
AWS has introduced rule hit count support for AWS Network Firewall , giving security teams direct visibility into which stateful firewall rules are matching live network traffic. The new capability is enabled by default and helps organizations identify active, inactive, and potentially misconfigured rules without manually reviewing large volumes of firewall logs. As firewall policies grow, they often accumulate rules that are no longer needed, never trigger, or are placed incorrectly in the inspection order. Until now, teams had to search alert logs manually to determine whether a specific…
Also in Infosecurity Magazine The Register Security Bleeping Computer
-
New Malware-as-a-service Leveraging Adobe-themed Domain to Attack Windows Users Using .bat File
A criminal service is hiding behind a website that appears to offer Adobe Acrobat Reader. The site, acrobatreaderonline.com, is not a document service. Instead, it appears to expose an operator panel for building and managing attacks against Windows users. The campaign uses a familiar trick: a trusted-looking document or payment theme leads a target toward a harmful download. Earlier activity tied to the same infrastructure used a Windows batch, or .bat, file through a WebDAV remote folder, turning a PDF or boleto lure into a possible malware entry point. Researchers at Clandestine identified…
Also in Bleeping Computer Microsoft Security Microsoft Security +1
-
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a
Also in Bleeping Computer Bleeping Computer Bleeping Computer
-
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
The U.S. Department of Justice (DoJ) announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit accusing the company of violating child privacy laws in the country. As part of the settlement, the social media platform will pay $300 million immediately, and an additional $100 million "upon entry of an order vacating a prior consent decree entered against
Also in SecurityWeek
-
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open
Also in Cyber Security News The Hacker News
-
Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments
Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.
Also in CCCS Alerts & Advisories
-
In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug
Other noteworthy stories that might have slipped under the radar: Threema DDoS attack, Evooo1Bot Linux botnet, Crypto4A secures top-tier NIST certification.
Also in Microsoft Security
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-78167 | ipTIME T16000MEFM | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation … Attack
Exploitation
|
|||||||||
| CVE-2026-78155 | StackGresOnGres | Critical | 9.9 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.9 | |
What it isprivilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges Attack
Exploitation
|
|||||||||
| CVE-2026-78169 | HiPER 1250GWUTT | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profil… Attack
Exploitation
|
|||||||||
| CVE-2026-5388 | justhtmlMicrosoft | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isjusthtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cas… Attack
Exploitation
|
|||||||||
| CVE-2026-7808 | justhtmlEmilStenstrom | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isjusthtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advan… Attack
Exploitation
|
|||||||||
| CVE-2026-8445 | justhtmlEmilStenstrom | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isjusthtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacter… Attack
Exploitation
|
|||||||||
| CVE-2026-78168 | ipTIME T24000MEFM | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack … Attack
Exploitation
|
|||||||||
| CVE-2026-78211 | 4MOSAn GCB Doctor4MOSAn Security Technology | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it is4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary s… Attack
Exploitation
|
|||||||||
| CVE-2026-78207 | exceljsMicrosoft | Critical | 9.4 | — | — | — | — | CVSS 9.4 | |
What it isexceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious _… Attack
Exploitation
|
|||||||||
| CVE-2026-19200 | VelociraptorRapid7 | High | 8.9 | — | — | — | — | CVSS 8.9 | |
What it isThe Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.