Tuesday, August 25, 2026 · generated · about 4 min read
Morning Brief
Patch today vendors with the most new CVEs today
- DrayTek Corporation 3 critical 40
- WordPress 3 critical 24
- Unknown 18
- getgrav 1 critical 15
- Red Hat 11
- ransomlook 11
- Dolibarr 10
- Apache 9
- vrana 1 critical 9
- Microsoft 1 critical 8
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News EvilTokens Doesn’t Just Steal Microsoft Sessions—Its AI Tells Attackers Who to Scam Next
EvilTokens is pushing phishing beyond the moment a victim clicks a link. The service steals Microsoft 365 session access, then examines the compromised mailbox to help criminals choose the contacts, payments, and conversations most likely to produce fraud. Unlike a conventional credential-stealing kit, the operation uses a real Microsoft sign-in process. A lure sends the target to a controlled page, where a device code is created and the user is directed to Microsoft’s authentic login site to approve it. That same OAuth device code phishing pattern leaves victims at a genuine destination, not…
Also in Rapid7 Blog Malwarebytes Labs Bleeping Computer +3
-
Hackers Abuse Google Sites to Host Fake OpenAI Codex Download Pages
Cybercriminals are using Google Sites to host fake download pages for OpenAI Codex, turning a familiar search into a malware trap. The campaign targets macOS users and relies on paid search placements to steer them toward a convincing but fraudulent installer page. The page does not simply deliver a harmful app. It tells visitors to copy a command, open Terminal, and run it themselves. That approach, known as ClickFix, shifts the final execution step to the victim and can bypass the suspicion normally raised by an unexpected download. Cato analysts identified the activity after tracking…
Also in The Register Security Cyber Security News CCCS Alerts & Advisories +1
-
You don't want this Sleepwalker backdoor on your Windows machine
Like a sleeper cell awaiting activation, a never-before-seen Windows backdoor dubbed Sleepwalker waits silently in memory for one specifically crafted network packet to wake it up and deliver commands using the malware's 23-instruction language. The commands can do everything from running code directly in memory to moving data off the computer. Malware researcher Dominik Reichel discovered the passive backdoor, which also has its own command language, and detailed Sleepwalker in a technical analysis on Monday. “What makes it worth writing up is what that packet carries: not a readable…
Also in Microsoft Security The Hacker News Bleeping Computer
-
CISA slaps its tightest three-day patching deadline on perfect-10 Oracle flaw
The US Cybersecurity and Infrastructure Security Agency (CISA) just dished out another three-day deadline for patching an actively exploited vulnerability, the most urgent in its wheelhouse. The culprit: a max-severity Oracle bug affecting Windows VMs. Tracked as CVE-2026-21962 (10.0), the improper access control (CWE-284) flaw affects Oracle’s HTTP Server and WebLogic Server Proxy Plug-in. Successful attacks targeting CVE-2026-21962 can allow miscreants to create, delete, or modify access to critical data, and even gain “complete access” to all data stored on the affected systems. Oracle…
Also in The Hacker News CCCS Alerts & Advisories
-
CISA Warns of Oracle HTTP and WebLogic Server Vulnerability Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-21962, an improper access control flaw affecting Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) Catalog. The addition confirms that attackers are actively exploiting the vulnerability in real-world attacks. Organizations with affected Oracle infrastructure should identify exposed systems and apply available Oracle security updates or mitigations as a priority. CVE-2026-21962 affects components commonly deployed in enterprise environments to route and…
Also in SecurityWeek CISA Alerts & Advisories
-
ToxicPanda Banking Trojan Matures Into Enterprise Threat
The latest version of the Android malware has new features that expand its global reach and put more than users' financial applications at risk.
Also in Malwarebytes Labs The Record Bleeping Computer +1
-
Hackers Exploit Critical miniOrange SAML SSO Flaws to Hijack WordPress Admin Accounts
Two critical flaws in the miniOrange SAML 2.0 Single Sign-On plugin could allow unauthenticated attackers to log in to vulnerable WordPress sites as any existing user, including administrators. The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8 and have been linked to attempted exploitation activity in the wild. The vulnerabilities affect miniOrange’s SAML-based single sign-on software, which lets WordPress sites authenticate users through an external Identity Provider. By exploiting weaknesses in the plugin’s SAML signature validation, attackers can forge an…
Also in The Hacker News Bleeping Computer
-
Critical Red Hat Keycloak Flaw Lets Unauthenticated Attackers Take Over Any User Account
Red Hat has disclosed a critical vulnerability in the Red Hat Build of Keycloak that could allow unauthenticated remote attackers to take over arbitrary user accounts. Tracked as CVE-2026-18963, the flaw affects the password recovery process and carries a CVSS v3.1 score of 9.1. The vulnerability exists in the reset-credentials flow of the keycloak-services component, the core identity and access management engine used by Red Hat Build of Keycloak. According to Red Hat, an attacker can trigger a password reset for any target account and bypass the email verification action that should…
Also in The Hacker News
-
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open
Also in Zero Day Initiative Zero Day Initiative
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-66897 | LXDCanonical | Critical | 9.9 | 0.6% | — | — | — | EPSS 0.6%CVSS 9.9 | |
What it isA path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target … Attack
Exploitation
|
|||||||||
| CVE-2026-32559 | UltimateAItophive | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
Attack
Exploitation
|
|||||||||
| CVE-2026-28165 | DigitsUnitedOver, LLC | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
Attack
Exploitation
|
|||||||||
| CVE-2026-32558 | Affiliate Pro - Affiliate Program for WooCommerce & WordPressWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-66587 | WP Cafe ProWPCafe | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-66648 | JawnMVPThemes | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
Attack
Exploitation
|
|||||||||
| CVE-2026-66650 | FreightCoTheme-Rex | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isUnauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions. Attack
Exploitation
|
|||||||||
| CVE-2026-76070 | NC63Netis Systems | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isNetis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler… Attack
Exploitation
|
|||||||||
| CVE-2026-76071 | NC63Netis Systems | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isNetis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod ac… Attack
Exploitation
|
|||||||||
| CVE-2026-77915 | rconfigrconfig | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isrConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php tha… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.