Friday, August 28, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Linux 126
- Unknown 40
- Spring 35
- WordPress 2 critical 32
- WatchGuard 29
- Open-Xchange GmbH 1 critical 25
- Ebyte 4 critical 12
- Microsoft 11
- MongoDB 9
- budibase 1 critical 8
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that's used as a proxy to redirect Microsoft 365 sign-ins, while capturing authenticated sessions in the process. In a report shared with The Hacker News ahead of publication, Island characterized the $320/month service as a subscription-based phishing platform that
Also in Infosecurity Magazine Bleeping Computer CCCS Alerts & Advisories +2
-
Hackers Compromise Hundreds of WordPress Sites to Deploy Amatera Stealer via ClickFix
A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background. The lure claims to come from a recent Beijing Institute of Technology graduate seeking research work in electrical engineering, energy systems and applied AI. That focus points to professors and laboratory staff as likely targets, rather than ordinary corporate recruiters, and turns academic…
Also in Cyber Security News The Hacker News Microsoft Security +3
-
CISA Warns of Linux Kernel Privilege Escalation Vulnerability Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency has added a Linux kernel vulnerability , tracked as CVE-2026-53362, to its Known Exploited Vulnerabilities catalog after confirming that attackers are exploiting the flaw in real-world attacks. The issue affects the Linux kernel’s IPv6 networking subsystem. It could allow a local attacker to gain elevated privileges on a vulnerable system. CVE-2026-53362 is currently described as an unspecified Linux kernel vulnerability. However, CISA said the flaw can enable privilege escalation through the IPv6 networking component . Privilege…
Also in SecurityWeek CISA Alerts & Advisories
-
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2019-1068 - A remote code execution vulnerability in
Also in Infosecurity Magazine Bleeping Computer CCCS Alerts & Advisories
-
19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code
Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active
Also in Malwarebytes Labs
-
Learn How to Build Security Operations Ready for AI-Powered Attacks
Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security processes were built to handle. The challenge is no longer just finding another vulnerability or
Also in Microsoft Security Blog Bleeping Computer The Hacker News +1
-
Android Malware Hijacks Update System for Car Head Units
Threat actors behind a notorious click-fraud botnet have set their sights on vehicle infotainment modules and are abusing legitimate functionality to spread infections.
Also in Bleeping Computer Malwarebytes Labs
-
Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
Cybersecurity researchers have disclosed details of a vulnerability in Amazon Kiro, an artificial intelligence (AI)-powered, agentic integrated development environment (IDE), that could facilitate data exfiltration via prompt injection and Kiro Powers. The security flaw, which does not have a CVE identifier, works against Kiro IDE 0.7.45 on Windows, according to Mindgard. The latest version of
Also in CyberScoop 404 Media 404 Media
-
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions
PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it's "aware of confirmed customer incidents and is treating this matter with the highest priority." An
Also in Bleeping Computer
-
Hackers Steal Data of 8.7 Million Customers in Cyberattack on Three UK Airports
Cybercriminals have stolen the personal data of about 8.7 million customers following a cyberattack on systems used by Manchester Airports Group (MAG), which operates Manchester Airport, East Midlands Airport and London Stansted Airport. The airport operator said the incident involved unauthorized access to customer information, including email addresses, postcodes and vehicle registration details. The attackers also demanded a ransom for the stolen data, but MAG said it refused to pay. MAG stated that passenger safety, airport operations and aviation security were not affected by the breach…
Also in The Record
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-82222 | GiveWPLiquid Web / StellarWP | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isDeserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1. Attack
Exploitation
|
|||||||||
| CVE-2026-19092 | Tutor LMSWordPress | Critical | 9.8 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.8 | |
What it isThe Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output… Attack
Exploitation
|
|||||||||
| CVE-2026-81934 | RedisRedis | Critical | 9.8 | 0.6% | — | — | — | EPSS 0.6%CVSS 9.8 | |
What it isRedis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary co… Attack
Exploitation
|
|||||||||
| CVE-2026-69658 | Ebyte NE2-D11 FirmwareEbyte | Critical | 9.8 | 0.2% | — | — | — | EPSS 0.2%CVSS 9.8 | |
What it isMQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions. Attack
Exploitation
|
|||||||||
| CVE-2026-71187 | Ebyte NE2-D11 FirmwareEbyte | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isThe Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device. Attack
Exploitation
|
|||||||||
| CVE-2026-73125 | Ebyte NE2-D11 FirmwareEbyte | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isEbyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device… Attack
Exploitation
|
|||||||||
| CVE-2026-76179 | Ebyte NE2-D11 FirmwareEbyte | Critical | 9.8 | 0.4% | — | — | — | EPSS 0.4%CVSS 9.8 | |
What it isAn improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which ma… Attack
Exploitation
|
|||||||||
| CVE-2026-76943 | Xiiaozet LK100WXiiaozet | Critical | 9.8 | 0.7% | — | — | — | EPSS 0.7%CVSS 9.8 | |
What it isXiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthoriz… Attack
Exploitation
|
|||||||||
| CVE-2026-78239 | Xiiaozet LK100WXiiaozet | Critical | 9.8 | 0.5% | — | — | — | EPSS 0.5%CVSS 9.8 | |
What it isXiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized ac… Attack
Exploitation
|
|||||||||
| CVE-2026-82082 | NUMailGreen-Computing | Critical | 9.8 | 2% | — | — | — | EPSS 2%CVSS 9.8 | |
What it isNUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.