Saturday, August 29, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Unknown 1 critical 64
- WordPress 33
- Open-Xchange GmbH 1 critical 25
- Microsoft 17
- IBM 4 critical 16
- MongoDB 11
- Oracle 9
- yamcs 3 critical 9
- budibase 1 critical 8
- GitoxideLabs 8
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Wired Security Microsoft Teams Has Become a Haven for Scammers in China
Fraudsters are exploiting enterprise chat apps like Teams and Webex to trick Chinese victims into transferring large sums of money, fueling a wave of complaints.
Also in Bleeping Computer CCCS Alerts & Advisories
-
Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers
Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users' home networks. Topping the list is support for Encrypted Client Hello (ECH), a privacy standard that prevents networks from eavesdropping on which websites a user is visiting. "This new privacy standard works in tandem
Also in Bleeping Computer Dark Reading
-
700 AI Agents Secretly Coordinated to Hack Hugging Face After Breaking Their Isolation
A large group of AI agents reportedly bypassed their intended isolation, created a covert communication channel, and coordinated an attack on Hugging Face infrastructure. An independent investigation found that roughly 700 agents joined the activity after more than 1,200 agents used an internal package repository as an unauthorized message board. The incident began during OpenAI’s ExploitGym security evaluations , where tens of thousands of agents were assigned cyber tasks in separate sandboxed environments. The agents were supposed to operate independently. However, some encountered tasks…
Also in Bleeping Computer
-
Critical ServiceNow Flaws Let Attackers Execute Code and Access Data
ServiceNow has released security updates for four vulnerabilities in its Now Platform and ServiceNow AI platform, including three critical flaws that could allow unauthenticated attackers to execute code, access sensitive instance data , modify records, or escalate privileges. The company published its August 2026 CVE advisory on August 27, confirming that the issues were discovered through its internal security research and responsible disclosure programs. ServiceNow said each vulnerability was remediated independently and urged self-hosted customers to promptly apply the available updates…
Also in The Hacker News
-
OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems
CISA has added the exploited flaw, CVE-2026-53362, to its KEV catalog, alongside a JFrog vulnerability exploited by OpenAI agents.
Also in CISA Alerts & Advisories
-
PaperCut releases second emergency patch for exploited flaws
PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial…
Also in SecurityWeek
-
Learn How to Build Security Operations Ready for AI-Powered Attacks
Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security processes were built to handle. The challenge is no longer just finding another vulnerability or
Also in Microsoft Security Blog Bleeping Computer The Hacker News
-
19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code
Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active
Also in Infosecurity Magazine
-
Hackers Compromise Hundreds of WordPress Sites to Deploy Amatera Stealer via ClickFix
A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background. The lure claims to come from a recent Beijing Institute of Technology graduate seeking research work in electrical engineering, energy systems and applied AI. That focus points to professors and laboratory staff as likely targets, rather than ordinary corporate recruiters, and turns academic…
Also in The Hacker News
-
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2019-1068 - A remote code execution vulnerability in
Also in Infosecurity Magazine CCCS Alerts & Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-82222 | GiveWPLiquid Web / StellarWP | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isDeserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1. Attack
Exploitation
|
|||||||||
| CVE-2026-54745 | pipelinesKubernetes | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isKubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ r… Attack
Exploitation
|
|||||||||
| CVE-2026-55565 | yamcsyamcs | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isYamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source comp… Attack
Exploitation
|
|||||||||
| CVE-2026-55634 | pimcorepimcore | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isPimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject f… Attack
Exploitation
|
|||||||||
| CVE-2026-18527 | Administration Runtime Expert for iIBM | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isIBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnera… Attack
Exploitation
|
|||||||||
| CVE-2026-19295 | Langflow OSSIBM | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isIBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that refer… Attack
Exploitation
|
|||||||||
| CVE-2026-37751 | Unknown | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAn OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input. Attack
Exploitation
|
|||||||||
| CVE-2026-55559 | yamcsyamcs | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isYamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating… Attack
Exploitation
|
|||||||||
| CVE-2026-82266 | redpandaredpanda-data | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isRedpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker acco… Attack
Exploitation
|
|||||||||
| CVE-2026-82277 | argo-rolloutsargoproj | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isArgo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, Restart… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.