Wednesday, September 2, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- HP 6 critical 86
- Unknown 2 critical 55
- WordPress 3 critical 53
- Mozilla 2 critical 34
- NVIDIA 30
- Google 5 critical 28
- Elastic 20
- Erlang 16
- Red Hat 13
- Dell 1 critical 13
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Dark Reading Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users
The "Spring Ring" operation aims to compromise users of the collaboration suite to remotely access their sessions, spread malware, and even take over infrastructure.
Also in Cyber Security News Bleeping Computer Malwarebytes Labs +2
-
Google Launches Gemini 3.8 Flash Cyber to Identify and Auto-Patch Security Vulnerabilities
Google has unveiled Gemini 3.8, its latest reasoning and coding model family, introducing a specialized variant called Gemini 3.8 Flash Cyber that is purpose-built to autonomously discover software vulnerabilities and generate working patches for them. The release arrives just three weeks after Gemini 3.7 Flash, marking Google’s third Flash-tier launch in six weeks, and both new models share the same underlying architecture while being tuned for different deployment scenarios. Google Launches Gemini 3.8 Flash Cyber The general-purpose Gemini 3.8 Flash targets long-horizon software engineering…
Also in CCCS Alerts & Advisories Bleeping Computer The Hacker News
-
Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products
The industrial giant has released advisories for its RSLinx Classic, ArmorStart, ControlFLASH, FactoryTalk, and other products.
Also in CCCS Alerts & Advisories CISA Alerts & Advisories CISA Alerts & Advisories +3
-
Another Artifactory CVE under attack by AI agents or humans
Security researchers reported that someone is exploiting CVE-2026-82329, a critical JFrog Artifactory authentication-bypass bug, just days after the vendor patched the 9.8-rated flaw. And we don't know if that someone is human. Artifactory is a widely used tool for managing software artifacts, packages, binaries, and AI models. It’s also popular with AI agents that go rogue and need to communicate with each other while remaining undetected by their human babysitters. In July, OpenAI and JFrog revealed that OpenAI’s models broke out of their cages to hack Hugging Face by exploiting Artifactory…
-
Dropbox Says 5,000 Accounts Were Compromised Through Lenovo ID Authentication Flaw
Dropbox has disclosed that approximately 5,000 user accounts were compromised in August after attackers exploited a weakness involving its Lenovo ID sign-in integration. The incident highlights the security risks that can arise when cloud platforms trust third-party identity providers without requiring strong, account-level verification before granting access. According to notifications sent to affected users, unauthorized access occurred between August 4 and August 21, 2026. Dropbox said attackers were able to register Lenovo IDs using victims’ email addresses due to an issue in Lenovo’s…
Also in The Register Security Bleeping Computer
-
Two critical Chrome flaws put users at risk on malicious websites
Chrome is rolling out an update for its desktop browser. The update includes 26 security fixes, two of which Google rates as critical use-after-free vulnerabilities. The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac, and 152.0.7977.75 for Linux. How to update Chrome If you don’t want to wait for the rollout to reach you, manually updating is easy. The easiest option is to allow Chrome to update automatically. But you can end up lagging behind if you never close your browser or if something goes wrong with the update. To update manually, click the More menu (three…
Also in SecurityWeek
-
Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes
International law enforcement agencies, working with CrowdStrike and Shadowserver Foundation, have disrupted Sality, a 23-year-old peer-to-peer botnet used to deliver malware to more than 15,000 machines worldwide. The botnet has operated since 2003 and distributed all types of malicious code to victims, spanning credential theft, spam distribution, proxy services, network exploitation, and distributed denial-of-service (DDoS) attacks. For the past eight years, Sality’s primary payload has been EggJagger, a tool that monitors clipboards for cryptocurrency wallet addresses, then silently…
Also in CyberScoop
-
Firefox on iPhone Can Now Block Ads and Trackers Without Installing an Extension
Mozilla has introduced a built-in Ad Blocker for Firefox on iOS, allowing iPhone users to block many third-party advertisements and ad-related trackers without downloading a separate browser extension. The new feature is designed to reduce visual clutter from pop-ups, overlays, and third-party advertising scripts that can slow down browsing or interrupt users while reading web content. It is optional and disabled by default, giving users control over whether ad blocking is enabled in their browser. Firefox users on iPhone can activate the setting by opening Settings, selecting Browsing, and…
Also in The Register Security
-
Critical Langflow Vulnerability Exploited as Attacks on AI Platform Rise
The attacks targeting CVE-2026-0768 are the latest threat against the low-code AI development platform, which is receiving more attention from adversaries this year.
Also in Bleeping Computer The Hacker News
-
Hackers push malicious Virtualizor update in BGP hijacking attack
Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers.
Also in SecurityWeek
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-76657 | Fabric ComposerHP | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isVulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacke… Attack
Exploitation
|
|||||||||
| CVE-2026-76658 | Fabric ComposerHP | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attack… Attack
Exploitation
|
|||||||||
| CVE-2026-18550 | Nokri – Job Board WordPress ThemeWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` f… Attack
Exploitation
|
|||||||||
| CVE-2026-18765 | E-OSBTeracity Software Technologies Inc. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01. Attack
Exploitation
|
|||||||||
| CVE-2026-18210 | Products's StoreUnknown | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This is… Attack
Exploitation
|
|||||||||
| CVE-2026-18808 | KIO (Klemsan Internet Objects)Klemsan Electrical Electronics Inc. | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isImproper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection. This issue affects KIO (Klemsan Internet Objects): before v1.9. Attack
Exploitation
|
|||||||||
| CVE-2026-78012 | EtherNet/IP Adapter DLL Kit (EIPA)Pyramid Solutions | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAn issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a de… Attack
Exploitation
|
|||||||||
| CVE-2026-73749 | AOS-CXHP | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isMultiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected serv… Attack
Exploitation
|
|||||||||
| CVE-2023-54391 | Proxmox Virtual Environment (VE)Proxmox Server Solutions GmbH | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isProxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured s… Attack
Exploitation
|
|||||||||
| CVE-2026-84372 | predispredis | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isPredis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in Abstract… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.