Saturday, September 5, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Linux 147
- WordPress 4 critical 65
- IBM 2 critical 64
- Unknown 4 critical 43
- undici 10
- YesWiki 1 critical 10
- thorsten 8
- xmlsoft 8
- siyuan-note 7
- HashiCorp 7
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Cyber Security News Microsoft Teams Desktop Client Fails to Load on Windows System – Microsoft Investigating
Microsoft is investigating an ongoing issue causing some Windows users to face significant delays or outright failures when launching the Microsoft Teams desktop client. The company acknowledged the problem, tracked internally as TM1466820, and confirmed it remains unresolved as engineers continue digging through service logs to find a root cause. According to Microsoft’s incident notice, affected users encounter trouble specifically during the first launch of Teams on a Windows device. Some cannot load the client at all, while others experience delays stretching up to two minutes before the…
Also in The Register Security Cyber Security News SecurityWeek +3
-
AI Agents Breach Company Network in Under 10 Hours and Steal Root Credentials
A human attacker armed with frontier artificial intelligence models breached an enterprise network and seized root credentials in under 10 hours, a timeline that would normally take human red teams roughly two weeks to complete, according to a new incident response report from Palo Alto Networks’ Unit 42. The threat actor told Unit 42 investigators during ransom negotiations that they relied on frontier AI models paired with attack-specific agentic AI frameworks to automate the intrusion. Rather than manually executing each stage of the attack, the operator directed AI agents to monitor…
Also in CyberScoop Microsoft Security Blog Dark Reading
-
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and
Also in Rapid7 Blog CCCS Alerts & Advisories
-
Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC
The disgruntled security researcher known as Nightmare Eclipse (aka Chaotic Eclipse, Infinite Nightmare, and now also MSNightmare) is moving away from their singular Microsoft vendetta and on to other vendors. On Thursday, they dropped a new zero-day bug called FalconFlank that affects CrowdStrike’s Falcon endpoint security platform - albeit with a Windows link. According to the prolific zero-day hunter, FalconFlank is a privilege escalation vulnerability that abuses the Microsoft Office malicious macros remediation feature in CrowdStrike Falcon. This is an automated security tool built into…
Also in Bleeping Computer The Hacker News CyberScoop
-
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs
Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program. "The Fairwind Program gives high-priority defenders (like governments, healthcare providers, and telecommunications services) early access to advanced models that help them
Also in CCCS Alerts & Advisories Infosecurity Magazine
-
Hackers Use Popular Messaging Services to Control New Windows Backdoors
A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services. The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices. The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders. Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot. Analysts at Securelist…
Also in Microsoft Security The Hacker News
-
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including
Also in SecurityWeek
-
Cisco searched for IOS XR bugs and found so many it rolled them into an update release
Cisco has warned its customers of three critical-rated flaws in its products. Two of them are present in the Cisco IOS XR operating system that powers the company’s carrier-grade kit. CVE-2026-20274 scores 9.8 on the ten-point CVSS scale and covers a buffet of buffering issues, the potential for out-of-bounds writes, and the chance to initialize resources with an insecure default. CVE-2026-20279 is another 9.8-rated flaw. Cisco says it’s an improper access control problem that covers “improper certificate validation, missing authentication for critical function, missing authorization, and…
-
Critical Citrix NetScaler auth bypass now leveraged in attacks
Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian.
Also in CCCS Alerts & Advisories
-
Your phone or computer may soon ask how old you are
First, the good news: If you use a Linux-based operating system, you may not be asked your age in a few months. The bad news is that Windows, macOS, iOS, and Android users in California will be. California has passed a law that requires a range of operating systems to start collecting your age when you first set them up. Under the state’s Digital Age Assurance Act (DAAA), signed into law in October 2025, Windows, macOS, iOS, and Android will all have to do this from January 1, 2027. Operating systems set up before that date in California will need to do the same by July 1, 2027. Operating…
Also in Cisco Security Advisories Cisco Security Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-82923 | AI Website Builder (GitHub build)WordPress | Critical | 9.8 | 0.8% | — | — | — | EPSS 0.8%CVSS 9.8 | |
What it isThe AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL … Attack
Exploitation
|
|||||||||
| CVE-2026-85661 | excel-mcp-serverMicrosoft | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isexcel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any fil… Attack
Exploitation
|
|||||||||
| CVE-2026-85663 | aimaimhubio | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary… Attack
Exploitation
|
|||||||||
| CVE-2026-85672 | zeroxgetomni-ai | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it iszerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attacker… Attack
Exploitation
|
|||||||||
| CVE-2026-85688 | ten-frameworkTEN-framework | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isTEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read … Attack
Exploitation
|
|||||||||
| CVE-2026-85696 | SadTalkerOpenTalker | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isSadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in… Attack
Exploitation
|
|||||||||
| CVE-2026-18658 | Operational Decision ManagerIBM | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isIBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to wr… Attack
Exploitation
|
|||||||||
| CVE-2026-44402 | SNMP Web ProVoltronic Power | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isVoltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archiv… Attack
Exploitation
|
|||||||||
| CVE-2026-31020 | Unknown | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isIn DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without in… Attack
Exploitation
|
|||||||||
| CVE-2026-75430 | Unknown | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isPowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.