Sunday, September 6, 2026 · generated · about 5 min read
Morning Brief
Patch today vendors with the most new CVEs today
- WordPress 2 critical 11
- Tenda 7 critical 9
- The Tcpdump Group 7
- Mikrotik 6
- WWBN 2 critical 5
- getgrav 5
- SourceCodester 4
- code-projects 4
- bookwyrm-social 3
- N-able 3
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and
-
CrowdStrike Launches SafeMind – First Agentic Cybersecurity Solution Built for Defenders
CrowdStrike has unveiled SafeMind, a family of purpose-built security models and harnesses that the company is calling the first agentic system engineered specifically for cyber defenders. Announced at Fal.Con 2026 in Las Vegas, the launch marks a strategic pivot away from generic frontier AI models toward a dedicated offensive-defensive framework built to operate natively inside the CrowdStrike Falcon platform. The system emerges from CrowdStrike’s newly established Cyber Superintelligence Lab and represents one of the most ambitious applications of agentic AI in enterprise security to date…
Also in Bleeping Computer The Register Security
-
Microsoft Teams Desktop Client Fails to Load on Windows System – Microsoft Investigating
Microsoft is investigating an ongoing issue causing some Windows users to face significant delays or outright failures when launching the Microsoft Teams desktop client. The company acknowledged the problem, tracked internally as TM1466820, and confirmed it remains unresolved as engineers continue digging through service logs to find a root cause. According to Microsoft’s incident notice, affected users encounter trouble specifically during the first launch of Teams on a Windows device. Some cannot load the client at all, while others experience delays stretching up to two minutes before the…
Also in The Register Security Cyber Security News SecurityWeek +3
-
10 Best ZTNA Solutions (Zero Trust Network Access) In 2026
Zero Trust Network Access (ZTNA) anchors 2026 cybersecurity amid remote, cloud, and hybrid booms. ZTNA solutions aren’t hype—they’re vital for data locks, compliance wins, and borderless teams. “Never trust, always verify”: ZTNA okays only vetted users/devices, location-blind. Shrink attack planes, block lateral creeps, master app gates. Market clutter and threat flux complicate picks. We rank 2026’s top 10: specs, perks, real impacts dissected.Prioritizing usability, relevance for CISOs, IT pros, scaling firms. CISO, manager, or tech enthusiast find your Zero Trust match. Per-tool: intros…
Also in Cyber Security News CyberScoop
-
Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability
A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available. Dutch e-commerce security firm Sansec disclosed the flaw, dubbed StyleSmuggler, on September 5, 2026, warning that unauthenticated attackers can achieve remote code execution on vulnerable installations and that live attacks began the previous day . The company said it was publishing its findings early, before completing its full technical analysis, “because stores are being…
Also in The Hacker News
-
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the binary. It is not a HAProxy vulnerability, and installing it requires code execution on the host and
Also in Rapid7 Blog CCCS Alerts & Advisories
-
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code. "A
Also in SecurityWeek
-
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Threat actors are exploiting two critical security flaws in WordPress plugins Super Forms and Elementor Pro, according to findings from Wordfence. The vulnerabilities in question are - CVE-2026-14894 (CVSS score: 9.8) - A missing file type validation vulnerability in Super Forms – Drag & Drop Form Builder that allows unauthenticated attackers to upload files of any type, including
Also in SecurityWeek
-
Critical Citrix NetScaler auth bypass now leveraged in attacks
Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian.
Also in CCCS Alerts & Advisories
-
Cisco searched for IOS XR bugs and found so many it rolled them into an update release
Cisco has warned its customers of three critical-rated flaws in its products. Two of them are present in the Cisco IOS XR operating system that powers the company’s carrier-grade kit. CVE-2026-20274 scores 9.8 on the ten-point CVSS scale and covers a buffet of buffering issues, the potential for out-of-bounds writes, and the chance to initialize resources with an insecure default. CVE-2026-20279 is another 9.8-rated flaw. Cisco says it’s an improper access control problem that covers “improper certificate validation, missing authentication for critical function, missing authorization, and…
Also in Cisco Security Advisories
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-86152 | CP3Tenda | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attac… Attack
Exploitation
|
|||||||||
| CVE-2026-86167 | HG10Tenda | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote e… Attack
Exploitation
|
|||||||||
| CVE-2026-86121 | cua-computer-servertrycua | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isCua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reac… Attack
Exploitation
|
|||||||||
| CVE-2026-86124 | AutoAgentHKUDS | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isAutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute ar… Attack
Exploitation
|
|||||||||
| CVE-2026-10196 | Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce EmailsMicrosoft | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle… Attack
Exploitation
|
|||||||||
| CVE-2026-86184 | laradashboardlaradashboard | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isLara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the G… Attack
Exploitation
|
|||||||||
| CVE-2026-86189 | AVideoWWBN | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isWWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can r… Attack
Exploitation
|
|||||||||
| CVE-2026-16310 | MemberDashWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthen… Attack
Exploitation
|
|||||||||
| CVE-2026-75816 | Frontend Admin by DynamiAppsWordPress | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isThe Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership… Attack
Exploitation
|
|||||||||
| CVE-2026-86165 | HG10Tenda | Critical | 9.8 | — | — | — | — | CVSS 9.8 | |
What it isA vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be ini… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.