Monday, September 7, 2026 · generated · about 4 min read
Morning Brief
Patch today vendors with the most new CVEs today
- MediaTek, Inc. 18
- itsourcecode 12
- SourceCodester 12
- Microsoft 10
- Unknown 9
- Oracle 7
- curl 7
- pmmp 5
- h3js 5
- MISP 4
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: The Hacker News Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, which mainly singles out directors, vice presidents, and other executive staff
Also in Bleeping Computer Cyber Security News Cyber Security News +1
-
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. "Sansec is
Also in Bleeping Computer SecurityWeek
-
OpenAI Agents Hacked Another Website
Plus: Tens of millions of US and Canadian drivers’ licenses go up for sale on the dark web, the US military finally tries to tackle the risk online ad data poses to troops, and more.
Also in SecurityWeek
-
Bimbo Bakeries USA Confirms Data Breach in Oracle EBS Zero-Day Attack
Bimbo Bakeries USA, the American arm of the world’s largest baking company, has confirmed that hackers stole employee data by exploiting a zero-day vulnerability in Oracle’s E-Business Suite (EBS), joining a growing list of organizations swept up in the Clop ransomware gang’s global extortion campaign against Oracle customers. In a notification letter dated August 31, 2026, and filed with the California Attorney General’s office on September 4, as detailed in the official filing published by the California Attorney General’s Office , the bakery giant said the incident traced back to a…
Also in The Hacker News
-
Linux Rootkit Injects Fileless PHP Web Shells Into Compromised F5 BIG-IP Servers
A stealthy Linux rootkit is giving attackers a new way to keep control of compromised F5 BIG-IP Access Policy Manager servers. Instead of leaving an obvious malicious PHP file behind, it places a web shell only in the memory used by the running server process. The activity is linked to BIG-IP APM webtop environments running Apache and PHP. F5 has associated related activity with CVE-2025-53521, an exploited, unauthenticated remote-code-execution flaw, a risk already highlighted in coverage of exposed BIG-IP APM devices . Sophos analysts identified the implant while examining compromised…
Also in Cyber Security News SecurityWeek
-
Hackers Abuse Trusted Google Services to Hide Credential-Stealing Phishing Attacks
Criminals are using trusted Google services as cover for a wide phishing campaign that steals corporate credentials and, in some cases, installs remote-access software. The malicious path runs through Google-owned domains before reaching attacker-controlled pages for users and filters. The emails use familiar workplace themes, including document reviews, expiring mailboxes, package deliveries, payment notices, voicemail alerts and government benefits. The lures target staff across manufacturing, government, finance and non-profit organizations. KnowBe4 Threat Lab analysts identified the…
Also in The Hacker News
-
Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits
The proof-of-concept (PoC) exploits lead to privilege escalation, spawning a shell with System privileges.
Also in Infosecurity Magazine
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-86296 | DIR-822AD-Link | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isA vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possibl… Attack
Exploitation
|
|||||||||
| CVE-2026-79697 | WISE-6610-NBAdvantech | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6… Attack
Exploitation
|
|||||||||
| CVE-2026-79698 | WISE-6610-NBAdvantech | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isA vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6… Attack
Exploitation
|
|||||||||
| CVE-2026-19633 | PostgreSQL AnonymizerDALIBO | High | 8.8 | — | — | — | — | CVSS 8.8 | |
What it isPostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the … Attack
Exploitation
|
|||||||||
| CVE-2026-20501 | MediaTek chipsetMediaTek, Inc. | High | 8.4 | — | — | — | — | CVSS 8.4 | |
What it isIn vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS… Attack
Exploitation
|
|||||||||
| CVE-2026-20502 | MediaTek chipsetMediaTek, Inc. | High | 8.4 | — | — | — | — | CVSS 8.4 | |
What it isIn vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS… Attack
Exploitation
|
|||||||||
| CVE-2026-86295 | DIR-895LD-Link | High | 8.3 | — | — | — | — | CVSS 8.3 | |
What it isA vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be… Attack
Exploitation
|
|||||||||
| CVE-2026-86242 | Bifrostmaximhq | High | 8.1 | — | — | — | — | CVSS 8.1 | |
What it isBifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The … Attack
Exploitation
|
|||||||||
| CVE-2026-86297 | DIR-605D-Link | High | 8.1 | — | — | — | — | CVSS 8.1 | |
What it isA vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument p… Attack
Exploitation
|
|||||||||
| CVE-2026-86313 | WalrusSamsung Opensource | High | 7.8 | — | — | — | — | CVSS 7.8 | |
What it isOut-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers. This issue affects Walrus: af80e665ea49d9003695a66502f841ed1d8397e7. Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.