vulnerability Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication Attackers are chaining two PaperCut vulnerabilities – one related to dynamic class loading and another to improper access control – to execute arbitrary code on susceptible instances without authentication. The vulnerability allows for remote code execution, and threat actors have been observed exploiting these flaws t… The Hacker News · 2d ago High CVE-2026-82078CVE-2026-81578vulnerabilityremote code executionpatch
threat-intel ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body A Chinese-speaking threat actor exploited a critical vulnerability in ownCloud to steal sensitive nuclear records from a Philippine research body. The attacker used custom Python scripts and open-source tools to gain una… The Hacker News · 2d ago High CVE-2023-49105CVE-2024-28000CVE-2026-53362PHCHvulnerabilitycyberattackdata breach
vulnerability Ebyte NA111-M A series of vulnerabilities have been identified in Ebyte NA111-M devices, primarily related to authentication and configuration management. These flaws allow unauthenticated attackers to access sensitive information, mo… CISA Advisories · 3d ago High CVE-2026-73125CVE-2026-76179CVE-2026-75814CHauthenticationconfigurationvulnerability
threat-intel The MFA Identity Trap: When Authentication Creates a False Sense of Security Multi-factor authentication (MFA) is increasingly relied upon, but organizations are mistakenly assuming that successful MFA automatically verifies a user’s identity. Attackers are exploiting vulnerabilities in the proce… SecurityWeek · 4d ago High mfaidentity-proofingauthentication
vulnerability WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities Threat actors are actively exploiting two recently patched vulnerabilities within the MiniOrange SAML 2.0 Single Sign-On plugin for WordPress websites. These vulnerabilities allow attackers to bypass authentication and g… SecurityWeek · 5d ago High CVE-2026-61979CVE-2026-15981wordpressvulnerabilityauthentication
threat-intel WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android WhatsApp is bolstering its security by introducing passkeys and enhanced two-step verification to combat phishing attacks and improve account protection for users on both iOS and Android. This move aims to make it signif… The Hacker News · 5d ago Medium passkeysphishingsecurity
threat-intel WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update WhatsApp has significantly boosted its account security by introducing multi-passkey support, upgrading two-step verification to stronger passwords, and providing caller information to combat scams. These changes aim to… SecurityWeek · 5d ago Medium passkeystwo-factorsecurity
vulnerability Ebyte NE2-D11 A CISA advisory highlights critical vulnerabilities in Ebyte NE2-D11 devices, primarily due to a lack of consistent authentication enforcement and cleartext transmission of sensitive information. The vendor, Ebyte, has n… CISA Advisories · 5d ago High CVE-2026-73125CVE-2026-73809CVE-2026-73839CHvulnerabilityauthenticationencryption
vulnerability Siemens SIMATIC IoT2050 Advanced A vulnerability in Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed allows unauthenticated remote attackers to create malicious flows and execute arbitrary code on the underlying ser… CISA Advisories · 5d ago Critical CVE-2026-58115vulnerabilityindustrial control systemsnode-red
vulnerability Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access Attackers are exploiting two unauthenticated vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing them to gain administrator access to vulnerable sites. The vulnerabilities stem from f… The Hacker News · 5d ago High CVE-2026-61979CVE-2026-15981wordpresssamlauthentication
vulnerability Multiples vulnérabilités dans Keycloak (25 août 2026) Multiple vulnerabilities have been discovered in Keycloak, allowing an attacker to bypass security policies and potentially take control of an account if they know its identifier. The CERT-FR has a proof of concept for C… CERT-FR · 5d ago Medium CVE-2026-18963CVE-2026-14613CVE-2026-15571keycloakvulnerabilityauthentication
vulnerability Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account A critical vulnerability (CVE-2026-18963) in Keycloak allows unauthenticated attackers to force a password reset and take over any user account, including administrative accounts. Red Hat and Keycloak have released patch… The Hacker News · 6d ago Critical CVE-2026-18963CVE-2026-15571password-resetauthenticationkeycloak
threat-intel Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting!, (Fri, Aug 21st) This script identifies users within an organization who have not yet been enrolled in multi-factor authentication (MFA) using the Microsoft Graph API. It leverages a beta command to efficiently list un-registered users,… SANS Internet Storm Center · Aug 21, 2026 Info mfamicrosoftgraph
vulnerability Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers Citrix has released security updates to address two critical vulnerabilities in NetScaler ADC and NetScaler Gateway, including a high-severity authentication bypass. These flaws primarily affect deployments where specifi… The Hacker News · Aug 20, 2026 High CVE-2026-19489CVE-2026-19490CVE-2026-8451authenticationvpnsaml
vulnerability Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities Cisco has released patches to address 15 critical and high-severity vulnerabilities across its products, including Crosswork and BroadWorks. These flaws could lead to remote code execution, authentication bypasses, and d… SecurityWeek · Aug 20, 2026 High CVE-2026-20030CVE-2026-20357CVE-2026-20358vulnerabilitypatchsecurity
vulnerability NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands A security vulnerability in NASA/JPL's AMMOS Instrument Toolkit's AIT-GUI browser-based operator console allows unauthenticated attackers to issue arbitrary commands to spacecraft and instruments. Researchers at Cycode d… The Hacker News · Aug 20, 2026 High CVE-2026-60112CVE-2026-47731CVE-2026-71214browserauthenticationcommand-injection
vulnerability Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler Citrix has announced patches for a critical authentication bypass vulnerability in its NetScaler ADC and NetScaler Gateway products. This flaw, with a CVSS score of 9.3, allows unauthenticated remote attackers to gain ac… SecurityWeek · Aug 20, 2026 Critical CVE-2026-19490CVE-2026-19489patchauthenticationvulnerability
threat-intel 943 Patches Rolled Out With Oracle’s August 2026 Security Update Oracle released a massive update – 943 security patches – as part of its August 2026 Critical Security Patch Update, addressing over 1,000 unique vulnerabilities across numerous products. Many of these flaws, particularl… SecurityWeek · Aug 19, 2026 High patchingvulnerabilitiessecurity
vulnerability Vulnérabilité dans Apereo CAS (19 août 2026) A security vulnerability has been identified in Apereo CAS, allowing attackers to bypass security policies. This affects older versions of the CAS system, requiring immediate patching to prevent exploitation. CERT-FR · Aug 19, 2026 Medium casvulnerabilitysecurity
threat-intel Apple Screen Sharing Security, (Mon, Aug 17th) A security vulnerability in Apple's screen sharing feature, leveraging the older VNC protocol, has been actively exploited. The issue stems from a combination of weak authentication and inadequate firewall controls, allo… SANS Internet Storm Center · Aug 17, 2026 High vncscreen-sharingfirewall
