threat-intel Homeland security cybercops say patch TrueConf (Russia's Zoom) if you're using it US Homeland Security cybersecurity officials are warning users of TrueConf, a video conferencing tool developed in Russia, to urgently patch the software due to a critical vulnerability that could allow attackers to remo… The Register · Aug 21, 2026 Critical CVE-2026-72529CVE-2026-72530RUUSvulnerabilitycybersecurityrussia
vulnerability Critical Isolated-vm Vulnerability Leads to RCE on Host A critical type confusion vulnerability in the isolated-vm Node.js library is being exploited to achieve remote code execution (RCE) on the host system. The vulnerability stems from a flawed data transfer mechanism withi… SecurityWeek · Aug 21, 2026 Critical rcetype-confusionnode.js
vulnerability Microsoft Rolls Out 22 Fresh Security Patches Microsoft released 22 security patches addressing critical and high-severity vulnerabilities across its Azure, Entra ID, Exchange, Fabric, and Defender products. Several of these flaws, including a zero-day exploit dubbe… SecurityWeek · Aug 21, 2026 Critical CVE-2026-69502CVE-2026-69555CVE-2026-65816vulnerabilitypatchzero-day
vulnerability GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure A critical vulnerability (CVE-2026-19478) in GitLab, allowing unauthenticated code injection and data manipulation, has been actively exploited shortly after its disclosure. This poses a significant risk to organizations… The Hacker News · Aug 21, 2026 Critical CVE-2026-19478vulnerabilitycode-injectiongraphql
vulnerability Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution Microsoft has patched a critical vulnerability in Entra ID, which has been exploited in the wild. The flaw allows remote code execution, and while Microsoft has addressed it, it highlights the ongoing need for vigilance… The Hacker News · Aug 21, 2026 Critical CVE-2026-69836CVE-2026-68820entria idazure adremote code execution
vulnerability Vulnérabilité dans Microsoft Entra ID (21 août 2026) A critical vulnerability (CVE-2026-69836) has been identified in Microsoft Entra ID, allowing for remote code execution. While initially reported as actively exploited, Microsoft has clarified that it is currently not be… CERT-FR · Aug 21, 2026 Critical CVE-2026-69836entria idremote code executioncve
threat-intel ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More This week’s ThreatsDay bulletin highlights a diverse range of security threats, including a Remote Code Execution vulnerability in Gogs, a sophisticated Mabna Institute cyber espionage campaign targeting universities and… The Hacker News · Aug 20, 2026 Critical CVE-2026-52813CVE-2026-52810CVE-2026-43774IRUSrcecyber espionagegit hooks
vulnerability Hackers Target Zimbra Servers in Active Exploitation Campaign A recently patched Zimbra vulnerability (CVE-2026-73570) is currently being actively exploited by threat actors, primarily linked to Russian and Chinese state-sponsored hackers. Attackers are leveraging this flaw to gain… SecurityWeek · Aug 20, 2026 Critical CVE-2026-73570PLzimbravulnerabilitysnmp
vulnerability Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE A critical vulnerability in isolated-vm, a popular JavaScript sandbox library, allows attackers to escape the sandbox environment and potentially execute code on the host system. The flaw stems from a type confusion issu… The Hacker News · Aug 20, 2026 Critical vulnerabilitysandboxjavascript
vulnerability Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution A critical security flaw in Zimbra Collaboration (ZCS) has been actively exploited in the wild, allowing attackers to execute arbitrary commands without authentication. The vulnerability, CVE-2026-73570, stems from impro… The Hacker News · Aug 20, 2026 Critical CVE-2026-73570CVE-2025-66376PLsnmpcommand injectionremote code execution
vulnerability MLflow Vulnerability Exploited for Cloud Credential Theft A vulnerability in MLflow, a popular AI engineering platform, has been exploited by threat actors to steal cloud credentials and secrets. The flaw, tracked as CVE-2026-64849, allows unauthenticated SSRF attacks, leading… SecurityWeek · Aug 20, 2026 Critical CVE-2026-64849ssrfcloudmlflow
vulnerability Johnson Controls Simplex Incident Manager A critical vulnerability in Johnson Controls Simplex Incident Manager allows a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading… CISA Advisories · Aug 20, 2026 Critical CVE-2026-27875memory-dumpingcredential theftbuilding automation
vulnerability Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler Citrix has announced patches for a critical authentication bypass vulnerability in its NetScaler ADC and NetScaler Gateway products. This flaw, with a CVSS score of 9.3, allows unauthenticated remote attackers to gain ac… SecurityWeek · Aug 20, 2026 Critical CVE-2026-19490CVE-2026-19489patchauthenticationvulnerability
vulnerability Critical GitLab Flaw Exploited Shortly After Disclosure A critical vulnerability in GitLab (CVE-2026-19478) was quickly exploited by threat actors shortly after its disclosure. The code injection flaw allowed unauthenticated users to delete public projects and modify user dat… SecurityWeek · Aug 20, 2026 Critical CVE-2026-19478gitlabvulnerabilitygraphql
threat-intel Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation Four critical vulnerabilities – affecting macOS, SharePoint, vCenter, and IKE – are currently being actively exploited in the wild. These flaws have led to widespread attacks, including the deployment of ransomware and b… The Hacker News · Aug 19, 2026 Critical CVE-2026-65400CVE-2026-55040CVE-2026-59310DEUSTRvulnerabilitycyberattackransomware
threat-intel CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities The CISA has issued an urgent warning about four actively exploited vulnerabilities affecting Microsoft, VMware, and Apple products. These flaws, including a double-free in Windows IKE and a weak authentication bypass in… SecurityWeek · Aug 19, 2026 Critical CVE-2026-33824CVE-2026-55040CVE-2026-59310CHvulnerabilitypatchingremote code execution
vulnerability Critical GitLab Zero-Click Flaw Poses Mitigation Challenges GitLab has released an out-of-band security update addressing two critical vulnerabilities, CVE-2026-19478 and CVE-2062-19650, that could allow unauthenticated attackers to manipulate or delete data. The vulnerabilities… Dark Reading · Aug 18, 2026 Critical CVE-2026-19478CVE-2026-19650graphqlcvezero-click
threat-intel Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets Two critical vulnerabilities are being actively exploited to steal cloud credentials and secrets. MLflow (versions < 3.15.0) is experiencing SSRF attacks, allowing attackers to access cloud metadata and exfiltrate sensit… The Hacker News · Aug 18, 2026 Critical CVE-2026-64849CVE-2026-25895CVE-2026-25939ssrfpath traversalremote code execution
vulnerability 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw A critical vulnerability in the Forminator Forms plugin for WordPress is exposing over 300,000 websites to potential remote code execution attacks. The flaw stems from inadequate file type validation, allowing attackers… SecurityWeek · Aug 18, 2026 Critical CVE-2026-15748wordpressvulnerabilityrce
vulnerability GitLab Patches Critical Code Injection Vulnerability GitLab has released patches to address two critical vulnerabilities, including a code injection flaw that could allow unauthorized data modification and deletion. These vulnerabilities affected multiple versions of GitLa… SecurityWeek · Aug 18, 2026 Critical CVE-2026-19478CVE-2026-19650vulnerabilitygraphqlcve
