vulnerability CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability, CVE-2025-62593, to its Known Exploited Vulnerabilities (KEV) catalog in the Ray distributed computing framework. This v… The Hacker News · Aug 18, 2026 Critical CVE-2025-62593raycve-2025-62593dns rebinding
vulnerability ISC Stormcast For Tuesday, August 18th, 2026 https://isc.sans.edu/podcastdetail/10056, (Tue, Aug 18th) The ISC Stormcast highlighted a significant vulnerability in the latest version of Apache Log4j 2, potentially allowing attackers to execute arbitrary code through a log message. This vulnerability, alongside related exp… SANS Internet Storm Center · Aug 18, 2026 Critical log4jlog4j2apache
vulnerability Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects GitLab has released a critical security update to address a vulnerability (CVE-2026-19478) that could allow unauthenticated attackers to delete public projects and user data. The flaw, which was discovered outside of Git… The Hacker News · Aug 17, 2026 Critical CVE-2026-19478CVE-2026-19650vulnerabilitygraphqlcve
vulnerability Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads A critical security flaw in Forminator Forms (WordPress plugin) and User Profile Builder (WordPress plugin) allows unauthenticated attackers to execute arbitrary code on vulnerable sites. The Forminator vulnerability (CV… The Hacker News · Aug 17, 2026 Critical CVE-2026-15748CVE-2026-15826wordpressvulnerabilityremote code execution
vulnerability Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure A critical vulnerability in SAP Commerce Cloud was rapidly exploited by hackers just days after its public announcement. The flaw, tracked as CVE-2026-58231, allows for arbitrary code execution and poses a significant ri… SecurityWeek · Aug 17, 2026 Critical CVE-2026-58231CVE-2019-0344sapcommercevulnerability
vulnerability ISC Stormcast For Monday, August 17th, 2026 https://isc.sans.edu/podcastdetail/10054, (Mon, Aug 17th) The ISC Stormcast highlighted a significant vulnerability in the latest version of Apache Struts, potentially allowing for remote code execution via a deserialization attack. This vulnerability is actively being exploite… SANS Internet Storm Center · Aug 17, 2026 Critical strutsvulnerabilitydeserialization
vulnerability SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch A critical security vulnerability (CVE-2026-58231) in SAP Commerce Cloud is being actively exploited, despite a patch being available for days. The flaw stems from inadequate input validation, potentially leading to code… The Hacker News · Aug 15, 2026 Critical CVE-2026-58231CVE-2025-31324USsapvulnerabilitypatch
vulnerability Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner A critical vulnerability in Apple's macOS Screen Sharing component has been actively exploited in the wild to install a cryptocurrency miner. Researchers have discovered a pre-authentication vulnerability (CVE-2026-65400… The Hacker News · Aug 15, 2026 Critical CVE-2026-65400CVE-2026-43779CVE-2026-43777USmacosscreen sharingvulnerability
vulnerability Vulnérabilité dans les produits Sophos (14 août 2026) A critical vulnerability has been identified in Sophos products, allowing attackers to escalate privileges on macOS systems. This affects older versions of Intercept X Endpoint and Sophos Home, requiring immediate patchi… CERT-FR · Aug 14, 2026 Critical CVE-2026-18367macosvulnerabilityprivilege escalation
vulnerability GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE A newly discovered zero-day SQL injection vulnerability in GeoServer is currently being actively exploited. The vulnerability, which has been assigned a GitHub security advisory identifier (GHSA-mqjf-5f49-2fjh), allows f… The Hacker News · Aug 13, 2026 Critical CVE-2024-36401CVE-2023-25158CVE-2023-25157sql injectionzero-dayremote code execution
vulnerability Magento visé quelques heures après la divulgation d’un correctif A critical vulnerability (CVE-2026-71362) in Adobe Commerce, Commerce B2B, and Magento Open Source has been actively exploited shortly after its patch release. While no confirmed customer breaches have been publicly repo… ZATAZ · Aug 13, 2026 Critical CVE-2026-71362session hijackingpatchecommerce
vulnerability Adobe Commerce Bug Targeted Immediately After Disclosure A critical vulnerability in Adobe Commerce and Magento allowed unauthenticated attackers to gain access to other customer accounts immediately after its disclosure. Adobe swiftly released a patch, but threat actors were… SecurityWeek · Aug 13, 2026 Critical CVE-2026-71362vulnerabilityecommerceadobe
vulnerability Flow Neuroscience FL-100 A critical vulnerability has been identified in Flow Neuroscience devices (FL-100 and Halo Neuroscience FL-100) due to a hard-coded credential that allows an attacker within Bluetooth range to manipulate brain stimulatio… CISA Advisories · Aug 13, 2026 Critical CVE-2026-18164bluetoothvulnerabilityhardcoded
vulnerability Hitachi Energy APM Edge Product Hitachi Energy is issuing a security advisory regarding critical vulnerabilities in its APM Edge product, specifically versions 6.10 and earlier. These vulnerabilities, including a write-what-where condition and an out-o… CISA Advisories · Aug 13, 2026 Critical CVE-2026-43284CVE-2026-43500SWvulnerabilitycvelinux
vulnerability Siemens License Server (SLS) Siemens License Server (SLS) versions prior to 5.3 are vulnerable to two separate attacks: a local privilege escalation due to an insecure sudoers policy, allowing an attacker to execute arbitrary commands and plant mali… CISA Advisories · Aug 13, 2026 Critical CVE-2026-69108CVE-2026-69109vulnerabilitysudopath traversal
vulnerability Haiwell IoT Cloud HMI Gateway A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway, version 3.40.1.12. Exploitation could allow an attacker to execute arbitrary OS commands with root privileges, posin… CISA Advisories · Aug 13, 2026 Critical CVE-2026-19188cwe-78iotcommand injection
vulnerability Johnson Controls Metasys A vulnerability in Johnson Controls Metasys allows a low-privilege user to inject malicious code via a crafted URL, potentially leading to session hijacking and unauthorized access across multiple versions. The vulnerabi… CISA Advisories · Aug 13, 2026 Critical CVE-2026-34491cve-2026-34491xsscisa
vulnerability Fortinet Patches Authentication Flaws in FortiWeb and FortiManager Fortinet has released patches for eight security vulnerabilities across its products, including critical authentication flaws in FortiWeb and FortiManager. These vulnerabilities could allow attackers to gain unauthorized… SecurityWeek · Aug 13, 2026 Critical CVE-2026-26035CVE-2026-70468CVE-2026-70465vulnerabilityauthenticationpatch
threat-intel Critical VMware vCenter Vulnerability in Attackers’ Crosshairs A critical vulnerability (CVE-2026-59310) in VMware vCenter is being actively exploited by an advanced persistent threat (APT) group, leading to remote code execution and persistent access for attackers. The vulnerabilit… SecurityWeek · Aug 13, 2026 Critical CVE-2026-59310DEUSTRvulnerabilityremote code executionssh
vulnerability Belgium's eID Authentication Opens Citizen Accounts to RCE A critical vulnerability was discovered in Belgium's eID authentication system due to a severely flawed browser extension, "Connective." This vulnerability allowed attackers to steal Belgian citizens' identities, payment… Dark Reading · Aug 13, 2026 Critical BEbrowser extensionsrceidentity theft
