A critical vulnerability with a maximum severity score of 10 has been discovered in SAP Commerce Cloud, with initial exploitation attempts already underway. The flaw's perfect severity rating combined with apparent ease of exploitation presents an immediate risk to organizations running this platform.
Wiz Red Agent autonomously identified and exploited a GitHub Actions injection vulnerability that bypassed GitHub's Advanced Security controls, gaining access to Snowflake's internal Jira and sensitive data within five days of the flaw going live. The vulnerability originated in a pull request assisted by GitHub Copilot, highlighting gaps in automated security detection. The red team agent independently assessed the breach's potential impact without requiring human direction.
A critical vulnerability in the WordPress User Profile Builder plugin exposed approximately 40,000 websites to unauthenticated admin account takeover attacks. The flaw allowed attackers without credentials to gain administrator-level access, posing a severe risk to affected installations.
CISA has added CVE-2025-62593, a code injection vulnerability in Ray-Project Ray, to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation. The vulnerability is classified as a frequent attack vector posing significant risk to federal systems, and federal agencies are required under BOD 26-04 to prioritize its remediation on publicly exposed assets. CISA encourages all organizations to adopt risk-based vulnerability management and address KEV Catalog vulnerabilities with urgency.
Attackers are actively exploiting a vulnerability in Mac Screen Sharing to achieve root-level access and deploy Monero cryptominers on affected systems. Apple has released patches to address this flaw, making immediate updates essential for Mac users to prevent compromise.
Security researchers at SSD Secure Disclosure have disclosed a two-stage exploit chain affecting Unisoc modem firmware that achieves full Android kernel access via VoLTE video calls, with no patch available from the chipset manufacturer. The vulnerability represents the second stage of an exploit chain that started with a remote code execution disclosure in March 2026, escalating the threat to complete kernel-level compromise on affected devices.
With more patches per month than at a pirate convention, the bug must be an endangered species. Well, about that
Dealing with machine-made bug backlog makes it hard to find a moment to deliver promised subscription service
Metasploit Framework 6.5 introduces 13 new exploit modules targeting critical vulnerabilities across WordPress, Ghost CMS, Joomla, SonicWall, and Linux systems, alongside support for malleable HTTP profiles and Windows AArch64 payloads. The release includes significant enhancements to the Model Context Protocol (MCP) server functionality, improved Kerberos ticket tracing, and multi-fetch payload capabilities, alongside 15 bug fixes addressing validation, port conflict handling, and SMB service registration issues.
Driven by AI-augmented research and scanning, vulnerability volumes continue to surge, driving the National Institute of Standards and Technology to ask whether AI could be the answer.
Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded. You know the drill - it’s the typical enterprise “please don’t be
Exploitation against CVE-2026–59310 began earlier this month, and patching the vulnerability may not be enough to fully mitigate the threat.
And will today’s surge in AI-driven vulnerability discovery eventually make tomorrow’s software safer?
Attackers wasted little time in exploiting a critical-severity vCenter vulnerability, with active exploitation occurring just five days after Broadcom's disclosure. The rapid weaponization underscores the heightened risk window organizations face when critical flaws are publicly revealed, emphasizing the urgency of patch deployment for vCenter deployments.
CISA has issued an advisory for CVE-2026-18164 affecting Flow Neuroscience FL-100 brain stimulation devices, which contain hard-coded credentials that allow attackers within Bluetooth range to manipulate stimulation parameters and override safety limits. The vulnerability, with a CVSS score of 8.1, impacts devices manufactured before July 2026 and requires physical proximity to exploit. Users are advised to install the latest firmware updates via the Flow app to remediate the issue.
Siemens Siveillance Video Management Servers contain a critical OS command injection vulnerability (CVE-2026-3014, CVSS 9.1) affecting versions V2023 R3, V2024 R1, and V2025, which could allow users with edit permissions to execute arbitrary code. Siemens has released patched versions and recommends immediate updates to V23.3.27, V24.1.16, or V25.1.15 respectively. CISA advises protecting network access to affected systems and implementing defense-in-depth strategies to minimize exploitation risk.
Siemens License Server (SLS) contains two critical vulnerabilities: CVE-2026-69108, a local privilege escalation flaw in versions before 5.1 that could allow root-level command execution, and CVE-2026-69109, a path traversal vulnerability in versions before 5.3 that permits remote arbitrary file access. Siemens recommends immediate patching to the latest versions and advises restricting network access to the affected systems as a precautionary measure.
Siemens Parasolid versions V38.0 (before 38.0.235) and V38.1 (before 38.1.230) contain an out-of-bounds read vulnerability (CVE-2026-64629) triggered when parsing specially crafted X_T format files, which could allow attackers to crash the application or execute arbitrary code with a CVSS score of 7.8. Siemens has released patched versions and recommends immediate updates to mitigate the risk to critical manufacturing infrastructure worldwide.
A persistent cross-site scripting vulnerability in Johnson Controls Metasys building automation systems (CVE-2026-34491) allows low-privilege users to inject malicious payloads via crafted URLs that execute in other users' sessions, including administrators, with a CVSS score of 8. Affected versions include Metasys 12 and 13 (end of support), Metasys 14 prior to v14.1.5, and Metasys 15 prior to v15.0.1, while patches or fixes are available for later versions. CISA recommends restricting network access to the Metasys UI, implementing network segmentation, enforcing least-privilege access, and deploying web application firewalls to mitigate exploitation risk.
View CSAF Summary Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges. The following versions of Haiwell IoT Cloud HMI Gateway are affected: Haiwell IoT Cloud HMI Gateway 3.40.1.12 (CVE-2026-19188) CVSS Vendor Equipment Vulnerabilities v3 10 Haiwell Haiwell IoT Cloud HMI Gateway Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrastructure Sectors: Energy, Critical Manufacturing, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-19188 A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges View CVE Details Affected Products Haiwell IoT Cloud HMI Gateway Vendor: Haiwell Product Version: Haiwell Haiwell IoT Cloud HMI Gateway: 3.40.1.12 Product Status: known_affected Remediations Mitigation Haiwell has addressed the issue in patch version number Scada-v3.50.1.19, which is available for download on their website: https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361 https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361 Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 10 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 4.0 10 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Acknowledgments Fiqram Akmal reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Revision History Initial Release Date: 2026-08-13 Date Revision Summary 2026-08-13 1 Initial Publication Legal Notice and Terms of Use