Apple macOS Improper Authentication Vulnerability

#Apple 
🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-65400.

What it is

CVE-2026-65400 is an improper authentication flaw in macOS Screen Sharing. The vulnerability allows an attacker on the network to authenticate to Screen Sharing without supplying valid credentials.

[]

Broadcom VMware vCenter Path Traversal Vulnerability

#Broadcom 
🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-59310.

What it is

CVE-2026-59310 is a path traversal vulnerability in Broadcom VMware vCenter. It has a CVSS score of 9.8 (Critical), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — meaning it is reachable over the network, requires low attack complexity, needs no privileges and no user interaction, and results in full compromise of confidentiality, integrity and availability.

[]

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

#Microsoft 
🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-33824.

What it is

CVE-2026-33824 is a double free vulnerability in Microsoft’s Internet Key Exchange (IKE) Service Extensions. The IKE service handles key negotiation for IPsec, and on Windows this typically runs as part of the IKE/AuthIP IPsec Keying Modules service, which listens on the network to negotiate security associations with peers.

[]

Microsoft SharePoint Weak Authentication Vulnerability

#Microsoft 
🚨SEVERITY: CRITICAL — CVSS 9.1Security Advisory

TL;DR 📌

  • Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
  • Highest CVSS: 9.1 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-55040.

What it is

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

[]

Ray-Project Ray Code Injection Vulnerability

#Ray-Project 
🚨SEVERITY: CRITICAL — CVSS 9.4Security Advisory

TL;DR 📌

  • Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.
  • Highest CVSS: 9.4 (Critical).
  • Listed in CISA KEV (2026-08-18) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-62593.

What it is

Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

[]

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

#Cisco 
🚨SEVERITY: HIGH — CVSS 8.6Security Advisory

TL;DR 📌

  • Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
  • Highest CVSS: 8.6 (High).
  • Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-20349.

What it is

CVE-2026-20349 is a heap inspection vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD). The flaw sits in the code handling heap memory on affected devices.

[]

Metabase SQL Injection Vulnerability

#Metabase 
🚨SEVERITY: CRITICAL — CVSS 10.0Security Advisory

TL;DR 📌

  • Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export…
  • Highest CVSS: 10.0 (Critical).
  • Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-72898.

What it is

CVE-2026-72898 is a SQL injection vulnerability in Metabase. An unauthenticated remote attacker can inject arbitrary SQL into the Metabase application database over the network, with no user interaction required.

[]

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

#Microsoft 
🚨SEVERITY: HIGH — CVSS 7.0Security Advisory

TL;DR 📌

  • Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
  • Highest CVSS: 7.0 (High).
  • Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-68820.

What it is

CVE-2026-68820 is a use-after-free vulnerability in the Ancillary Function Driver for WinSock (AFD.sys), the kernel-mode driver that underpins Windows socket operations. It sits on the local attack surface, not the network data plane: exploitation requires local access and low-privilege authentication on the target host.

[]

Progress LoadMaster Command Injection Vulnerability

#Progress 
🚨SEVERITY: CRITICAL — CVSS 9.6Security Advisory

TL;DR 📌

  • Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.
  • Highest CVSS: 9.6 (Critical).
  • Listed in CISA KEV (2026-08-07) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-8037.

What it is

CVE-2026-8037 is a command injection vulnerability in Progress LoadMaster, the vendor’s load balancer/ADC appliance. The flaw sits in multiple command endpoints where input is not properly sanitised before being passed through to the underlying system.

[]

Cisco Catalyst SD-WAN Software Security Hardening Release: August 2026

#Cisco  #Cisco Catalyst SD-WAN Manager  #Cisco Catalyst SD-WAN Controller 
🚨SEVERITY: CRITICAL — CVSS 9.9Security Advisory

TL;DR 📌

  • As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To…
  • Highest CVSS: 9.9 (Critical).
  • Fix available — see the first fixed release below.
  • CVEs: CVE-2026-20303, CVE-2026-20304, CVE-2026-20310.

What it is

As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

[]