Critical vulnerabilities, curated daily for security professionals
Today's Security Brief
Consumer and small-office network hardware led yesterday's disclosures, with EFM ipTIME A3004T (CVE-2026-19977, CVSS 10) and two Edimax EW-7478APC flaws (CVE-2026-19961 and CVE-2026-19959, both CVSS 9.9) exposing internet-facing router and access point management to remote compromise. The day produced 10 critical CVEs, down 64% from the prior day's 28, alongside 104 high-priority CVEs, up 32% from 79. Server-side software also featured prominently: CVE-2026-15623 (CVSS 9.4) affects Google Cloud SecOps (Chronicle SOAR), while CVE-2026-73061 and CVE-2026-74790 both hit the scriban templating library, a dependency risk for .NET applications embedding user-supplied templates. Web application platforms account for much of the remaining volume, including Joomla's Phoca Cart extension (CVE-2026-74251, CVSS 9.3), WP Directory Kit (CVE-2026-18473, CVSS 9.1), and siyuan-note (CVE-2026-73056, CVSS 9.8), with remote code execution and authentication bypass the dominant patterns. Three CVEs have confirmed active exploitation, affecting Cisco Secure Firewall ASA/FTD, Metabase, and the Windows Ancillary Function Driver for WinSock. Patch availability is recorded at 0% in the collected data, so verify fix status directly with each vendor before scheduling remediation.
Patch availability recorded at 0% across the collected set, including the Joomla Phoca Cart and WP Directory Kit web extensions
3 CVEs with confirmed active exploitation: Cisco Secure Firewall ASA/FTD, Metabase, and Windows Ancillary Function Driver for WinSock
Immediate action: Prioritize the actively exploited issues first: Cisco Secure Firewall ASA/FTD (CVE-2026-20349), Metabase (CVE-2026-72898), and the Windows Ancillary Function Driver for WinSock (CVE-2026-68820). Next, inventory internet-exposed EFM ipTIME and Edimax devices, restrict their management interfaces to trusted networks, and audit .NET services and Joomla or WordPress sites for the affected scriban, Phoca Cart, and WP Directory Kit components. Patch availability is not confirmed for any of today's critical items, so check vendor advisories directly and apply network-level mitigations where fixes are not yet published.
How to read this brief
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges — the access they need first. No privileges means no login required.
No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
🔴 Actively exploited in the wildIn CISA KEV since August 11, 2026
Cisco Secure Firewall ASA and FTD contain a heap inspection vulnerability due to improper memory clearing, which is currently being exploited in the wild.
Network · No privileges · No interactionEPSS 95th percentile
🔴 Actively exploited in the wildIn CISA KEV since August 11, 2026
Metabase contains a critical SQL injection vulnerability in the password reset endpoint that allows unauthenticated remote attackers to gain full administrative control over the instance.
A SQL injection vulnerability in a legacy dashboard widget API of Google SecOps (Chronicle SOAR) allows authenticated attackers to execute unauthorized blind SQL queries.
An unauthenticated SQL injection vulnerability in the Phoca Cart extension for Joomla allows attackers to extract database content via malicious GET parameters.
The WP Directory Kit WordPress plugin before 1.5.5 contains a SQL injection vulnerability that allows unauthenticated users to execute arbitrary database queries.
A stack-based buffer overflow in the Edimax EW-7478APC formWanTcpipSetup function allows remote attackers to execute arbitrary code via the pppUserName argument.
A session validation vulnerability in EFM ipTIME A3004T 14.19.0 allows unauthenticated remote attackers to bypass authentication mechanisms via the httpcon_check_session_url function.
The SiYuan kernel before 3.7.4 fails to restrict excessive authentication attempts, allowing unauthenticated attackers to brute-force API tokens and gain administrative access.
The Scriban template engine contains an access-modifier bypass vulnerability in TypedObjectAccessor, allowing unauthenticated attackers to perform unauthorized writes to CLR object properties.
Scriban fails to properly cache TypedObjectAccessor by Type, allowing attackers to reuse TemplateContext instances to bypass sandbox policies and access restricted members across different requests.
A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to release an expression object, the program still retains the dangling pointer and subsequently accesses member fields of the already freed memory. By constru
The Eventin WordPress plugin fails to validate template path settings, allowing authenticated users to perform local file inclusion and execute arbitrary PHP code.
A memory management flaw in the Linux kernel allows local attackers to trigger a use-after-free condition by incorrectly handling i_mmap_rwsem during page splitting.
An input validation vulnerability in the Linux kernel hwmon driver allows local attackers to access unsupported weight registers via the nct6775-core driver.
The vitepos WordPress plugin lacks per-target authorization in its password-reset API, allowing low-privileged Outlet Managers to reset administrative account passwords.
The WPC Order Tip for WooCommerce plugin before 3.3.1 fails to enforce authorization checks, allowing unauthenticated attackers to access sensitive customer order data.
The Autopay WordPress plugin is vulnerable to stored cross-site scripting (XSS) due to a lack of capability checks and input sanitization on its styling options.
The Arvow AI SEO Writer WordPress plugin contains an authentication bypass vulnerability due to improper REST endpoint access control, allowing unauthenticated attackers to perform unauthorized actions.
The GeoDirectory WordPress plugin contains an authorization bypass that allows unauthenticated users to access non-public listing data via the markers REST endpoint.
An authentication bypass vulnerability exists in the Linux kernel s390 qeth driver, where specific ioctl commands lack proper CAP_NET_ADMIN privilege checks.
A vulnerability in the Linux kernel KVM subsystem allows improper handling of x2APIC MSR intercepts when AVIC is inhibited, potentially leading to privilege escalation or system instability.
Crypt::OpenSSL::PKCS12 before 1.98 for Perl is vulnerable to a NULL pointer dereference in print_attribute when processing zero-length BMPSTRING attributes.
An input validation flaw in the Linux kernel vmwgfx DRM driver allows an attacker to trigger an out-of-bounds memory access by providing a crafted DMA command.
A vulnerability in the Linux kernel SCTP implementation allows a local attacker with low privileges to trigger an integer overflow, potentially leading to memory corruption.
A use-after-free vulnerability in the Linux kernel mac80211 subsystem occurs during BA session termination, potentially allowing for arbitrary code execution.
A use-after-free vulnerability in the Linux kernel TIPC module, specifically within poll trace queue dumps, could lead to system instability or unauthorized access.
The Linux kernel Bluetooth HIDP subsystem fails to validate transaction headers in L2CAP SDU frames, potentially leading to unauthorized memory access.
The KVM s390 PCI implementation in the Linux kernel improperly handles adapter interrupt registration, allowing for a potential denial of service or privilege escalation.
A use-after-free vulnerability exists in the Linux kernel iommufd component, specifically within the iopf_group_alloc function, due to improper management of IOPF group ownership.
A use-after-free vulnerability in the Linux kernel ksmbd module allows potential exploitation when a file reference persists after a logical close operation.
An improper hardware state management vulnerability in the octeontx2-af driver allows virtual functions to overwrite critical PKIND state, potentially leading to cross-tenant data leakage.
The Linux kernel contains a use-after-free vulnerability in the Bluetooth hci_sync component due to improper connection handling during task execution.
A race condition in the Linux kernel Bluetooth ISO implementation leads to a double-put of iso_conn, potentially causing a use-after-free vulnerability.
A deadlock vulnerability exists in the Linux kernel Bluetooth ISO socket timeout handling, where improper lock management during timer disabling can cause a system hang.
Improper socket reference handling in the Linux kernel Bluetooth ISO connection ready state can lead to a concurrent close and potential use-after-free.
An out-of-bounds clear_bit vulnerability exists in the Linux kernel's ath12k Wi-Fi driver, specifically within the ath12k_mac_dp_peer_cleanup function.
A use-after-free vulnerability in the Linux kernel Thunderbolt XDomain implementation allows for potential memory corruption during device disconnection.
A resource exhaustion vulnerability in the Scriban template engine allows unauthenticated attackers to cause a denial-of-service via excessive resource allocation.
An authorization bypass vulnerability in the Scriban template engine allows attackers to access sensitive data due to improper handling of stale include caches.
A security vulnerability exists in the Acer Planet9 background service due to incorrect file permissions on an application executable, allowing local privilege escalation to SYSTEM.
An improper memory handling vulnerability in the Linux kernel netfilter ipset module occurs during resize operations, leading to potential memory corruption.
A vulnerability in the OPPO Health application allows the loading of arbitrary external URLs within WebView components, leading to potential token theft.
Multiple GL.iNet router models are susceptible to an authorization bypass vulnerability in the WebDAV public-share feature, allowing unauthenticated access to shared resources.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem allows local attackers to potentially trigger memory corruption during hci_past_sync operations.
A race condition in the Linux kernel Bluetooth ISO socket implementation allows for unauthorized access due to improper locking during socket name retrieval.
A memory management flaw in the Linux kernel drm/xe driver allows local users to trigger improper synchronization of external buffer object kernel fences during execution.
An integer division vulnerability in the Linux kernel vmwgfx driver allows local attackers to trigger a crash or memory corruption via malformed DRAW_PRIMITIVES command headers.
An integer overflow vulnerability in the Linux kernel amdkfd driver allows local authenticated users to cause memory corruption via improper ring buffer size alignment.
A divide-by-zero vulnerability exists in the Linux kernel's AMD display driver when handling zero-area viewports, potentially leading to system instability.
A use-after-free vulnerability in the Linux kernel amdgpu driver allows local attackers to trigger memory corruption via improper handling of power tables.
A vulnerability in the Linux kernel DRM Panthor driver allows for insufficient validation of firmware interface structure sizes, potentially leading to memory corruption.
A vulnerability in the Linux kernel DRM Panthor driver fails to validate firmware section data sizes, potentially leading to heap-based buffer overflows.
A memory disclosure vulnerability in the Linux kernel VC4 DRM driver allows data from previous jobs to remain in memory, potentially exposing sensitive information.
A memory management error in the Linux kernel DRM/VC4 driver allows for improper buffer sizing during overflow handling, potentially leading to memory corruption.
A double-free vulnerability exists in the Linux kernel CAN/peak_usb driver due to improper handling of transfer buffers when URB submission errors occur.
A vulnerability in the Linux kernel scsi_debug driver allows for an out of bounds write due to an allocation length underflow in the resp_report_zones function.
A vulnerability in the Linux kernel tracing subsystem occurs when the return value of __register_event is ignored, leading to potential system instability.
A use after free vulnerability in the Linux kernel page reporting mechanism during system suspend allows for potential memory corruption or privilege escalation.
A use after free vulnerability in the Linux kernel ALSA timer component occurs because a death flag is not correctly cleared, allowing for potential memory corruption.
A Use-After-Free (UAF) vulnerability in the Linux kernel AFS filesystem component arises from a race condition during asynchronous call reception and destruction.
A use-after-free vulnerability exists in the Linux kernel audit subsystem within the audit_del_rule function, potentially allowing for memory corruption.
A use-after-free vulnerability in the Linux kernel DIBS (Distributed Inter-process Buffer System) loopback implementation, specifically in attach, detach, and unregister functions.
A local privilege escalation vulnerability exists in the Linux kernel dmaengine idxd driver due to improper cleanup of file-device references during setup failures.
A denial of service vulnerability in Scriban allows remote, unauthenticated attackers to cause resource exhaustion via specifically crafted array multiplication operations.
A deadlock vulnerability in the Linux kernel qede driver recovery path allows a local attacker to cause a system hang by triggering a TX timeout on a NIC with configured tunnel ports.
A vulnerability in the Linux kernel network stack allows for un-rate-limited ICMP/NDISC Redirect messages when peer allocation fails, potentially leading to resource exhaustion.
A deadlock vulnerability exists in the Linux kernel btrfs filesystem driver during metadata writeback, potentially leading to a system denial of service.
An unbounded recursion vulnerability in the Linux kernel slab allocator can occur during the free path, potentially leading to a system crash or denial of service.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: track the connection owning a byte-range lock
SMB2_LOCK adds each granted byte-range lock to both the file lock list
and the lock list of the connection which handled the request.
The Xen hypervisor contains a sysctl vulnerability where improper lock acquisition order allows authenticated, less privileged entities to contend for locks before necessary permission checks occur.
The Xen hypervisor is affected by a denial of service vulnerability where an unfair lock acquisition mechanism for platform operations allows an authenticated actor to stall critical management functions.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: prevent path traversal bypass by restricting caseless retry
ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path
resolution within the share root.
CVE-2026-64266
7.8
LinuxLinux
Local · Low privileges · No interaction
In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before returning from fuse_ref_folio()
fuse_ref_folio() unlocks the request but does not re-lock it before
returning.
CVE-2026-64423
7.8
LinuxLinux
Local · Low privileges · No interaction
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: remove multicast group from hash table on device destruction
When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through
the multicast list and calls ip_ma_put() on each membership, scheduling
them for.
CVE-2026-64431
7.8
LinuxLinux
Local · Low privileges · No interaction
In the Linux kernel, the following vulnerability has been resolved:
ntfs: avoid calling post_write_mst_fixup() for invalid index_block
ntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write()
returns an error, intending to restore the buffer after a failed write.