Saturday, August 8, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Google Chrome accounts for three of the day's critical entries (CVE-2026-17676, CVE-2026-17681 and CVE-2026-17666, all CVSS 9.1 to 9.6), alongside a cluster of unauthenticated WordPress plugin flaws and server-side deserialization in Apache Fory. The set totals 73 CVEs: 11 rated critical, down 45% from the prior day, and 62 rated high, up 94%. Notable critical items include CVE-2026-71558 (CVSS 9.8) in Apache Fory, CVE-2026-16258 (CVSS 9.8) in the WordPress Ajax Search Lite plugin, and CVE-2026-19264 (CVSS 9.8) in gitroomhq postiz-app. Six CVEs carry confirmed active exploitation, covering remote management and CI/CD infrastructure such as N-able N-central, Apache Tomcat, JetBrains TeamCity, IBM Langflow OSS and Progress LoadMaster. No vendor patch was recorded for any entry at collection time, so teams should prioritize compensating controls and exposure reduction while tracking vendor advisories for updates.

  • Google Chrome carries three critical CVEs (CVE-2026-17676, CVE-2026-17681, CVE-2026-17666) at CVSS 9.1 to 9.6, affecting every desktop deployment
  • 11 critical CVEs (CVSS 9.0+), a 45% decrease from the prior day's 20
  • 62 high-priority CVEs (CVSS 7.0 to 8.9), a 94% increase from the prior day's 32
  • Unauthenticated remote code execution and deserialization dominate: Apache Fory (CVE-2026-71558), HKUDS LightRAG (CVE-2026-61808) and postiz-app (CVE-2026-19264), plus three WordPress plugin flaws at CVSS 9.8
  • Patch availability recorded at 0% across the 73 disclosed CVEs, including internet-facing WordPress plugins and self-hosted AI and automation tooling
  • 6 CVEs show confirmed active exploitation, concentrated in remote management and build infrastructure (N-able N-central, Apache Tomcat, JetBrains TeamCity, IBM Langflow OSS, Progress LoadMaster)

Immediate action: Prioritize the actively exploited stack first: N-able N-central, Apache Tomcat, JetBrains TeamCity, IBM Langflow OSS and Progress LoadMaster, all of which are typically internet-reachable management or build systems. Follow with Chrome browser updates across endpoints and an audit of the affected WordPress plugins (Ajax Search Lite, WP Events Manager, AI Copilot Content Generator), which are unauthenticated and remotely reachable. No vendor patches were recorded for this set at collection time, so restrict external access, apply WAF or network controls where possible, and monitor vendor advisories for fixed releases.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation