Wednesday, August 19, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Oracle enterprise middleware, Microsoft cloud and collaboration services, and Mozilla browser products account for the highest-impact vulnerabilities disclosed yesterday, several carrying maximum CVSS 10 ratings. The set includes 54 critical CVEs (up 29% from the prior day) and 101 high-priority CVEs (up 6%), for 155 scored vulnerabilities overall. CVE-2026-66803 (CVSS 10) in Microsoft Azure Cosmos DB, CVE-2026-70921 (CVSS 10) in Oracle Hyperion Financial Management, and CVE-2026-75874 (CVSS 10) in Mozilla Firefox and Thunderbird are the most severe individual entries, alongside CVE-2026-75843 and CVE-2026-75851 (CVSS 9.9) in ArcadeData ArcadeDB. Remote code execution and authentication bypass against internet-reachable management and identity components dominate the pattern, with Oracle Identity Manager Connector, Oracle Workflow, Apple macOS, and TRENDnet TEW-WLC100 wireless controllers also affected. Vendor patch data was unavailable for these records at collection time, so teams should verify fix status directly with vendors and prioritize by exposure; five vulnerabilities, including issues in Microsoft Windows, Microsoft SharePoint, VMware Cloud Foundation, Ray-Project Ray, and Apple macOS, have confirmed active exploitation.

  • Oracle carries the largest critical footprint, spanning Hyperion Financial Management (CVSS 10), Identity Manager Connector (CVSS 9.9), and Oracle Workflow (CVSS 9.8)
  • 54 critical CVEs (CVSS 9.0+), a 29% increase over the prior day's 42
  • 101 high-priority CVEs (CVSS 7.0 to 8.9), a 6% increase over the prior day's 95
  • Remote code execution and authentication bypass lead the attack patterns, affecting Microsoft Azure Cosmos DB, Mozilla Firefox and Thunderbird, ArcadeData ArcadeDB, and TRENDnet TEW-WLC100 controllers
  • Patch availability recorded at 0% across the collected set, including Apple macOS (CVE-2026-28982, CVSS 9.8) and the Oracle middleware issues, so confirm fix status with vendor advisories
  • 5 vulnerabilities have confirmed active exploitation, covering Microsoft Windows, Microsoft SharePoint, VMware Cloud Foundation and vCenter, Ray-Project Ray, and Apple macOS

Immediate action: Prioritize Oracle middleware and identity components, Microsoft Azure Cosmos DB and SharePoint, VMware Cloud Foundation and vCenter, and Mozilla Firefox and Thunderbird deployments, starting with any instance reachable from untrusted networks. Vendor fix data was not recorded for these entries, so check the relevant advisories directly and apply available updates or documented mitigations; where no fix exists, restrict management interface access and increase monitoring on the affected services.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation