📰 DAILY THREAT BRIEFING
Sunday, August 16, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of August 16, 2026.

  1. New Evooo1Bot Linux botnet turns routers into traffic relay nodes
    — Bleeping Computer

    A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5…
  2. How Anthropic plans to watermark Claude's AI-generated text
    — Bleeping Computer

    It could soon become easier to identify AI-generated content, even if it's not the usual "It's Not X, it's Y" type of post you'd come across…
  3. Mission-Driven Security: Inside a Global Bank's Defense
    — Dark Reading

    In this video interview, Standard Chartered's group CISO shares insights on transitioning from technical roles to strategic leadership, the …
  4. Hackers arrested over €30M bank fraud exploiting service provider flaw
    — Bleeping Computer

    Four cybercriminals were arrested in Brazil, and three others were charged in Europe over allegations that they exploited a vulnerability at…
  5. Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI
    — Dark Reading

    Driven by AI-augmented research and scanning, vulnerability volumes continue to surge, driving the National Institute of Standards and Techn…
  6. Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office
    — Dark Reading

    One Caledonian government agency reported a breach, thanks to a third party that may have serviced other agencies as well.
  7. Who’s Tracking You? Use This New Service to Find Out
    — Krebs on Security

    It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we…
  8. ISC Stormcast For Friday, August 14th, 2026 https://isc.sans.edu/podcastdetail/10052, (Fri, Aug 14th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  9. Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
    — The Hacker News

    Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) c…
  10. ISC Stormcast For Thursday, August 13th, 2026 https://isc.sans.edu/podcastdetail/10050, (Thu, Aug 13th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  11. Using Gemma4 with Ollama – Testing File Hash Analysis and Recommendations with AI, (Wed, Aug 12th)
    — SANS ISC

    In the past few weeks, I have been using Gemma4 as a Large Language Model (LLM) to see how useful it can be to analyze some of the malware h…
  12. Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
    — The Hacker News

    The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impac…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (11514 in last 30 days).
Critical: 9 · High: 4 · Medium: 4 · Low: 3. View full dashboard →

  1. CVE-2026-19917
    — CVSS 6.3 (MEDIUM)

    A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulation of the argument checkbox can lead to sql injec…
  2. CVE-2026-73055
    — CVSS 4.8 (MEDIUM)

    Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox.…
  3. CVE-2026-73054
    — CVSS 7.5 (HIGH)

    SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Un…
  4. CVE-2026-73053
    — CVSS 9.0 (CRITICAL)

    SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that exe…
  5. CVE-2026-73052
    — CVSS 9.0 (CRITICAL)

    SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to…
  6. CVE-2026-73050
    — CVSS 9.0 (CRITICAL)

    SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler att…
  7. CVE-2026-73047
    — CVSS 6.2 (MEDIUM)

    siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig…
  8. CVE-2026-73046
    — CVSS 9.8 (CRITICAL)

    SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access…
  9. CVE-2026-73045
    — CVSS 7.5 (HIGH)

    SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish pass…
  10. CVE-2026-73044
    — CVSS 9.0 (CRITICAL)

    SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes. Attackers can inject malicious payloads through the setAttrViewCol…
  11. CVE-2026-73043
    — CVSS 9.0 (CRITICAL)

    SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can in…
  12. CVE-2026-73042
    — CVSS 9.0 (CRITICAL)

    SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through f…
  13. CVE-2026-73041
    — CVSS 9.0 (CRITICAL)

    SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF…
  14. CVE-2026-19916
    — CVSS 3.5 (LOW)

    A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulation of the argument dname results in cross si…
  15. CVE-2026-19906
    — CVSS 3.7 (LOW)

    A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulat…
  16. CVE-2026-19905
    — CVSS 7.3 (HIGH)

    A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This manipulation of the argument httpOID causes sql injection. It is…
  17. CVE-2026-18855
    — CVSS 9.1 (CRITICAL)

    The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll_delete_link_fields function in all versions up to, and including, 7.9.4 This makes it poss…
  18. CVE-2026-19904
    — CVSS 2.4 (LOW)

    A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation …
  19. CVE-2026-19903
    — CVSS 5.3 (MEDIUM)

    A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories a…
  20. CVE-2026-19901
    — CVSS 8.1 (HIGH)

    A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the at…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · August 16, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com