📰 DAILY THREAT BRIEFING
Thursday, August 27, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of August 27, 2026.

  1. Critical Avada WordPress theme flaw enables zero-click RCE
    — Bleeping Computer

    A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary…
  2. Dark Caracal Adds New Malware to Cyber Espionage Arsenal
    — Dark Reading

    GoCaracal is a new modular malware framework that broadens Dark Caracal's capabilities to steal data and maintain access to victims.
  3. Red Flags That Expose Fake North Korean IT Workers
    — Dark Reading

    North Korean operatives posing as IT workers are improving their tactics, but researchers say there are still ways to spot them before they …
  4. New GPUThor attack defeats NVIDIA ECC protection for root access
    — Bleeping Computer

    A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-serv…
  5. Android Malware Hijacks Update System for Car Head Units
    — Dark Reading

    Threat actors behind a notorious click-fraud botnet have set their sights on vehicle infotainment modules and are abusing legitimate functio…
  6. FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
    — The Hacker News

    The U.S. Department of Justice (DoJ) on Wednesday announced the disruption of two hacking platforms named QScan and QTRouter operated by Chi…
  7. Meta agrees to $18 billion settlement over teen social media harms
    — Bleeping Computer

    Meta has reached a proposed settlement worth up to approximately $18 billion with a bipartisan coalition of 52 attorneys generals over alle…
  8. Who Has Admin Rights in your Entra ID Directory?, (Wed, Aug 26th)
    — SANS ISC

    A common thing that folks should "worry" about in Entra (or any platform really) is "who has rights to administer"?&&#x2…
  9. Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler
    — The Hacker News

    Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an…
  10. NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
    — The Hacker News

    Cybersecurity researchers have disclosed details of a new adversary-in-the-middle (AitM) phishing toolkit called NovaCookies that's used as …
  11. ISC Stormcast For Wednesday, August 26th, 2026 https://isc.sans.edu/podcastdetail/10068, (Wed, Aug 26th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
    — SANS ISC

    It is pretty obvious that hostnames can replace IP addresses. Pretty much any software accepting an IP address will also accept a hostname a…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (12523 in last 30 days).
Critical: 0 · High: 8 · Medium: 7 · Low: 4. View full dashboard →

  1. CVE-2026-81203
    — CVSS 7.3 (HIGH)

    A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql inj…
  2. CVE-2026-80158
    — CVSS 5.5 (MEDIUM)

    A flaw was found in the ipa_getkeytab module of the community.general
    Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared wi…
  3. CVE-2026-47666
    — CVSS 7.6 (HIGH)

    Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-…
  4. CVE-2026-47665
    — CVSS 8.7 (HIGH)

    Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendere…
  5. CVE-2026-21808
    — CVSS 4.1 (MEDIUM)

    HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural d…
  6. CVE-2026-21807
    — CVSS 3.9 (LOW)

    HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow.
  7. CVE-2025-62341
    — CVSS 3.7 (LOW)

    HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosur…
  8. CVE-2026-81202
    — CVSS 7.3 (HIGH)

    A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argum…
  9. CVE-2026-77611
    — CVSS 7.1 (HIGH)

    SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope b…
  10. CVE-2026-77368
    — CVSS 7.6 (HIGH)

    SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant …
  11. CVE-2026-77317
    — CVSS 8.1 (HIGH)

    SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path…
  12. CVE-2026-61617
    — CVSS 7.7 (HIGH)

    Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant …
  13. CVE-2026-45694
    — CVSS 5.4 (MEDIUM)

    LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, wh…
  14. CVE-2026-43621
    — CVSS 0.0 (NONE)

    Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator acces…
  15. CVE-2026-21810
    — CVSS 4.4 (MEDIUM)

    HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.
  16. CVE-2026-21809
    — CVSS 3.9 (LOW)

    HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance an…
  17. CVE-2026-77573
    — CVSS 3.5 (LOW)

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery agai…
  18. CVE-2026-77507
    — CVSS 5.3 (MEDIUM)

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing una…
  19. CVE-2026-62326
    — CVSS 6.5 (MEDIUM)

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source …
  20. CVE-2026-62249
    — CVSS 4.3 (MEDIUM)

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted comp…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · August 27, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com