📰 DAILY THREAT BRIEFING
Monday, July 27, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of July 27, 2026.

  1. Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th)
    — SANS ISC

    ESAFENET's CDG showed up in our data before. The company focused on secure document management and data leakage preventio…
  2. GitHub, PyPI add time-based defenses against supply chain attacks
    — Bleeping Computer

    GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect agains…
  3. Steam forum ClickFix attacks infect gamers with XMRig cryptominers
    — Bleeping Computer

    Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect dev…
  4. Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
    — The Hacker News

    A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun …
  5. Malicious sites use JavaScript to build malware in browser memory
    — Bleeping Computer

    A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to as…
  6. Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
    — The Hacker News

    Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected …
  7. Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
    — The Hacker News

    Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on Ju…
  8. CISOs vs. Boards: Myth or Misunderstanding?
    — Dark Reading

    Escalating threats are forcing boards to prioritize security, but communication gaps persist. Boards and security teams each say they need m…
  9. Escape Artists: 'Incorrigible' AI Models Resist Rehabilitation
    — Dark Reading

    The hacking of Hugging Face by a rogue OpenAI agent is significant, but unsurprising — and preventing the next AI model escape will be dif…
  10. Vatican's Official Prayer App Leaks 700K+ Global Users' PII
    — Dark Reading

    A porous API endpoint exposes, names, email addresses, country, and site status, all of which can be easily gleaned by anyone with a browser…
  11. ISC Stormcast For Friday, July 24th, 2026 https://isc.sans.edu/podcastdetail/10022, (Fri, Jul 24th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. Russian Global Webmail Espionage
    — Unit 42

    Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (8976 in last 30 days).
Critical: 1 · High: 6 · Medium: 8 · Low: 1. View full dashboard →

  1. CVE-2026-57990
    — CVSS 7.4 (HIGH)

    Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
  2. CVE-2026-57989
    — CVSS 7.4 (HIGH)

    Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
  3. CVE-2026-57978
    — CVSS 5.4 (MEDIUM)

    Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
  4. CVE-2026-17497
    — CVSS 8.3 (HIGH)

    NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview…
  5. CVE-2026-17496
    — CVSS 8.1 (HIGH)

    NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to nu…
  6. CVE-2026-17459
    — CVSS 4.3 (MEDIUM)

    A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component Sp…
  7. CVE-2026-17458
    — CVSS 6.3 (MEDIUM)

    A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation …
  8. CVE-2026-17457
    — CVSS 4.3 (MEDIUM)

    A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such m…
  9. CVE-2026-63720
    — CVSS 7.5 (HIGH)

    datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value cont…
  10. CVE-2026-17434
    — CVSS 6.3 (MEDIUM)

    A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to impro…
  11. CVE-2026-17433
    — CVSS 5.3 (MEDIUM)

    A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulat…
  12. CVE-2026-15962
    — CVSS 8.8 (HIGH)

    The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated att…
  13. CVE-2026-17432
    — CVSS 5.0 (MEDIUM)

    A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gatewa…
  14. CVE-2026-10681
    — CVSS 6.5 (MEDIUM)

    In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index from the global _thread_idx_map[] bitmap without holding lists_lock.

    On SMP sys…

  15. CVE-2026-66012
    — CVSS 10.0 (CRITICAL)

    SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This expose…
  16. CVE-2026-66011
    — CVSS 3.3 (LOW)

    ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-l…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · July 27, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com