Sunday, 16 August 2026

CVE-2024-58374 (CVSS 8.7): Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attacker (opens in a new tab)

NVD ·fetched 16 Aug 2026, 15:41 UTC Must read CVE-2024-58374 CVSS 8.7 EPSS 0.5% agreed3/3

Why readUnauthenticated SQL injection in Hongjing e-HR with exploitation observed in the wild by Shadowserver since 30 July 2024.

A path traversal sequence in the request URI bypasses the oauthservlet authentication filter and reaches the getSdutyTree servlet, where the unsanitised codeitemid parameter is concatenated into a Microsoft SQL Server query. UNION-based payloads return database contents including user credentials, with no authentication required. Shadowserver first recorded exploitation evidence on 2024-07-30, so anyone running this HR platform should treat it as already targeted rather than theoretical.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73532 (CVSS 9.3): Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update (opens in a new tab)

NVD ·fetched 16 Aug 2026, 15:41 UTC Must read CVE-2026-73532 CVSS 9.3 EPSS 0.5% agreed3/3

Why readFluent Forms Pro 6.2.7 was not a buggy release but a trojanised build, and removing the plugin does not remove the backdoor.

A tampered Fluent Forms Pro package was served from a decommissioned update server, adding libs/class-license-sync.php via a require_once in fluentformpro.php. The rogue code registers a backdoor REST endpoint, writes persistent PHP into mu-plugins and uploads, creates a passwordless administrator account and schedules tasks that survive uninstallation. Anyone who took 6.2.7 needs to hunt for those artefacts and audit admin users rather than simply upgrading.

nvd.nist.gov → (opens in a new tab)

CVE-2026-67614 (CVSS 9.3): CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attac (opens in a new tab)

NVD ·fetched 16 Aug 2026, 15:41 UTC Must read CVE-2026-67614 CVSS 9.3 EPSS 0.6% agreed3/3

Why readCyberPanel before 3.0.0 ships a hard-coded JWT secret in the WebTerminal FastAPI SSH service, so a forged token with ssh_user=root gives an unauthenticated interactive root shell over WebSocket on port 8888.

An attacker signs a JWT with the known hard-coded secret, sets ssh_user=root, and connects to the WebSocket terminal on port 8888 to get a root shell with no credentials at all. Fixed in 3.0.0. CyberPanel instances are internet-facing hosting control panels and have been mass-exploited before, so the gap between this description and a working script is very small; patch or firewall 8888 now rather than waiting for EPSS to move.

nvd.nist.gov → (opens in a new tab)

CVE-2026-14664 (CVSS 8.8): Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via tex (opens in a new tab)

NVD ·fetched 16 Aug 2026, 03:40 UTC Must read CVE-2026-14664 CVSS 8.8 EPSS 1.1% agreed3/3

Why readHeap overflow in PostgreSQL's regexp engine gives code execution as the database OS user; patch to 18.5, 17.11, 16.15, 15.19 or 14.24.

A heap buffer overflow in PostgreSQL regexp handling lets whoever authors a query execute arbitrary code as the OS user running the server, triggered via text that would fail encoding validation. It shares heritage with CVE-2026-2006 but arises from unanticipated data growth when input is round-tripped through pg_wchar, so the earlier fix did not cover it. All versions before 18.5, 17.11, 16.15, 15.19 and 14.24 are affected; EPSS is 0.011 with no exploitation observed yet.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73570 (CVSS 8.9): A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP (opens in a new tab)

NVD ·fetched 16 Aug 2026, 15:41 UTC CVE-2026-73570 CVSS 8.9 EPSS 0.5% agreed3/3

Why readUnauthenticated RCE as the zimbra user in Zimbra Collaboration before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

Improper sanitisation during SNMP notification processing lets an attacker send crafted SMTP requests that end in arbitrary OS command execution as the Zimbra user, with no authentication required. CVSS 8.9 with scope change, though attack complexity is rated high and EPSS is only 0.0054 so far. Zimbra has a long record of internet-facing bugs being picked up by both crimeware and state actors, so check whether zimbra-snmp is installed and move to 10.1.20.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73420 (CVSS 9.1): NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the (opens in a new tab)

NVD ·fetched 16 Aug 2026, 19:37 UTC CVE-2026-73420 CVSS 9.1 EPSS 0.5% agreed3/3

Why readA Unicode fullwidth at-sign slips past next-auth's email normalizer and misroutes the magic-link sign-in to an attacker mailbox, giving zero-interaction account takeover.

In @auth/core before 0.41.3 and next-auth before 4.24.15 and 5.0.0-beta.32, defaultNormalizer validates the address before applying NFKC/NFKD normalization. An address containing U+FF20 FULLWIDTH COMMERCIAL AT passes the single-at-sign check, but a downstream mail library that normalizes sees two separators and delivers the passwordless link to a second, attacker-controlled recipient. Affected apps are those using the built-in normalizer rather than a custom normalizeIdentifier; upgrade, or pin normalization order in your own normalizeIdentifier.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73665 (CVSS 9.3): FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket (opens in a new tab)

NVD ·fetched 16 Aug 2026, 19:37 UTC CVE-2026-73665 CVSS 9.3 EPSS 0.3% agreed3/3

Why readSocket.IO v4 only applies io.use() middleware to the default namespace, so FreePBX UCP before 17.0.9 accepts unauthenticated connections on custom namespaces and lets them run commands as the asterisk user.

node/lib/server.js gates the UCP Node server on ports 8001 and 8003 with io.use(checkAuth), but that middleware never fires for custom namespaces, and node/lib/auth.js does not invoke checkAuth consistently on those paths. An unauthenticated client then injects carriage returns or newlines into event values that reach the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, achieving arbitrary command execution. Fixed in 17.0.9; the underlying Socket.IO namespace-middleware trap is worth checking in any Node app that assumed io.use() was global.

nvd.nist.gov → (opens in a new tab)

CVE-2026-72851 (CVSS 9.0): Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers ca (opens in a new tab)

NVD ·fetched 16 Aug 2026, 19:37 UTC CVE-2026-72851 CVSS 9.0 EPSS 0.3% agreed3/3

Why readUnauthenticated SQL injection into Budibase before 3.40.0 through the webhook trigger endpoint, executing with the builder's stored datasource credentials.

Webhook-triggered automations containing EXECUTE_QUERY steps pass attacker-controlled JSON from an unauthenticated POST straight into SQL. Payloads run with the credentials the builder configured for the connected datasource, so exfiltration, modification and persistence reach back-ends such as Snowflake. Fixed in 3.40.0; advisory GHSA-x7h8-ww3q-xv7c. Any internet-exposed Budibase instance with webhook automations should be treated as reachable.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73533 (CVSS 9.3): Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned updat (opens in a new tab)

NVD ·fetched 16 Aug 2026, 15:41 UTC CVE-2026-73533 CVSS 9.3 EPSS 0.4% agreed3/3

Why readThe same poisoned update channel also shipped a backdoored Ninja Tables Pro 5.2.11, so sites running both plugins have two sets of artefacts to clear.

Ninja Tables Pro 5.2.11 was distributed as a tampered build from a decommissioned update server, carrying a loader at app/Library/updater/NinjaTableDataSync.php. It stands up a backdoor REST endpoint, drops persistent PHP files into mu-plugins and uploads, adds a passwordless administrator account and registers scheduled tasks that outlive plugin removal. The mechanics mirror the Fluent Forms Pro case, which points at one compromised distribution channel rather than two unrelated incidents.

nvd.nist.gov → (opens in a new tab)

CVE-2026-73663 (CVSS 9.3): FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted S (opens in a new tab)

NVD ·fetched 16 Aug 2026, 19:37 UTC CVE-2026-73663 CVSS 9.3 EPSS 1.0% agreed3/3

Why readAn unauthenticated SIP caller can SQL-inject FreePBX through a crafted Caller ID name and rewrite administrator accounts, on any box between 16.0.0 and 16.0.11 or 17.0.4.

The missedcall module passes the inbound Caller ID name from the SIP From header straight into the missedcalllog INSERT in agi-bin/missedcallnotify.php with no escaping or bound parameters. Triggering it needs only a call to a monitored extension that goes unanswered, and the injection reaches FreePBX admin account rows, yielding unauthorised remote access. Fixed in 16.0.11 and 17.0.4; FreePBX boxes are routinely internet-facing, and EPSS at 0.0095 already sits in the 58th percentile.

nvd.nist.gov → (opens in a new tab)

CVE-2026-14662 (CVSS 8.8): Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an all (opens in a new tab)

NVD ·fetched 16 Aug 2026, 03:40 UTC CVE-2026-14662 CVSS 8.8 EPSS 1.0% agreed3/3

Why readInteger wraparound in PostgreSQL tsvector and tsquery lets an unprivileged database user write out of bounds and potentially execute code as the server OS user.

Crafted large inputs to PostgreSQL's tsvector and tsquery functions wrap an integer, undersize an allocation and write past it, with arbitrary code execution as the database OS user the worst case. The upstream note tempers the risk: these types are normally populated by application logic rather than end-user input, so attacks routed through an application as a conduit are unlikely. Same fix train as the regexp bug, in 18.5, 17.11, 16.15, 15.19 and 14.24; CVE-2026-6473 addressed similar problems previously.

nvd.nist.gov → (opens in a new tab)

CVE-2026-18428 (CVSS 8.7): A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query a (opens in a new tab)

NVD ·fetched 16 Aug 2026, 15:41 UTC CVE-2026-18428 CVSS 8.7 EPSS 0.7% agreed3/3

Why readA SQL validation bypass in the OpenSearch SQL plugin's Flint extension handler gives an authenticated user arbitrary code execution on the backing Apache Spark workers.

A crafted SQL query sent to the direct query endpoint slips past the Flint extension query handler's validation, turning async query access into code execution on Spark workers. CVSS 4.0 scores it 8.7 with high confidentiality, integrity and availability impact at low privilege; EPSS is 0.0069, the highest in today's batch. AWS has published bulletin 2026-081 covering Amazon OpenSearch Service software, and self-managed users should take the fixed plugin build from GHSA-g4jr-343c-fvjm.

nvd.nist.gov → (opens in a new tab)

Researchers Hack an Airline Analog (opens in a new tab)

Hackaday Security ·Fenix Guthrie ·fetched 16 Aug 2026, 15:41 UTC Must read agreed3/3

Why readShows that ARINC 429's single-transmitter assumption is defeatable without swapping hardware: the transmitter sits behind a pair of 37.5 ohm resistors, so an attacker can simply overpower it on the same line.

ARINC 429 was assumed resistant to transmission-override because each bus has one authorised source, implying an attacker would have to physically replace something like the flight management computer. The output stage's pair of 37.5 ohm resistors undermines that: an injecting device transmitting on the same line can overpower the legitimate signal. Researchers demonstrated it on a bench rig built from a GE 2907A4 flight management computer and a GE 577F1 multipurpose control and display unit, which turns a hardware-replacement problem into a wire-access problem.

hackaday.com → (opens in a new tab)

Protecting Those Who Protect Children: Inspection Findings And The Evidence Base For Investigator Well-Being (opens in a new tab)

Forensic Focus ·Forensic Focus ·fetched 16 Aug 2026, 07:39 UTC agreed3/3

Why readAn HMICFRS inspection finds that digital forensic examiners working online child sexual abuse material need mandatory, proactive mental health support rather than opt-in provision.

A new report from HMICFRS, the UK policing inspectorate, sets out inspection findings on the welfare of investigators and digital forensic staff exposed daily to child sexual abuse material, and argues the evidence base now supports proactive and mandatory support rather than voluntary schemes. For anyone running a digital forensics unit or a CSAM triage queue this is a staffing and duty-of-care obligation, not a technique. The available text is a single summary paragraph, so the specific inspection findings and any recommendations have to be read in the report itself.

forensicfocus.com → (opens in a new tab)

CVE-2026-73678 (CVSS 10.0): MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attacker (opens in a new tab)

NVD ·fetched 16 Aug 2026, 23:39 UTC Must read CVE-2026-73678 CVSS 10.0 EPSS 0.8% agreed3/3

Why readA working blueprint for the failure mode everyone shipping agents is worried about: an open endpoint, an attacker-supplied model key, and an agent tool that calls exec() on whatever the model emits.

MindsDB Minds Platform 26.1.0 and earlier leaves both PUT /api/v1/settings/ and POST /api/v1/responses/ unauthenticated, so an attacker configures their own LLM API key and then sends a prompt that steers the Anton agent into its scratchpad tool, which runs the supplied Python with no sandbox. Execution lands as the user running the desktop application, putting SSH keys, stored credentials and environment secrets in reach. The missing auth is the easy half; the durable lesson is the scratchpad design, since any agent framework exposing an unrestricted code tool inherits this exposure whether or not the front door is locked.

nvd.nist.gov → (opens in a new tab)

CVE-2026-72776 (CVSS 9.3): AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbi (opens in a new tab)

NVD ·fetched 16 Aug 2026, 19:37 UTC CVE-2026-72776 CVSS 9.3 EPSS 0.8% agreed3/3

Why readAgenticSeek binds an unauthenticated POST /query to 0.0.0.0:7777 with wildcard CORS, and the agent will happily reason its way into shell commands through BashInterpreter with shell=True and safety=False.

At commit fc242c7, any network-reachable caller can submit a query that drives the autonomous agent into generating and executing host commands via subprocess.Popen, with the built-in command blocklist bypassable. The interesting part is the shape rather than the project: a self-hosted agent framework whose tool layer is the RCE, exposed by default on all interfaces with no auth boundary in front of it. Worth auditing your own locally-run agent stacks for the same three properties: wildcard bind, wildcard CORS, unsandboxed shell tool.

nvd.nist.gov → (opens in a new tab)

CVE-2026-50027 (CVSS 9.8): mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/* in mcp-memory-service are (opens in a new tab)

NVD ·fetched 16 Aug 2026, 23:39 UTC CVE-2026-50027 CVSS 9.8 EPSS 0.5% agreed3/3

Why readAuthentication that is configured but enforced on only some routes, in the component AI agents treat as their memory.

Every route under /api/documents/* in mcp-memory-service before 10.67.1 was served without the auth dependency even when MCP_API_KEY or OAuth was set, while the parallel /api/memories routes enforced it correctly. An unauthenticated caller could read stored documents, write arbitrary content into the memory store, and permanently delete memories belonging to authenticated users. Poisoned or deleted agent memory is quieter than RCE and much harder to notice after the fact, so upgrade to 10.67.1 and check whether the store was reachable from outside while it was exposed.

nvd.nist.gov → (opens in a new tab)

London police apologise over Al-Fayed probe data breach (opens in a new tab)

Google News: incidents · The Hindu ·fetched 16 Aug 2026, 07:39 UTC agreed2/3

Why readA police force publicly apologising for mishandling data from a sensitive abuse investigation, the kind of precedent regulators and legal teams cite when scoping victim-data controls.

The Metropolitan Police have apologised over a data breach connected to the investigation into Mohamed Al-Fayed, an inquiry involving a large number of complainants. The available reporting is a wire headline with no technical detail on how the exposure happened or how many people were affected. Its value is as a data protection governance datapoint for anyone handling victim or witness records, not as an incident with usable indicators.

news.google.com → (opens in a new tab)

Lecornu Plans Crisis Meeting on Cyberattack at French Tax Agency (opens in a new tab)

Google News: incidents · Bloomberg.com ·fetched 16 Aug 2026, 19:37 UTC agreed3/3

Why readFrance's prime minister is convening a crisis meeting over a cyberattack on the national tax agency, a government-level incident a board will ask about.

Bloomberg reports that Lecornu is planning a crisis meeting following a cyberattack on the French tax agency. No attribution, technique or scope of data exposure is given in the item as supplied, and the escalation to a head-of-government crisis meeting is the substance of the story. For anyone with French operations or public-sector exposure it is the fact to have on Monday; the technical detail will follow later.

Also covered byМежа. Новини України. (opens in a new tab),AzerNews (opens in a new tab).

news.google.com → (opens in a new tab)

Safepal security vulnerability exposes data of 39,798 customers (opens in a new tab)

Google News: incidents · coindesk.com ·fetched 16 Aug 2026, 15:41 UTC agreed3/3

Why readNames a crypto wallet provider and a customer count for a disclosed data exposure, the sort of item a board asks about when you hold the same category of vendor.

Safepal disclosed a security vulnerability that exposed data belonging to 39,798 customers. The item as received is a headline-only aggregation, so the flaw class, the exposure window and the data categories involved are not stated. Treat the named firm and the affected count as the fact and wait for the primary disclosure for anything more.

Also covered bySQ Magazine (opens in a new tab),The Block (opens in a new tab),Startup Fortune (opens in a new tab).

news.google.com → (opens in a new tab)

Israel crypto broker Bits of Gold probes customer data breach (opens in a new tab)

Google News: incidents · Crypto News ·fetched 16 Aug 2026, 19:37 UTC agreed3/3

Why readIsraeli crypto broker Bits of Gold is investigating a breach of customer data, relevant to anyone tracking exchange-sector exposure.

Bits of Gold, an Israeli cryptocurrency brokerage, says it is investigating a customer data breach. The report carries the named firm and the fact of the investigation; scope, cause and record counts are not stated.

news.google.com → (opens in a new tab)