Rosetta Daily · Aug 14, 2026
33 sources scanned, 20 items selected. No item matched the CISA KEV catalog today (verified with SQL, not memory).
Critical Vulnerabilities (CVSS ≥ 8.0)
- PostgreSQL patches a batch of high-severity bugs (CVSS 8.1–8.8): heap buffer overflows, integer wraparounds and type confusion across
pg_dump,regexp,plperl,pg_stat_statements,fuzzystrmatchand more — worst case allows arbitrary code execution as the OS user running the database. Fixed in 18.5 / 17.11 / 16.15 / 15.19 / 14.24. (CVE-2026-14662and a dozen+ related CVEs) - Flowise (open-source LLM/agent orchestration platform) sandbox-escape cluster (CVSS 9.0–9.4): versions before 3.1.3 have multiple bypassable guards in the vm2 sandbox and Python code validator (CSV/Airtable/custom-MCP nodes are all injectable), letting attackers run arbitrary code or exfiltrate data. (CVE-2026-73483)
- Zoho ManageEngine Password Manager Pro / PAM360, two CVSS 8.8 flaws: authenticated SQL injection (CVE-2026-11840) and a SAML-validation authentication bypass (CVE-2026-12263). A compromised PAM product can hand attackers a large batch of privileged credentials at once.
- GitPython remote code execution (CVE-2026-73625, CVSS 8.7): the
check_unsafe_optionsguard in versions before 3.1.54 can be bypassed by smuggling git options inside single-character kwarg values, exploitable viaclone_from/fetch/pull/push. (link) - Budibase NoSQL injection (CVE-2026-73618, CVSS 8.7): the low-code platform's MongoDB query endpoint (before 3.40.0) fails to sanitize JSON metacharacters, letting users with query-write access break out of the intended query structure. (link)
- WordPress plugin "Link Factory" is itself a backdoor (CVE-2026-15413, CVSS 10): marketed as a "homepage sentence publisher," it exposes an attacker-controlled REST API (
/wp-json/link-factory/v1/) authenticated only by a hardcoded operator public key. (link) - Batch disclosure of a dozen+ unauthenticated WordPress plugin flaws (CVSS 9.3–9.8): Salon booking system, Church Admin, Everest Backup, Listdom, Cartify and others — mostly niche plugins with limited install bases; check your own site inventory.
Actively Exploited
- SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1): patched in July's Patch Tuesday; attackers began exploiting it in the wild after PoC code was released. (The Hacker News)
- SAP Commerce Cloud max-severity RCE under active attack: patched three days ago and already targeted, per threat-intel firm Defused (no CVE number given in the source article). (Bleeping Computer)
- VMware vCenter Syslog Server RCE (CVE-2026-59310) exploited: used to deploy a reverse SSH tool for persistence and remote access. (Bleeping Computer)
- macOS Screen Sharing authentication bypass exploited: the Dutch NCSC warns attackers are deploying a Monero miner via this flaw after public exploit code emerged (no CVE number given). (Bleeping Computer)
- Microsoft patches "LegacyHive" Windows zero-day: disclosed after July's Patch Tuesday (no CVE number given). (Bleeping Computer)
ICS / Vendor Advisories
- CISA released 15 ICS/medical-device advisories in a single day, covering Siemens (7 products), Hitachi Energy APM Edge, AVEVA Enterprise SCADA, Johnson Controls (Airwall, Metasys), ANDRITZ HIPASE, Haiwell IoT Cloud HMI Gateway, and medical device Flow Neuroscience FL-100. The three most severe: AVEVA Enterprise SCADAdeserialization → RCE (link); Siemens Siveillance Video→ RCE (link); Haiwell IoT Cloud HMI Gateway→ root-level arbitrary command injection (link). Flow Neuroscience FL-100(a transcranial stimulation device) lets a Bluetooth-range attacker tamper with stimulation parameters and override safety limits — a physical-safety issue. (link)
Industry News
- Shell investigates a potential incidentafter the Clop ransomware gang claimed it stole 89GB of data. (link)
- RingCentral breach exposed 1.6 million accounts: ShinyHunters stole personal data after a July intrusion, per Have I Been Pwned. (link)
- Trezor supply-chain breach affects ~14,000 customers: caused by an intrusion at its logistics provider, ShipMonk. (link)
- Akira ransomware disables EDR via Safe Mode: an affiliate rebooted a compromised host into Safe Mode with Networking to kill endpoint defenses, stole data but failed to encrypt. (link)
- Apple rolls out new "Threat Notification" alerts: warning select users their iPhone was targeted by mercenary spyware. (link)
- White House memo authorizes private "hack-back" operations: directs the National Coordination Center (NCC) to let approved security firms apply for offensive counter-hacking authorization. (link)
AI Security
- "AI watermark removers" surface days after Claude's watermarking launch: including an open-source project with 4,500+ GitHub stars and several paid "AI-detection evasion" services — almost none can prove they actually work. (link)