Conventional Threats Watchlist

Acrisure KARR BT and DR-100 anti-theft systems use a shared, hard-coded Bluetooth authentication key across all affected devices, allowing an attacker within Bluetooth range to send unauthorized commands to a vehicle. This could enable unauthorized door unlocking or engine immobilization. Acrisure has released a firmware update (July 20, 2026) to address the flaw, and no public exploitation has been reported.

Updated Aug 5, 2026 · CVSS 8.1

A vulnerability in multiple Thermo Fisher Applied Biosystems Genetic Analyzer software products allows tampering with .fsa/.hid output files due to missing integrity checks, which could result in falsified DNA test results. The flaw requires local access and no user interaction, affecting eight product lines including several that are end-of-life with no patch available.

Updated Aug 5, 2026 · CVSS 8.4

A critical unauthenticated remote code execution vulnerability affects MaxSite CMS, allowing attackers to inject arbitrary PHP code into the application's configuration file via the install endpoint. Exploitation results in persistent RCE as the web-server process user, requiring no authentication and enabling full compromise of the affected host.

Updated Aug 5, 2026 · CVSS 9.8

MaxSite CMS versions 109.5 and earlier contain a critical authentication bypass in the AJAX dispatcher, allowing unauthenticated attackers to reach admin-gated plugin endpoints. Exploitation requires only a crafted X-Requested-With header and a base64-encoded path pointing to any *-ajax.php file, enabling actions like poll manipulation and potentially more severe abuse depending on the targeted plugin.

Updated Aug 5, 2026 · CVSS 9.8

kotaemon, an open-source RAG (retrieval-augmented generation) UI and document QA toolkit through version 0.12.0, contains a critical unauthenticated insecure deserialization vulnerability in its check_connection endpoint. Attackers can supply crafted YAML/JSON payloads with a manipulated __type__ field to instantiate arbitrary Python classes, ultimately achieving remote code execution via subprocess.check_output injection.

Updated Aug 5, 2026 · CVSS 9.8

A critical unauthenticated command injection vulnerability affects Puwell IP Camera firmware versions 2.x through 4.x, allowing remote attackers to achieve root-level code execution via a crafted JSON payload sent to the exposed DebugShell service on TCP port 34567. Given the CVSS score of 9.8 and lack of any authentication barrier, this vulnerability is likely to be rapidly weaponized by botnet operators and IoT malware families for mass exploitation.

Updated Aug 5, 2026 · CVSS 9.8

A critical SQL Injection vulnerability in Adobe Campaign Classic (CVE-2026-48330) allows an unauthenticated attacker to execute arbitrary SQL commands and achieve remote code execution in the context of the current user, with no user interaction required. With a maximum CVSS score of 10.0 and a scope change, successful exploitation could grant attackers elevated access, full control over the marketing automation platform, and lateral movement into connected infrastructure.

Updated Aug 5, 2026 · CVSS 10

Apache Tomcat contains a vulnerability that allows attackers to bypass the EncryptInterceptor, a component intended to encrypt sensitive data transmitted between nodes in a Tomcat cluster. This CVE has been added to CISA's Known Exploited Vulnerabilities catalog with a short remediation window, indicating active exploitation in the wild. Organizations running clustered Tomcat deployments should prioritize patching immediately.

Updated Aug 5, 2026

The INC Ransomware group has become the dominant threat actor exploiting recently disclosed vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances, with a sharp increase in activity since early August 2026. Multiple victims have already been listed on the group's data leak site, indicating active and successful exploitation in the wild.

Updated Aug 4, 2026

Unit 42 researchers disclosed three attack techniques against Chrome's Google Password Manager cloud authenticator that allow user-level malware on a compromised Windows machine to sign into passkey-protected accounts without any biometric, PIN, or user-visible prompt. The strongest variant, Golden Pass-ta-key, targets the underlying master key, enabling silent, persistent account takeover even after remediation. This undermines the core phishing-resistance promise of passkeys when the endpoint itself is compromised.

Updated Aug 4, 2026

Researchers identified 18 malicious npm packages, including one named 'lib-mtop' impersonating a private Alibaba package, designed to deliver a cross-platform remote access trojan to developers using Alibaba developer tools. The campaign appears to specifically target Chinese-speaking development environments through a targeted software supply chain attack, likely leveraging dependency confusion or typosquatting techniques.

Updated Aug 4, 2026

DOUBLECUP is a newly identified Russian loader-as-a-service that leverages ClickFix-style social engineering to trick victims into executing malicious commands, hiding payload code inside PNG images stored in browser caches. The service delivers CountLoader to both Windows and macOS victims and a new Windows-targeted remote access trojan called DeviceManager, expanding the threat actor's toolkit for initial access and persistent remote control.

Updated Aug 4, 2026

Security researchers disclosed three attack techniques, collectively dubbed 'Pass-ta-key,' that allow malware already present on a compromised Windows device to abuse Google Password Manager's synced passkey feature. The attacks enable adversaries to bypass user verification, hijack accounts protected by passkeys, and extract passkey private keys, undermining a core assumption that passkeys are phishing-resistant and device-bound.

Updated Aug 4, 2026

Microsoft has attributed a global campaign against hospitality Wi-Fi networks to the Russian state-sponsored actor Midnight Blizzard (APT29). The group uses custom malware deployed via compromised hotel networks to intercept traffic and steal Microsoft 365 credentials from traveling targets, likely diplomats, government officials, and corporate executives. The campaign highlights the ongoing risk of adversary-in-the-middle attacks on untrusted public networks.

Updated Aug 4, 2026

CISA has added CVE-2026-18577, an authentication bypass vulnerability in N-able N-central, to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation. Federal civilian agencies are required under BOD 26-04 to remediate this vulnerability on a prioritized timeline, and CISA urges all organizations to apply the same urgency.

Updated Aug 4, 2026

A critical command injection vulnerability affects GL-iNet GL-MT3000 routers up to firmware version 4.4.5, residing in the server.set_peer function of the wg-server.so native plugin exposed via /cgi-bin/glc. The flaw allows unauthenticated or low-privilege remote attackers to inject arbitrary OS commands through the public_key parameter, and a public exploit is already available, significantly increasing the risk of active exploitation.

Updated Aug 4, 2026 · CVSS 9.8

A critical command injection vulnerability affects the s2s.enable_echo_server function within the s2s.so native plugin on GL-iNet GL-MT3000 routers up to version 4.4.5. The flaw allows unauthenticated remote attackers to inject arbitrary OS commands via the 'port' argument, and a public exploit is already available. Given the CVSS score of 9.8 and remote exploitability, affected devices are at immediate risk of full compromise.

Updated Aug 4, 2026 · CVSS 9.8

Krayin CRM 2.2.4 contains a critical missing authentication vulnerability that allows unauthenticated attackers to overwrite the primary administrator account by exploiting a flaw in the installer middleware bypass logic. Successful exploitation grants full administrative access to all CRM data, including customer records, credentials, and any integrated API keys or tokens.

Updated Aug 4, 2026 · CVSS 9.8

A critical remote code execution vulnerability exists in OpenEMR through 8.2.0, allowing authenticated administrators to inject PHP payloads into the categories database table via SQL manipulation. The payload is later executed through an unsanitized eval() call in the CategoryTree component, which can be triggered by unauthenticated or low-privilege pages, resulting in full command execution as the web server user.

Updated Aug 4, 2026 · CVSS 9.1

A critical command injection vulnerability exists in the ovpn-client.so plugin of GL.iNet GL-MT3000 routers (up to firmware 4.4.5), reachable via the /cgi-bin/glc endpoint. An attacker can remotely inject OS commands through the Hostname parameter of the get_recommend_config function, potentially achieving full device compromise. The exploit has been publicly disclosed, increasing the likelihood of active exploitation.

Updated Aug 4, 2026 · CVSS 9.8