Other Conventional Threats

Siemens Solid Edge SE2025 and SE2026 contain seven high-severity memory corruption vulnerabilities (CVSS 7.8) triggered when parsing specially crafted PAR, PSM, or DFT files, which could allow an attacker to crash the application or achieve arbitrary code execution in the context of the current process. Exploitation requires a user to open a malicious file, making this a local-vector, user-interaction-required threat rather than a remotely exploitable one. Siemens has released patched versions (SE2025 V225.0.15+ and SE2026 V226.0.7+) and organizations should update promptly.

Updated Aug 17, 2026 · CVSS 7.8

The Link Library plugin for WordPress (versions up to 7.9.4) contains an arbitrary file deletion vulnerability caused by insufficient path validation in the ll_delete_link_fields function. When the 'Delete local file on link deletion' option is enabled, unauthenticated attackers can submit malicious links that, once deleted by an administrator during routine moderation, trigger deletion of critical files such as wp-config.php, potentially leading to full remote code execution.

Updated Aug 17, 2026 · CVSS 9.1

The Pods – Custom Content Types and Fields WordPress plugin (versions up to 3.3.9) contains a critical authorization bypass flaw that allows unauthenticated attackers to escalate privileges to Administrator or reset any user's password, including the site owner's. This enables complete site takeover and has been assigned a CVSS score of 9.8.

Updated Aug 17, 2026 · CVSS 9.8

The TrueBooker WordPress plugin (versions up to 1.2.6) contains a critical account takeover vulnerability due to an insecure AJAX handler that allows unauthenticated attackers to change any user's email address, including administrators. Attackers can chain this with WordPress's native password reset flow to fully hijack accounts, including full site administrator access.

Updated Aug 17, 2026 · CVSS 9.8

This report highlights that attacks against Google Workspace increasingly bypass traditional phishing defenses by exploiting stolen OAuth tokens to gain access to Gmail, Drive, and connected third-party applications. Material Security emphasizes that organizations must defend the entire Workspace attack chain, not just the initial login, since attackers can pivot through connected integrations and persistent tokens. This represents a shift toward identity- and token-centric attack paths rather than credential phishing alone.

Updated Aug 16, 2026

ANDRITZ HIPASE-250 and 250 SCALA industrial control system products (versions <=7.20) contain four vulnerabilities including recoverable password storage, missing authentication on data/config endpoints, an unauthenticated logging manipulation endpoint, and a hard-coded VNC credential used across engineering workstation deployments. Successful exploitation could allow an attacker to read sensitive process data, access engineering workstations, suppress audit logs, or recover stored credentials. These are primarily energy-sector ICS/OT vulnerabilities with no reported public exploitation to date.

Updated Aug 16, 2026 · CVSS 8.1

Siemens LOGO! Soft Comfort versions prior to V9 contain two vulnerabilities affecting project-file encryption and password protection: a hardcoded AES master key and unsalted SHA-256 password hashes. A local attacker could exploit these flaws to decrypt project files, bypass or remove passwords, and perform efficient offline brute-force attacks, potentially gaining unauthorized access to sensitive PLC project logic and configurations.

Updated Aug 16, 2026 · CVSS 6.8

Flow Neuroscience FL-100 (and rebranded Halo Neuroscience FL-100) tDCS devices contain an undocumented hard-coded credential shared across all units, allowing any attacker within Bluetooth range to bypass authentication. Exploitation could let an attacker arbitrarily manipulate brain stimulation parameters and override built-in safety limits, posing direct physical harm risk to patients.

Updated Aug 16, 2026 · CVSS 8.1

The User Session Synchronizer plugin for WordPress (versions up to 1.4.0) contains a critical authentication bypass vulnerability that allows unauthenticated attackers to impersonate any user, including administrators. The flaw stems from unvalidated request parameters and a cryptographic fallback that renders the encryption predictable when an unregistered session key is referenced. Full site takeover is possible with no prior knowledge of secrets, making this an urgent patch priority for any WordPress site running the plugin.

Updated Aug 16, 2026 · CVSS 9.8

The RapiSafe – Secure Multi File Upload plugin for Contact Form 7 (versions up to 1.0.4) contains an unauthenticated arbitrary file deletion vulnerability in its AJAX upload removal handler. Attackers can exploit exposed nonces to delete critical files such as wp-config.php, potentially triggering a reinstallation flow that leads to full remote code execution and site takeover. Given the plugin's popularity and the ease of exploitation (no authentication required), this poses a severe risk to any WordPress site running the affected component.

Updated Aug 16, 2026 · CVSS 9.1

A critical vulnerability in IBM Db2 Mirror for i allows a remote, likely unauthenticated attacker to execute arbitrary CL (Control Language) commands due to improper input sanitization. With a CVSS score of 9.9, successful exploitation could lead to full compromise of the affected IBM i system.

Updated Aug 16, 2026 · CVSS 9.9

DecryptAds is a new free service that scrapes and correlates adtech and mobile SDK data to help users identify which companies are tracking them via websites and apps. This is a privacy/transparency tool rather than a malicious threat, though it highlights the scale of existing ad-tracking infrastructure. No exploit, malware, or attack vector is involved.

Updated Aug 15, 2026

Law enforcement in Brazil and Europe arrested seven individuals connected to a fraud scheme that exploited a vulnerability at a third-party service provider to withdraw approximately €30 million from Commerzbank customer accounts. The case highlights the ongoing risk that vulnerabilities in banking service providers and payment intermediaries pose to end customers.

Updated Aug 15, 2026

This is a news report on Anthropic's plans to implement watermarking for AI-generated text produced by Claude, aimed at improving content provenance and detection of AI-generated material. This is a defensive/product feature announcement rather than a security threat, vulnerability, or attack campaign.

Updated Aug 15, 2026

Siemens Siveillance Video Management Servers (based on Milestone XProtect) contain a critical OS command injection vulnerability in the Management Server API that allows users with edit permissions to execute arbitrary code in the context of the Management Server service. Siemens has released patched versions for the affected V2023 R3, V2024 R1, and V2025 product lines and urges immediate updates.

Updated Aug 15, 2026 · CVSS 9.1

A high-severity persistent cross-site scripting vulnerability affects Johnson Controls Metasys building automation systems (versions 12–15), allowing a low-privilege user to inject a malicious payload via a crafted URL that executes in other users' sessions, including administrators. This could lead to session hijacking and unauthorized access within critical infrastructure environments such as commercial facilities, manufacturing, energy, and government sites. No public exploitation has been reported to CISA at this time, but patches or vendor guidance are available for supported versions.

Updated Aug 15, 2026 · CVSS 8

Johnson Controls Airwall versions 4.0.4 and earlier contain two vulnerabilities: a hard-coded cryptographic key used identically across all deployments, and an arbitrary file read flaw via path traversal. Combined, these could allow an attacker with local access or code/binary access to decrypt sensitive configuration data or read arbitrary files including credential stores and private keys. No public exploitation has been reported, and both flaws require local access or high attack complexity, limiting immediate risk.

Updated Aug 15, 2026 · CVSS 7

CVE-2026-17182 is a critical authentication bypass vulnerability in IBM Db2 Mirror for i affecting versions 7.4, 7.5, and 7.6, allowing remote attackers to bypass authentication controls due to improper validation of request URI path segments. Exploitation could result in unauthorized access, disclosure, or alteration of sensitive database information without requiring credentials. With a CVSS score of 9.8, this vulnerability poses a severe risk to organizations running affected Db2 Mirror deployments.

Updated Aug 15, 2026 · CVSS 9.8

A critical vulnerability in the getgrav/grav-plugin-api plugin (before 1.0.13) allows an attacker holding a minimal-scope API key to mint a new, unscoped super-access API key by submitting an empty scopes array. This bypasses intended scope restrictions and can be chained with configuration write access to achieve full remote code execution on the underlying Grav CMS instance.

Updated Aug 15, 2026 · CVSS 9.8

A critical path traversal vulnerability in luci-app-openvpn allows authenticated attackers to write arbitrary files outside the intended upload directory, enabling persistent root-level code execution on OpenWrt-based devices. Exploitation involves planting SSH keys in system directories to maintain access across reboots, making this a severe threat to routers and embedded network infrastructure.

Updated Aug 15, 2026 · CVSS 9.9