GitLab has addressed a critical GraphQL vulnerability tracked as CVE-2026-19478, which could allow unauthenticated attackers to remotely modify or delete public projects and associated user data. The flaw received a CVSS score of 9.4 and affects both Community Edition and Enterprise Edition. Patches were coordinatedly released on August 17, 2026.
A critical security vulnerability in the Forminator Forms WordPress plugin, tracked as CVE-2026-15748, has been disclosed with a CVSS score of 9.8. The flaw enables unauthenticated remote code execution through malicious PHP file uploads, affecting over 600,000 active installations. The vulnerability was reported by a security researcher and details are pending official patch release and exploitation confirmation.
A maximum-severity vulnerability in SAP Commerce Cloud is being actively exploited in the wild days after SAP released a security update. Tracked as CVE-2026-58231, the flaw carries a CVSS score of 10.0 and involves insufficient authorization checks and input validation that could allow unauthenticated attackers to abuse a default authentication client.
Adobe has released security updates to address multiple critical vulnerabilities impacting ColdFusion and Campaign Classic platforms. The most severe flaw, tracked as CVE-2026-48362, carries a CVSS score of 10.0 and involves an operating system command injection vulnerability. Additional privilege escalation flaws were also addressed in this release.
The U.S. Department of Justice has unsealed an indictment charging 17 Iranian nationals with orchestrating a prolonged hacking-for-hire operation on behalf of the Iranian government. The group, identified as the Mabna Institute, is alleged to have conducted spear-phishing and brute-force attacks against hundreds of American institutions, resulting in the theft of sensitive intellectual property and data. The DOJ estimates the total economic loss at $3.4 billion. Authorities have coordinated the indictment with international law enforcement efforts to disrupt the group's infrastructure.
The FBI and CISA have issued alerts regarding the Medusa ransomware gang, which has breached more than 500 critical infrastructure organizations in the United States since June 2021. The campaign has resulted in significant disruption to essential services and data exfiltration. Authorities attribute initial access to common vectors such as phishing, RDP compromise, and exploitation of known vulnerabilities. No single software patch addresses the ransomware; mitigation focuses on security best practices.
CISA and Johnson Controls have issued advisories regarding multiple critical vulnerabilities affecting C-CURE 9000 and Victor application server products. The vulnerabilities, primarily tracked as CVE-2026-21655, CVE-2026-34496, and CVE-2026-21653, involve server-side request forgery (SSRF) that could allow unauthenticated remote attackers to achieve arbitrary code execution, impact physical security controls, and facilitate lateral movement within networks. Affected versions span C-CURE 9000 up to v3.10.1, victor Application Server up to v4.10, victor up to v7.0, and victor Web up to v7.1. Johnson Controls has released vendor fixes recommending upgrades to newer versions to address the vulnerable deserialization paths.
Siemens has identified that the RUGGEDCOM APE1808 industrial gateway, when deployed with Fortinet NGFW, is affected by two vulnerabilities originally documented in Fortinet products. CVE-2026-23573 is a cross-site scripting flaw rated MEDIUM (CVSS 3.1: 6.1), and CVE-2026-59839 is a path traversal vulnerability also rated MEDIUM (CVSS 3.1: 5.5). Both vulnerabilities were reported to CISA by Siemens ProductCERT. Siemens recommends contacting customer support for detailed remediation information and advises following Fortinet's advisory for workarounds.
Microsoft has released security updates to remedy at least 398 vulnerabilities in Windows operating systems and supported software. Among the patches, one vulnerability is reported as actively exploited in the wild, and two others were publicly detailed prior to today's release, increasing the risk of rapid weaponization. Users and organizations are advised to apply the updates immediately.
Siemens has released updates for the Siemens License Server (SLS) to address two actively tracked vulnerabilities. CVE-2026-69108 is a local privilege escalation flaw stemming from an insecure sudoers policy that could allow an attacker to execute arbitrary commands as root. CVE-2026-69109 is a path traversal vulnerability that could enable a remote attacker to read arbitrary files on the system. Both flaws affect SLS versions prior to 5.1 and 5.3 respectively, and Siemens recommends immediate updating to the latest released versions.
A critical vulnerability (CVE-2026-18164) affects Flow Neuroscience FL-100 and Halo Neuroscience FL-100 brain stimulation devices. An undocumented hard-coded credential, shared across all device units, permits attackers within Bluetooth range to bypass authentication. This could allow manipulation of brain stimulation parameters and override of safety limits, posing direct health risks to users. The advisory was published by CISA on August 13, 2026, following reporting by researcher A.C. Buglione. No public exploitation has been reported to date.
Siemens Solid Edge computer-aided design software is affected by seven file parsing vulnerabilities disclosed August 13, 2026. The flaws — including out-of-bounds reads and writes, and use-after-free issues — reside in the handling of specially crafted files in PAR, PSM, and DFT formats. Exploitation could allow an attacker to execute arbitrary code or crash the application in the context of the current process. All seven CVEs carry a CVSS v3.1 base score of 7.8 (HIGH). Siemens has released updated versions (SE2025 V225.0.15 or later; SE2026 V226.0.7 or later) and recommends immediate updating.
Siemens Solid Edge versions SE2025 prior to V225.0.15 and SE2026 prior to V226.0.7 are affected by seven CVEs (CVE-2026-50058 through CVE-2026-50064) involving out-of-bounds read, out-of-bounds write, and use-after-free vulnerabilities in file parsing routines. The flaws are triggered when the application processes specially crafted files in PAR, PSM, or DFT format. Exploitation could allow an attacker to execute code in the context of the current process, crash the application, or potentially gain control of affected systems. CVSS v3.1 base scores are 7.8 (HIGH) for all seven vulnerabilities. Siemens has released updates and recommends immediate patching.
Siemens Parasolid, a widely used 3D geometric modeling kernel, is affected by an out-of-bounds read vulnerability (CVE-2026-64629) with a CVSS score of 7.8. The flaw occurs when the application parses specially crafted X_T format files. Exploitation could allow an attacker to crash the application or execute arbitrary code in the context of the current process. Siemens has released updated versions—V38.0.235 and V38.1.230—to address the issue. The vulnerability requires local access and user interaction to trigger.
CISA and ANDRITZ have disclosed four vulnerabilities affecting ANDRITZ HIPASE-250 and 250 SCALA industrial control system software versions 7.20 and earlier. The flaws span reversible password storage, unauthenticated data exposure, an undocumented logging-level endpoint, and a hard-coded x11vnc password in provisioning scripts. ANDRITZ has released patches in versions V8.00.00 (December 2024) and V8.15.00 (July 2026), urging users to update immediately.
A critical command injection vulnerability (CVE-2026-19188) has been identified in the Haiwell IoT Cloud HMI Gateway product. The flaw exists in the Net Check feature accessible via the /setting endpoint, where the cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system. Successful exploitation may allow an attacker to inject and execute arbitrary OS commands with root privileges. The vulnerability affects Haiwell IoT Cloud HMI Gateway version 3.40.1.12 and earlier. Haiwell has addressed the issue in patch version Scada-v3.50.1.19. The vulnerability has been reported to CISA by Fiqram Akmal. No known public exploitation has been reported to CISA at the time of publication. The vulnerability is classified as critical with CVSS scores of 3.1 and 4.0. Affected sectors include Energy, Critical Manufacturing, and Water and Wastewater.
