SAP Patches Zero-Day in Commerce Cloud Data Hub Adapter
August 12, 2026
CVE-2026-58231 allows unauthenticated remote code execution across SAP Commerce Cloud. The flaw affects the Data Hub Adapter and carries CVSS
Application Security
SAP Patches Zero-Day in Commerce Cloud Data Hub Adapter
CVE-2026-58231 allows unauthenticated remote code execution across SAP Commerce Cloud. The flaw affects the Data Hub Adapter and carries CVSS 10.0 globally.
CISA Adds Metabase SQL Injection Zero-Day to KEV With Aug 14 Deadline
CISA adds CVE-2026-72898 Metabase SQL injection flaw to KEV, setting an August 14 patch deadline for federal agencies and urging enterprises to update.
SharePoint RCE CVE-2026-55040 First Confirmed Ransomware Exploit
CISA confirms ransomware operators exploit a CVSS 9.1 SharePoint Server RCE requiring no authentication and granting administrator access worldwide today.
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
Varonis and PromptArmor disclosed prompt-injection flaws in Atlassian Rovo that can exfiltrate Jira, Confluence, and SharePoint data from enterprise tenants.
Belgian Connective eID Flaws Let Websites Forge Signatures
Researcher James Arnott disclosed severe flaws in the Connective eID extension exposing PINs, enabling forged signatures, and allowing drive-by code execution.
Swiss Government SharePoint Breach Compromised 200 Accounts
BIT's SharePoint intrusion compromised credentials for about 200 Swiss federal accounts, likely via Microsoft flaws fixed in the July Patch Tuesday updates.
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow secrets via an AI agent.
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
PortSwigger's AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700 targets.
CryptoJS Weak RNG Behind $5.7M in Five Wallet App Drains
Coinspect traced roughly $5.7 million in cryptocurrency theft to a 12-year-old weak random number generator in the CryptoJS library and five wallet apps.
Attackers Compile khunt Inside Oracle to Reach Windows SYSTEM
Huntress traced credential-theft alerts to attackers who compiled the khunt toolkit inside Oracle to reach SYSTEM-level code execution on a Windows server.
CISA Adds Metabase SQL Injection Zero-Day to KEV With Aug 14 Deadline
August 12, 2026
CISA adds CVE-2026-72898 Metabase SQL injection flaw to KEV, setting an August 14 patch deadline for federal agencies and urging
SharePoint RCE CVE-2026-55040 First Confirmed Ransomware Exploit
August 12, 2026
CISA confirms ransomware operators exploit a CVSS 9.1 SharePoint Server RCE requiring no authentication and granting administrator access worldwide today.
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
August 11, 2026
Varonis and PromptArmor disclosed prompt-injection flaws in Atlassian Rovo that can exfiltrate Jira, Confluence, and SharePoint data from enterprise tenants.
Belgian Connective eID Flaws Let Websites Forge Signatures
August 11, 2026
Researcher James Arnott disclosed severe flaws in the Connective eID extension exposing PINs, enabling forged signatures, and allowing drive-by code
Swiss Government SharePoint Breach Compromised 200 Accounts
August 7, 2026
BIT’s SharePoint intrusion compromised credentials for about 200 Swiss federal accounts, likely via Microsoft flaws fixed in the July Patch
Claude Code and Gemini CLI Flaws Expose CI Workflow Secrets
August 7, 2026
Novee Security found flaws in Claude Code and Google Gemini CLI that let an attacker-controlled GitHub issue reach CI workflow
AI-Assisted HTTP Terminator Finds Apache Traffic Server Zero-Day
August 7, 2026
PortSwigger’s AI-assisted HTTP Terminator found roughly 30,000 HTTP desync vectors and a live Apache Traffic Server zero-day affecting roughly 700
CryptoJS Weak RNG Behind $5.7M in Five Wallet App Drains
August 7, 2026
Coinspect traced roughly $5.7 million in cryptocurrency theft to a 12-year-old weak random number generator in the CryptoJS library and
Attackers Compile khunt Inside Oracle to Reach Windows SYSTEM
August 6, 2026
Huntress traced credential-theft alerts to attackers who compiled the khunt toolkit inside Oracle to reach SYSTEM-level code execution on a
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.