TP-Link security advisory FAQ 5248 (last updated 27 August 2026; firmware release noted by OPSWAT as 18 August 2026) covers CVE-2026-15315 and CVE-2026-15316 in Tapo smart cameras. CVE-2026-15315 (CVSS v4.0 8.7 High; CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N): improper authentication in the login verification module on Tapo C120 V1 and C200 V5 — a local-network attacker can replay device_confirm challenge material to obtain administrative session tokens without the camera password. CVE-2026-15316 (CVSS v4.0 7.1 High; CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N): oversized encrypted Wi-Fi credential input in C200 V5 onboarding crashes/restarts the HTTPS management service (DoS). Discovery credit: OPSWAT Unit 515 / fellowship research (Khoi Tran, Thai Do); OPSWAT blog notes further critical findings still under coordinated disclosure. Adjacent-network only (AV:A) — not internet-unauth without LAN/VPN reach to the camera. SecurityWeek 18 Sep roundup re-amplified the advisory. Primary: TP-Link FAQ 5248; research: OPSWAT.
TP-Link — Security Advisory FAQ 5248 Tapo C120/C200 (updated 27 Aug 2026)
Oracle's 18 August 2026 Critical Security Patch Update (revision 3 on 27 August) contains 943 new security patches. Oracle says it continues to receive reports of attempts to exploit already-patched issues where customers had not applied available updates. Fusion Middleware includes unauthenticated WebLogic Server Core issues CVE-2026-60698 (IIOP, 9.8), CVE-2026-60672 and CVE-2026-60696 (T3/IIOP, 9.8) on 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, plus CVE-2026-60977 (RMI, 9.8) on 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, and Oracle Internet Directory LDAP Server CVE-2026-61241 at 10.0 on 12.2.1.4.0 and 14.1.2.1.0. Database Server includes adjacent-network Portable Clusterware issues CVE-2026-71063 and CVE-2026-71064 at 9.6. Apply the August 2026 CSPU for each product family you run. This is separate from CVE-2026-21962 (January 2026 CPU, later added to CISA KEV).
Broadcom VMSA-2026-0006 (29 July 2026; updated 19 August) covers CVE-2026-59310, a Critical directory-traversal flaw in the VMware vCenter Syslog server. A malicious actor with network access to vCenter can execute arbitrary code; Broadcom rates maximum CVSSv3 9.8; NVD CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No workarounds — apply fixed builds per the VMSA response matrix / FAQ (brcm.tech/vmsa-2026-0006). CISA added the CVE to KEV on 18 August 2026 (FCEB due 21 August) after QUIRSO reported 361+ compromised IPs across 47 countries with reverse-SSH persistence. Updated 15 Sep 2026: according to BleepingComputer and the CISA KEV catalog (knownRansomwareCampaignUse=Known), CISA now flags the flaw as used in ransomware campaigns; Shadowserver still tracks 450+ internet-exposed vCenter instances. Treat unpatched vCenter as emergency. Primary: Broadcom VMSA-2026-0006; CISA KEV. (source: BleepingComputer)
Weak authentication in on-premises Microsoft SharePoint (CVE-2026-55040) lets an unauthorised attacker bypass a security feature over the network. CISA added it to KEV on 18 August 2026 after evidence of active exploitation. NVD scores it 9.1 (CVSS 3.1). It is the auth-bypass half of an unauthenticated RCE chain with August's CVE-2026-63520 (Business Connectivity Services RCE). Apply the July/August SharePoint security updates for Subscription Edition, 2019 and 2016, and keep farms off the public internet unless required.
CISA added CVE-2026-33824 to the Known Exploited Vulnerabilities catalog on 18 August 2026: a double-free in Microsoft Internet Key Exchange (IKE) Service Extensions. Treat internet-reachable IKE as known-exploited and apply Microsoft's update.
Zabbix's 18 August 2026 advisory (ZBX-28071) says that in Zabbix 7.4 the cryptographic key used for signing frontend sessions was erroneously written to the database seed. The only known exploitation scenario is deployments that use both SAML authentication and guest users: the key can be used to forge valid session cookies and gain unauthorised frontend access. Other deployments have no known impact. Affected: 7.4.0 through 7.4.10. Fixed: 7.4.11. Vendor CVSS 4.0 is 7.7 (High). Workaround: clear settings.session_key in the Zabbix database so the frontend generates a new random key. Zabbix credited Daniel Shemesh and Or Ida via HackerOne. Not in CISA KEV at last check.
Red Hat's 17 August 2026 CVE record (threat severity Critical, CVSS 3.1 9.1) describes a reset-credentials flaw in keycloak-services for Red Hat Build of Keycloak. An unauthenticated remote attacker can force password reset for any user without the email verification step and set new credentials, taking over the account. Temporary mitigation if you cannot patch yet: turn Forgot password off for every realm (Realm settings → Login). Fixed packages include Keycloak 26.4 builds at or after rhbk/keycloak-operator-bundle 26.4.15-1 / keycloak-rhel9 26.4-23 (RHSA-2026:56519 / 56520) and 26.6 builds at or after 26.6.6-1 / 26.6-12 (RHSA-2026:56523 / 56524). Red Hat marks Red Hat Single Sign-On 7 and JBoss EAP Expansion Pack as not affected. No in-the-wild exploitation stated on the Red Hat CVE page at last check.
Ray is an AI compute engine. CISA added CVE-2025-62593 to KEV on 17 August 2026. The Ray GitHub advisory describes a code-injection issue in versions before 2.52.0. Patch to 2.52.0. Do not expose developer Ray services to untrusted networks. The Ray advisory rates it 9.4 Critical under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). Correction (27 Oct 2026): the CVSS fields now show the advisory's CVSS 4.0 score and vector; an earlier version paired the 9.4 score with a CVSS 3.1 vector. (source: Ray advisory)
Apple released iOS 26.6.1 and iPadOS 26.6.1 and macOS Tahoe 26.6.2 on 17 August 2026 (security-content pages published 20 August). The iOS advisory includes ImageIO integer overflow CVE-2026-65346, where processing an image may lead to arbitrary code execution; Telephony CVE-2026-65329, where an attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic (iPhone 11 and later); Kernel use-after-free CVE-2026-65343 (remote unexpected system termination); and multiple WebKit memory-safety issues. Apple does not publish CVSS scores on that page. Safari 26.6.1 followed on 18 August for macOS Sonoma and Sequoia. This is separate from CVE-2026-65400 (macOS Screen Sharing), which CISA added to KEV on 18 August.
Apple: iOS 26.6.1 and iPadOS 26.6.1 security content
Linux kernel CVE-2026-72018 (published 15 August 2026; XBOW research write-up 28 September 2026) is an out-of-bounds write in dibs_loopback move_data(): the software SMC-D loopback path memcpy'd into a registered DMB without checking offset+size against DMB length. A local user with CAP_NET_ADMIN can stage a malicious SMC-D peer over loopback, drive a constrained zero-write past the buffer, and escalate to root (XBOW demonstrated reliable LPE). CNA CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected from the 6.10-era DIBS loopback introduction; fixed in stable trains including 6.12.97, 6.18.40, 7.1.5 and 7.2 (per CVE.report / Linux CNA). Primary: CVE.report / kernel stable commits; wire: XBOW 28 Sep + Talkback.
Microsoft Security Update Guide CVE-2026-69414 is an elevation of privilege in the Microsoft Malware Protection Engine (ShieldBreak): CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), Important. August reporting described a public local PoC to SYSTEM when Defender is enabled, including as a bypass of RoguePlanet (CVE-2026-50656). BleepingComputer (9 September 2026) says Microsoft shipped a ShieldBreak fix in the September 2026 Patch Tuesday set, and that researcher Nightmare Eclipse then released a "ShieldCrash" proof-of-concept claiming the patch is incomplete under specific conditions — arbitrary file read as SYSTEM on fully patched Windows 10/11/Server, without write access in the published skeleton PoC. Treat ShieldCrash as secondary researcher claim until MSRC documents a new CVE or revises 69414. Watch MSRC for engine build requirements; do not equate a public PoC with confirmed in-the-wild exploitation.
PostgreSQL's own security page for CVE-2026-6471 (fix published 13 August 2026) describes missing authorisation in logical decoding: a non-superuser with REPLICATION privilege can cause the server to dlopen any file visible to the OS account running PostgreSQL by choosing the logical decoding plugin path, which runs arbitrary code as that account. Affected before 18.6, 17.11, 16.15, 15.19, and 14.24; fixed in those builds. Vendor CVSS 3.0 is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Cyera's PostGREShell research (covered by SecurityWeek on 4 September 2026) explains how replication-protocol plugin loading can be abused for RCE, privilege escalation and persistence when REPLICATION is granted to backup or monitoring accounts. Inventory roles with REPLICATION, patch to the fixed minor releases, and do not treat REPLICATION as a low-privilege convenience grant.
