Newsdesk
Engineering
DevOpsEngineering EditionSecurityExploits, Breaches & AdvisoriesWebBrowsers, Frameworks & the PlatformReleasesWhat Shipped This WeekMobileiOS, Android & Cross-PlatformOpen SourceLicences, Governance & Supply Chain
Data & AI
DataEngines, Pipelines & Query PlansPapersPapers Worth ReadingAIEngineering Edition
Industries
FintechRails, Regulation & Banking TechChipsFabs, Process Nodes & AcceleratorsClimateGrid, Storage & the Transition
Enterprise Systems
Supply ChainFinance, Manufacturing, Warehousing & Enterprise AIHR TechSuccessFactors, payroll and people systems
Go-to-Market
MarketingSearch, Content & DemandSalesB2B Go-to-Market & Retention
Longform
ReadingFrom the Blogs Worth FollowingCraftArchitecture, Practice & Running Teams
DesignIndiaAll stories

Security Weekly Digest

18 August 2026

4 vulnerabilities added to CISA's exploited-in-the-wild catalog this week.

One week of Security Weekly Digest, 4 stories, as published.

Exploited CVEs

CVE-2025-62593: Ray-Project

Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

Why it matters — Confirmed exploited in the wild. CVSS 9.4 (CRITICAL). CISA remediation deadline 20 Aug 2026 — 2 days out.

CISA KEV · 18 August 2026 · Read the original →

Exploited CVEs

CVE-2026-72898: Metabase

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Why it matters — Confirmed exploited in the wild. CVSS 10.0 (CRITICAL). CISA remediation deadline 14 Aug 2026 — already passed.

CISA KEV · 18 August 2026 · Read the original →

Exploited CVEs

CVE-2026-20349: Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

Why it matters — Confirmed exploited in the wild. CVSS 8.6 (HIGH). CISA remediation deadline 14 Aug 2026 — already passed.

CISA KEV · 18 August 2026 · Read the original →

Exploited CVEs

CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Why it matters — Confirmed exploited in the wild. CVSS 7.0 (HIGH). CISA remediation deadline 25 Aug 2026 — 7 days out.

CISA KEV · 18 August 2026 · Read the original →

Nice of the industry to plan our sprint capacity for us.

4 stories, every Tuesday

Published here every week. Follow by RSS to get it as it lands.

Subscribe by RSS All issues
← Previous issue Next issue →