IT security 2026-08-03

Level Watchful — 52/100 — 2026-08-03

Watchful day: 10 stories ranked, 1 of the top 10 reported as actively exploited, 1 flaw newly added to CISA’s exploited-vulnerabilities catalogue. Top story: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability (65/100).

  1. N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — 65/100 (CVE-2026-18577)
  2. open-emr openemr: OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component… — 36/100 (CVE-2026-39932)
  3. CVE-2026-41452 — Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unau… — 36/100 (CVE-2026-41452)
  4. CVE-2026-18602 — A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. — 34/100 (CVE-2026-18602)
  5. CVE-2026-18614 — A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. — 34/100 (CVE-2026-18614)
  6. bouncycastle bc-java: In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. — 28/100 (CVE-2026-8763)
  7. bouncycastle bc-java: In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. — 28/100 (CVE-2026-59650)
  8. bouncycastle bc-java: In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certific… — 28/100 (CVE-2026-58062)
  9. CVE-2026-68979 — Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce au… — 23/100 (CVE-2026-68979)
  10. CVE-2026-68980 — Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Con… — 9/100 (CVE-2026-68980)