IT security 2026-08-18

Level Critical — 94/100 — 2026-08-18

Critical day: 17 stories ranked, 5 of the top 10 reported as actively exploited, 5 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability (90/100).

  1. Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability — 90/100 (CVE-2026-33824)
  2. Broadcom VMware vCenter Path Traversal Vulnerability — 78/100 (CVE-2026-59310)
  3. Microsoft SharePoint Weak Authentication Vulnerability — 70/100 (CVE-2026-55040)
  4. Ray-Project Ray Code Injection Vulnerability — 67/100 (CVE-2025-62593)
  5. Apple macOS Improper Authentication Vulnerability — 67/100 (CVE-2026-65400)
  6. mozilla firefox: Use-after-free in the JavaScript: WebAssembly component. — 38/100 (CVE-2026-74936)
  7. mozilla firefox: Use-after-free in the Graphics: Text component. — 38/100 (CVE-2026-74940)
  8. mozilla firefox: Use-after-free in the Graphics: ImageLib component. — 38/100 (CVE-2026-74943)
  9. mozilla firefox: Use-after-free in the DOM: Core & HTML component. — 38/100 (CVE-2026-74944)
  10. CVE-2026-47606 — NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute p… — 35/100 (CVE-2026-47606)