IT security 2026-08-21

Level Tense — 75/100 — 2026-08-21

Tense day: 24 stories ranked, 3 of the top 10 reported as actively exploited, 3 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: TrueConf Server Code Injection Vulnerability (67/100).

  1. TrueConf Server Code Injection Vulnerability — 67/100 (CVE-2026-72530)
  2. TrueConf Server Missing Authentication for Critical Function Vulnerability — 66/100 (CVE-2026-72529)
  3. Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability — 65/100 (CVE-2026-73570)
  4. vmware spring ai: In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but i… — 38/100 (CVE-2026-59318)
  5. tp-link er7212pc firmware: A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to o… — 35/100 (CVE-2026-19586)
  6. CVE-2026-17000 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to… — 30/100 (CVE-2026-17000)
  7. CVE-2026-17138 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to… — 30/100 (CVE-2026-17138)
  8. CVE-2026-19437 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to… — 30/100 (CVE-2026-19437)
  9. CVE-2026-17436 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to… — 30/100 (CVE-2026-17436)
  10. CVE-2026-18832 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to… — 30/100 (CVE-2026-18832)