Daily briefing · August 14, 2026
Quiet Day, High Stakes: Ten Critical CVEs Published Across AI, ICS, IBM and WordPress
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — calm
August 14, 2026 brought no active exploitation or weaponized exploits, but the day's publication record is far from trivial — 201 new CVEs emerged, including 28 critical-severity entries. The standout concerns are a pair of CVSS 10.0 remote code execution flaws, multiple IBM Db2 Mirror for i weaknesses, and a cluster of WordPress authentication-bypass vulnerabilities, all published today and awaiting attacker attention.
Today’s brief
- Two CVSS 10.0 unauthenticated RCE flaws disclosed today: one in MindsDB Minds Platform, one in Haiwell IoT Cloud HMI Gateway — both reachable without credentials
- IBM Db2 Mirror for i (versions 7.4–7.6) hit with three critical CVEs: arbitrary CL command execution, path traversal code execution, and authentication bypass
- WordPress ecosystem takes heavy hits: Wishlist Member, User Session Synchronizer, and 6Storage Rentals all expose full account takeover to unauthenticated attackers
- No active exploitation confirmed today, but the volume and severity of new disclosures demand immediate patch prioritization
Critical highlights
1
A CVSS 10.0 unauthenticated RCE in MindsDB Minds Platform (v26.1.0 and earlier) allows any attacker to execute arbitrary OS commands by sending crafted prompts to an unprotected API endpoint that calls exec() on attacker-controlled Python code with no sandboxing — a critical exposure for any organization running this AI platform publicly.
2
A CVSS 10.0 OS command injection in the Haiwell IoT Cloud HMI Gateway's Net Check feature allows unauthenticated attackers to inject arbitrary commands via a Socket.io event — ICS/OT environments running this device should treat this as an emergency priority given the lack of input sanitization.
3
IBM Db2 Mirror for i (7.4, 7.5, 7.6) allows remote attackers to execute arbitrary CL commands due to improper neutralization of special elements — a CVSS 9.9 flaw that could result in full system compromise on affected IBM i environments.
4
SiYuan (v3.7.2 and earlier) carries a first-order SQL injection in its backlink/mention search that allows stored metadata to break out of SQL context when combined with a client-supplied single quote — defenders running this note-taking platform internally should patch immediately to prevent data exfiltration or privilege escalation.
5
The Wishlist Member WordPress plugin (up to v3.34.1) enables full account takeover through insufficient verification of registration parameters, allowing an unauthenticated attacker to merge into arbitrary user accounts — sites using this membership plugin should disable or update without delay.
6
User Session Synchronizer for WordPress (up to v1.4.0) performs zero validation on attacker-supplied session synchronization parameters, firing on every request and allowing complete authentication bypass and account takeover — any site with this plugin installed is effectively open to unauthenticated admin access.
7
The 6Storage Rentals WordPress plugin (up to v2.27.0) exposes an AJAX handler with no nonce, capability, or ownership checks, letting unauthenticated attackers set session cookies for any existing WordPress user — this is a trivially exploitable authentication bypass requiring immediate remediation.
8
IBM Db2 Mirror for i (7.4, 7.5, 7.6) is vulnerable to arbitrary code execution via external control of file name or path — when chained with other weaknesses in the same product cluster, this raises the overall risk posture for IBM i shops significantly.
9
A third critical flaw in IBM Db2 Mirror for i allows remote attackers to bypass authentication and read or modify sensitive data through improper validation of URI path segments — organizations relying on this platform for database mirroring should apply IBM's guidance as an urgent priority.
10
The mcp-memory-service AI memory layer (prior to v10.67.1) exposes all document API routes without authentication even when an API key or OAuth is configured — unauthenticated attackers can upload, retrieve, or manipulate the entire memory store, posing a serious data integrity and confidentiality risk for AI-driven applications.
Ransomware today
Ransomware activity targeting Brazil remains notably intense in recent days. The groups thegentlemen and m3rx claimed new Brazilian victims, including Vector Two Technology and Megalaser Industria Metalurgica LTDA (thegentlemen) and tecnoabi.com (m3rx). Over the past 30 days, lockbit5 leads all groups in activity with 21 confirmed victims, all in Brazil, underlining the country's continued status as a primary ransomware target.
tecnoabi.com BRm3rx · Technology
Vector Two Technology BRthegentlemen · Technology
Megalaser Industria Metalurgica LTDA BRthegentlemen · Manufacturing
lockbit5 21Section9 6thegentlemen 5Global Secret Group 4L Group 2ransomhouse 2
Active groups & APTs
Several threat actor clusters are being monitored for potential activity, including linkc, Equation, Darkhotel (attributed to North Korea), karakurt, LeakBazaar, and apt73. No new confirmed victims have been attributed to these groups in the current window, but their continued tracking reflects ongoing intelligence interest in their infrastructure and targeting patterns.
Brazil focus
Brazil's threat landscape remains highly active across multiple sectors in recent weeks. Confirmed ransomware victims include tecnoabi.com and Vector Two Technology (Technology), Megalaser Industria Metalurgica LTDA (Manufacturing), Chat Jurídico (Professional Services), uva.edu.br (Education), Intranet Gov Brasil (Government & Defense), brdigital.net.br (Technology), and Alya Construtora (Manufacturing) — with groups including thegentlemen, m3rx, direwolf, L Group, and ransomhouse all demonstrating a clear, sustained focus on Brazilian targets across both public and private sectors.
tecnoabi.comm3rx · Technology
Vector Two Technologythegentlemen · Technology
Megalaser Industria Metalurgica LTDAthegentlemen · Manufacturing
Chat Jurídicodirewolf · Professional Services
uva.edu.brL Group · Education
Intranet Gov Brasilthegentlemen · Government & Defense
brdigital.net.brL Group · Technology
Alya Construtoraransomhouse · Manufacturing
Today’s recommendation: Security teams should prioritize patching today's CVSS 10.0 RCE flaws in MindsDB and Haiwell before exploitation attempts begin, while immediately auditing WordPress deployments for the three authentication-bypass plugins and applying IBM's mitigations for the Db2 Mirror for i cluster.
Knowing which of today's critical vulnerabilities exist in your environment is the first step — validating that your controls actually prevent their exploitation is what separates monitoring from real resilience.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →