CERT / PSIRT advisories
285
● Daily security briefing
Wednesday, August 12, 2026
August 12 was a heavy advisory day with 285 CERT/PSIRT advisories and 2,499 CVEs published, though no new KEV additions were recorded. Microsoft's August 2026 security update and multiple Cisco product vulnerabilities dominated advisory output, with particular focus on Cisco ASA and Secure Firewall Threat Defense issues that enable denial of service attacks. The day featured eight critical CVEs, primarily concentrated in LXD containerization software (CVE-2026-63294, CVE-2026-63298, CVE-2026-63300, CVE-2026-66898, and CVE-2026-63299) involving root command execution and authorization bypass risks, alongside critical issues in IBM DOORS Next (CVE-2024-27253) and a markdown processing library (CVE-2026-73299).
CVEs published
2499
Added to KEV
0
Known exploited
12
12 critical5 high7 unknownacross the day’s notable advisories and CVEs
Notable advisories
Critical/high or exploited items from national CERTs and vendor PSIRTs.
- unknownexploitedhkcertMicrosoft Monthly Security Update (August 2026)
- unknownexploitedcert-fr-avisVulnerability in Cisco products (August 12, 2026)
- highexploitedcert-bund[UPDATE] [high] Oracle Communications: Multiple vulnerabilities
- highexploitedcert-bund[UPDATE] [high] Oracle Communications: Multiple vulnerabilities
- unknownexploitedhkcertCisco Products Multiple Vulnerabilities
- unknownexploitedjpcertSecurity Alert: Microsoft Releases August 2026 Security Updates
- unknownexploitedncsc-nlNCSC-2026-0295 [1.00] [M/H] Vulnerability patched in Cisco Secure Firewall ASA and FTD software
- highexploitedcert-bund[NEW] [high] Cisco ASA (Adaptive Security Appliance) and Secure Firewall Threat Defense: Vulnerability enables denial of service
- highexploitedcert-bund[UPDATE] [high] Oracle Communications: Multiple vulnerabilities
- highexploitedcert-bund[UPDATE] [high] Oracle Communications: Multiple vulnerabilities
- unknownexploitedcccsCisco security advisory (AV26-807)
- unknownexploitedcert-fr-avisMultiple vulnerabilities in Microsoft Windows (August 12, 2026)
Notable CVEs
Highest-severity CVEs published this day from the NVD and GitHub Advisory firehose — the sharpest items behind the day’s numbers.
- criticalCVE-2026-73299CVSS 10Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with un
- criticalCVE-2024-27253CVSS 10IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.
- criticalCVE-2026-63294CVSS 9.9A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, L
- criticalCVE-2026-63298CVSS 9.9An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration dire
- criticalCVE-2026-63300CVSS 9.9An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on
- criticalCVE-2026-66898CVSS 9.9A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive,
- criticalCVE-2026-73269CVSS 9.9A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a c
- criticalCVE-2026-63299CVSS 9.9An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits duri
- criticalCVE-2026-73268CVSS 9.9A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbi
- criticalCVE-2026-72508CVSS 9.9A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a
- criticalCVE-2026-63297CVSS 9.9An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-p
- criticalCVE-2026-63296CVSS 9.9An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a targe
Where the day’s advisories came from
Curated CERT and PSIRT sources — these add up to the 285 above.
Get this briefing by email. One free message every morning after 06:00 UTC — same data, zero noise, one-click unsubscribe. Subscribe. Tracking specific products instead? Watch them from any product page and get alerted only when they ship a new advisory.