🔐 Security Pulse · 2026-08-05 16:00 UTC

⚡ TL;DR

Multiple critical vulnerabilities disclosed in popular CMS, AI platforms, and network devices, including CVE-2026-70590 and CVE-2026-71285, risking credential leaks and remote code execution. Overall cyber threat level remains elevated.

🔐 CYBER THREATS

• 🔴🔴🔴 Ghost CMS vulnerabilities (CVE-2026-70590 to CVE-2026-70593) allow staff-level users to leak hashed passwords, SSRF, remote file overwrite, and unauthorized write outside uploads directory, risking site takeover and data leaks ^[1][2][3].
• 🔴🔴 CVE-2026-71285 in Uptime Kuma's Matomo integration injects unquoted JavaScript siteId, enabling XSS attacks on admins ^[4].
• 🔴 CVE-2026-18814 in H3C NX15 device allows command injection via API leading to critical infrastructure compromise risks ^[5].
• 🟡🟡 CVE-2026-70620 and CVE-2026-70619 in Odysseus service permit admin and authenticated users to conduct SSRF and manage embedding backend configs, opening internal network reconnaissance paths ^[6][7].
• 🔴 CVE-2026-70591 Ghost Admin SSRF vulnerability via image fetching abused by staff users for internal network probing ^[8].
• 🟡 CVE-2026-70492, CVE-2026-70493, CVE-2026-70494 in Open WebUI AI platform permit XSS, knowledge base exposure, and improper deletion of folders, threatening self-hosted AI deployments ^[9][10].
• 🟡 CVE-2026-13227 ERPNext API improper authorization risks unauthorized data access in versions prior to v16.25.0 and v15.115.0.
• 🟡 CVE-2026-18813 CVE-2026-18814 H3C NX15 also suffers multiple vulnerabilities (API delete function and reload_config leading to command injection) affecting networking equipment ^[5].
• 🔴 CVE-2026-70588 Ghost CMS import sanitization failure could enable content-based attacks via Universal Import ^[1].

🛡️ NATIONAL SECURITY

• 🟡 CISAgov highlights improved Bomb-making Materials Awareness Program (BMAP) working with local agencies to detect suspicious explosive precursor chemical purchases, increasing homeland security resilience.
• No new reported military movements or espionage activities detected in last 24h feeds.

⚠️ RISK FLAGS

• ⚠️⚠️ Active exploitation likely for Ghost CMS multi-CVE chain (password leak, SSRF, file overwrite) given staff-level user access can be common in managed CMS environments, risking wide site compromises ^[1][2][3].
• ⚠️ CVE-2026-18814 H3C NX15 command injection vulnerability in critical networking infrastructure could be exploited for persistent access or service disruption, requires urgent patching ^[5].
• ⚠️ SSRF and missing authorization in Odysseus (CVE-2026-70620, CVE-2026-70619) present internal network scanning and configuration control risks, requiring immediate risk assessment ^[6][7].

🧭 THREAT MOOD

• 🟡 Elevated: Multiple high-impact vulnerabilities disclosed in critical platforms combined with active exploitation potential in CMS and networking devices require heightened vigilance and patch prioritization. No immediate physical/national security crisis reported.

📎 Sources

1. CVE-2026-70588 Ghost is a Node.js content management system. F… — @CVEnew
2. CVE-2026-70589 Ghost is a Node.js content management system. F… — @CVEnew
3. CVE-2026-70590 Ghost is a Node.js content management system. P… — @CVEnew
4. CVE-2026-71285 Uptime Kuma's Matomo analytics integration (ser… — @CVEnew
5. CVE-2026-18814 A vulnerability was found in H3C NX15 V100R017.… — @CVEnew
6. CVE-2026-70620 Odysseus before commit 87babb5 contains a serve… — @CVEnew
7. CVE-2026-70619 Odysseus before commit bf325f6 contains a missi… — @CVEnew
8. CVE-2026-70591 Ghost is a Node.js content management system. F… — @CVEnew
9. CVE-2026-70492 Open WebUI is an extensible, feature-rich, and … — @CVEnew
10. CVE-2026-70493 Open WebUI is an extensible, feature-rich, and … — @CVEnew

Educational & informational only — not financial advice. Markets carry risk; do your own research.
Serial 20260805-16-v31 · 2026-08-05 16:00 UTC · pulse.uzylab.com