The vulnerabilities security press is actually writing about — grouped by story, ranked by how many outlets are covering them and how fresh that coverage is. This measures attention, not age or severity: a critical bug nobody has written about won't appear here.
This week's vulnerability landscape is dominated by CISA adding five critical flaws to its Known Exploited Vulnerabilities catalog, spanning VMware vCenter, macOS, Ray, and Progress LoadMaster. Enterprise software remains the primary target, with a suspected China-nexus threat actor deploying Babuk ransomware via the vCenter flaw, while Microsoft's August Patch Tuesday addressed over 400 vulnerabilities including an actively exploited SharePoint zero-day.
Admins must patch CVE-2026-59310 immediately — suspected China-nexus actors are deploying Babuk-derived ransomware via this flaw.
Organisations with internet-exposed Macs should patch CVE-2026-65400 now — attackers are actively exploiting this for full device control.
Dev teams using Ray must apply the fix for CVE-2025-62593 — CISA gave federal agencies three days to remediate.
LoadMaster customers should patch CVE-2026-8037 urgently — CISA has confirmed active exploitation in the wild.
GitLab administrators should priorit CVE-2026-19478 — while not yet exploited, the unauthenticated flaw enables public project modification or deletion.
SharePoint administrators must patch the authentication bypass — attackers are actively exploiting it after a public PoC release.
Ranked by how many distinct security-news outlets are covering each vulnerability and how recent that coverage is, weighted by exploitation status (CISA KEV / EPSS) and severity. Related CVEs from a single event are grouped into one story. A CVE with no current press does not appear, however severe.