Morning Brief — 2026-09-04

3 material breach disclosures, 1 exploit probability movers, 10 emerging critical cves, 10 supply chain, 29 ransomware activity, 517 ioc volume, 20 active malware families, 2 intel feeds, 12 hand-authored sigma, and 18 detection gaps. Sections with no signal are still rendered with an explicit “none in this window” note so absence is visible alongside presence.

Material Breach Disclosures

Park Dental Partners, Inc. (PARK)

• Filed: 2026-09-01 · CIK 0002069604 · Accession 0001104659-26-104300
• Filing: https://www.sec.gov/Archives/edgar/data/2069604/000110465926104300/park-20260828x8k.htm

On August 28, 2026, Park Dental Partners, Inc. (“we” or the “Company”) identified unauthorized access to its computer network. The Company promptly initiated its incident response protocols, and engaged its external cybersecurity and forensic specialists. The Company is continuing to investigate the nature and scope of this incident, including the scope of any compromise of personal or protected h…

NovoCure Ltd (NVCR)

• Filed: 2026-09-01 · CIK 0001645113 · Accession 0001645113-26-000065
• Filing: https://www.sec.gov/Archives/edgar/data/1645113/000164511326000065/nvcr-20260901.htm

Forward-Looking StatementsIn addition to historical facts or statements of current condition, this press release may contain forward-looking statements. Forward-looking statements provide Novocure’s current expectations or forecasts of future events. These may include statements regarding anticipated scientific progress on its research programs, clinical study progress, development of potential pr…

Nutex Health Inc. (NUTX)

• Filed: 2026-08-31 · CIK 0001479681 · Accession 0001628280-26-059602
• Filing: https://www.sec.gov/Archives/edgar/data/1479681/000162828026059602/nutx-20260831.htm

remediation of the incident. Readers are cautioned that these forward-looking statements are not guarantees of future events or outcomes and they should not be unduly relied on, as they are based on information available to the Company and on management’s current beliefs and expectations as of the date of this Current Report on Form 8-K and are therefore inherently uncertain and subject to risks,…

Federal Patching Priority

No new KEV additions in this window.

Exploit Probability Movers

Emerging Critical CVEs

• CVE-2026-83711 · CRITICAL (10.0) · 2026-09-03 — Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-70352 · CRITICAL (10.0) · 2026-09-03 — Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-85061 · CRITICAL (10.0) · 2026-09-03 — MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes fro…
• CVE-2026-85223 · CRITICAL (9.9) · 2026-09-03 — A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback…
• CVE-2026-85031 · CRITICAL (9.9) · 2026-09-03 — A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote explo…
• CVE-2026-70403 · CRITICAL (9.8) · 2026-09-04 — XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
• CVE-2026-69657 · CRITICAL (9.8) · 2026-09-04 — XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
• CVE-2026-62928 · CRITICAL (9.8) · 2026-09-04 — XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
• CVE-2026-15354 · CRITICAL (9.8) · 2026-09-04 — The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the submit() function, which allows unauthenticated fo…
• CVE-2026-85509 · CRITICAL (9.8) · 2026-09-04 — FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.

Supply Chain

GHSA-8x84-r2ff-h8pq · CVE-2026-72801 (go)

• HIGH · CVSS 7.5 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-8x84-r2ff-h8pq

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

GHSA-vpjw-wf5h-cgpq · CVE-2026-72804 (go)

• HIGH · CVSS 8.6 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-vpjw-wf5h-cgpq

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

GHSA-x67c-8pwr-m8g3 · CVE-2026-72807 (go)

• HIGH · CVSS 8.0 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-x67c-8pwr-m8g3

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

GHSA-3mp7-4rh5-jrv9 · CVE-2026-72809 (go)

• HIGH · CVSS 8.0 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-3mp7-4rh5-jrv9

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

GHSA-mw8r-mw84-88v2 · CVE-2026-72810 (go)

• HIGH · CVSS 8.6 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-mw8r-mw84-88v2

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

GHSA-q2vg-7qgx-x5fc · CVE-2026-72811 (go)

• CRITICAL · CVSS 10.0 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-q2vg-7qgx-x5fc

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

GHSA-7j72-f6wg-cxw6 (go)

• HIGH · CVSS 8.6 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-7j72-f6wg-cxw6

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

GHSA-36v8-mpjm-8j5r · CVE-2026-68586 (go)

• HIGH · CVSS 8.6 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-36v8-mpjm-8j5r

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

GHSA-69mh-gvh4-8gp7 · CVE-2026-68587 (go)

• HIGH · CVSS 8.6 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-69mh-gvh4-8gp7

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

GHSA-fph3-ghq9-vw66 · CVE-2026-69083 (go)

• CRITICAL · CVSS 10.0 · 2026-09-03
• Affected: github.com/siyuan-note/siyuan/kernel
• https://github.com/advisories/GHSA-fph3-ghq9-vw66

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

Ransomware Activity

29 new victim postings across 13 groups.

IOC Volume

517 new IOCs in this window. By source:

Recent OSINT Events

No curated MISP events in this window (bulk-IOC contributions tallied in IOC Volume).

Active Malware Families

20 malware families active this week (0 corroborated across ≥2 sources), exercising 21 ATT&CK techniques. Family is the unit, not the indicator: the raw IOCs are drill-down evidence below, not the signal.

Families marked ”→” are delivery/social-engineering clusters (ClickFix, GuLoader). Their technique mappings are the delivery chain — downstream behavior is payload-dependent, so they don’t open a hard coverage gap on their own.

Multi-Source IOCs

No IOCs corroborated across multiple sources in this window. Each feed reported uniquely.

MISP × KEV Correlation

No MISP events in this window referenced a CVE.

Cross-Reference

No SEC × KEV vendor token matches in this window. (This is a heuristic surface, absence is expected most days.)

Intel Feeds

2 IOC feeds updated this run (3,180 indicators total) — each available as CSV, MISP JSON, and STIX 2.1. Subscribe at https://thrunt.me/intel/manifest.json.

Hand-Authored Sigma

10 production-ready TTP rules (+2 scaffolds in the authoring queue) live at https://thrunt.me/sigma/manifest.json. Subscribe via https://thrunt.me/sigma/rules.lock.json (content-hash churn) or pull all with https://thrunt.me/sigma/rules.tar.gz.

Detection Gaps

18 of 161 techniques with corpus signal have zero detection coverage — no SigmaHQ community rule, no thrunt rule. This is the hand-authoring queue; the live view is at https://thrunt.me/corpus/attck/.

…and 8 more below the cut — full list on the rollup.

Pipeline Health

All feeds healthy.

Sources: SEC EDGAR (public domain), CISA Known Exploited Vulnerabilities (public domain), FIRST.org EPSS (per ToS), NIST NVD (public domain), GitHub Security Advisories (per ToS), abuse.ch URLhaus (CC0, attribution), ransomware.live (per ToS), MITRE ATT&CK (CC BY 4.0).

Published by Applied Cybernetics Group via thrunt.me. Heuristic cross-references are labelled as such; verify before action.