Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization
A Russian security engineer has released Vulnaware, an open-source prioritization engine designed to solve one of the most persistent problems in vulnerability management: ensuring that genuinely dangerous flaws reach remediation teams before they become incidents.
The project was created after the author observed that vulnerabilities rarely compete successfully for attention inside IT service desks because they lack an associated ticket, SLA, or downtime impact. According to Verizon DBIR 2026, exploitation of vulnerabilities overtook credential theft for the first time in the report’s 19-year history, accounting for 31 percent of breaches compared with 20 percent the previous year.
Vulnaware is not a vulnerability scanner or a full VM platform. Instead, it functions as an independent layer that sits between existing scanners and ITSM systems. It currently accepts data from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS. Scope is limited at ingestion using asset groups, scan folders, or host tags so that only relevant assets are processed.
Prioritization relies on three concrete signals: presence in the CISA KEV catalog, availability of exploits in community feeds from Vulncheck, and trend indicators when available from MaxPatrol. The goal is to surface only those vulnerabilities that have at least one working exploit, dramatically reducing noise for security and IT teams.
Once an issue is prioritized, Vulnaware can automatically create tickets in Jira Service Management, GLPI, Znuny, and osTicket. It also sends notifications through a Telegram bot (with optional asset obfuscation) and email templates built with Jinja. A lightweight web interface allows manual review and one-click dispatch when automatic routing is not desired.
The tool’s design follows the five-stage lifecycle described in NIST SP 800-40 Rev. 4 and the risk-based timelines introduced by CISA BOD 26-04, which replaced rigid deadlines with a matrix considering asset exposure, KEV listing, exploit automation, and technical impact. By converting prioritized vulnerabilities into properly classified service requests or changes, the solution gives organizations measurable MTTR data for the flaws that actually matter.
Related articles
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.
Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been identified in the go-archive archive processing library used by Docker and related software. The flaw, tracked as CVE-2026-17106, affects the Unpack, UnpackLayer, and Untar functions and permits files to be created or overwritten outside the intended extraction directory. The issue stems from a mismatch between the path string validated by the code and the actual path resolved by the operating system. Docker rated the vulnerability 7.1 under CVSS v4.0 and classified it as High severity. A proof-of-concept exploit has already been published for macOS and Linux. The fix was implemented in go-archive 0.3.0 and shipped in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0.
Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch
Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.
CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency has added two critical vulnerabilities affecting TrueConf Server to its Known Exploited Vulnerabilities catalog. CVE-2026-72529 allows unauthenticated remote attackers to execute arbitrary scripts due to missing authentication in a critical function. CVE-2026-72530 is a code injection flaw that enables attackers to run arbitrary code on the underlying host system by escaping the sandboxed environment. Both issues can be exploited over TCP port 4307 without requiring authentication. Kaspersky assigned CVSS v3.1 base scores of 9.8 and 9.0 respectively, rating both as Critical. US federal agencies must apply mitigations for the first vulnerability by August 23 and for the second by September 3.