On August 8, 2026, Metabase disclosed a maximum-severity SQL injection flaw (CVSS 10.0) that was already being exploited in the wild. The vulnerability lets unauthenticated attackers gain administrator privileges and drain every connected database. Self-hosted Metabase admins must patch, revoke sessions, and rotate all secrets immediately.

CVE-2026-65667 is an unauthenticated privilege escalation in Microsoft Teams, rated CVSS 10.0, published August 6, 2026 outside the Patch Tuesday cycle. The advisory omits the affected component and the patched build — here's what security teams should do while they wait.