Tuesday, March 10, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Tuesday's vulnerability disclosures reveal critical flaws in Delta Electronics COMMGR2 (CVE-2026-3630, CVSS 9.8) and Progress Budibase (CVE-2026-30240, CVSS 9.6), alongside web-enabled controller vulnerabilities affecting building automation systems. The day's 80 CVEs include 5 critical-severity issues, up 150% from Monday's 2, and 75 high-priority vulnerabilities, a 23% increase. Industrial control systems and low-code development platforms are the primary attack surfaces, with remote code execution and authentication bypass patterns dominating the critical findings. Fourteen vulnerabilities have confirmed active exploitation, including long-standing flaws in GitLab, Ivanti Endpoint Manager, Broadcom VMware Aria Operations, and multiple Apple products. No patches are currently available for Tuesday's newly disclosed CVEs, making network segmentation and compensating controls essential for affected systems.

  • Delta Electronics COMMGR2 carries the highest severity (CVSS 9.8) among newly disclosed CVEs, affecting industrial communications infrastructure
  • Critical CVE count jumped to 5, a 150% increase from Monday's 2 critical disclosures
  • 75 high-priority vulnerabilities disclosed, up 23% from the prior day's 61
  • Remote code execution and authentication bypass flaws affect building automation controllers (wwwupdate.cgi, wwwupload.cgi) and Budibase server components
  • Patch availability stands at 0% for newly disclosed CVEs — compensating controls and network segmentation are immediately necessary
  • 14 actively exploited vulnerabilities span Ivanti EPM, VMware Aria Operations, SolarWinds Web Help Desk, Roundcube Webmail, and Qualcomm chipsets

Immediate action: Prioritize network isolation for Delta Electronics COMMGR2 systems and building automation controllers running vulnerable wwwupdate.cgi and wwwupload.cgi services, as no patches are currently available. Review exposure to actively exploited flaws in Ivanti Endpoint Manager, Broadcom VMware Aria Operations, SolarWinds Web Help Desk, and Roundcube Webmail, and apply any existing vendor mitigations or access restrictions immediately.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation