CVE-2026-21513
A protection mechanism failure in the MSHTML Framework allows an unauthenticated attacker to bypass security features over a network, potentially leading to unauthorized system access.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Sunday's disclosures are dominated by 17 actively exploited vulnerabilities targeting Microsoft Windows, Office, Apple OS, and Google Chromium, all carrying CVSS 9.5 scores. No new critical CVEs were disclosed, a sharp drop from the prior day's 24, while high-priority vulnerabilities fell 64% to 35. Notable KEV entries include CVE-2026-21513 and CVE-2026-21525 affecting Microsoft Windows, CVE-2026-20700 targeting Apple OS, and CVE-2026-2441 in Google Chromium. Attack patterns center on remote code execution and privilege escalation across enterprise operating systems, productivity suites, and collaboration platforms including Roundcube Webmail and Zimbra. No patches are currently available for the disclosed vulnerabilities, requiring defenders to prioritize compensating controls and monitoring.
Immediate action: Prioritize compensating controls for Microsoft Windows, Apple OS, and Google Chromium environments where active exploitation is confirmed but patches are unavailable. Review network segmentation and access restrictions for Roundcube Webmail, Zimbra, and GitLab instances given confirmed exploitation of CVE-2025-49113, CVE-2020-7796, and CVE-2021-22175. Monitor vendor security advisories closely for forthcoming patch releases and apply them immediately upon availability.
A protection mechanism failure in the MSHTML Framework allows an unauthenticated attacker to bypass security features over a network, potentially leading to unauthorized system access.
Microsoft Windows NULL Pointer Dereference Vulnerability - Active in CISA KEV catalog.
A protection mechanism failure in the Windows Shell allows an unauthenticated attacker to bypass security features over a network connection.
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate their privileges locally on the affected system.
A type confusion vulnerability in the Desktop Window Manager (DWM) allows an authorized local attacker to elevate their privileges to a higher level.
A security feature bypass vulnerability in Microsoft Office Word exists due to reliance on untrusted inputs, allowing an unauthorized local attacker to circumvent security protections.
A memory corruption vulnerability in Apple software was addressed through improved state management to prevent potential exploitation.
Microsoft Configuration Manager SQL Injection Vulnerability - Active in CISA KEV catalog.
Notepad++ Download of Code Without Integrity Check Vulnerability - Active in CISA KEV catalog.
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability - Active in CISA KEV catalog.
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability - Active in CISA KEV catalog.
Google Chrome is vulnerable to a "Use After Free" condition in its CSS engine, which could allow a remote attacker to execute arbitrary code via a crafted webpage.
GitLab Server-Side Request Forgery (SSRF) Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Deserialization of Untrusted Data Vulnerability - Active in CISA KEV catalog.
RoundCube Webmail Cross-site Scripting Vulnerability - Active in CISA KEV catalog.
FileZen is affected by a high-severity OS command injection vulnerability that allows a threat actor to execute arbitrary commands on the underlying operating system.
Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' parameter
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt' parameter
Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'val' parameter
The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection, which could allow for remote code execution.
The wpForo 2 forum plugin for WordPress contains a high-severity vulnerability that could lead to unauthorized database access or system compromise.
phpMyFAQ, an open-source FAQ web application, is affected by a high-severity vulnerability that could allow for unauthorized system interaction.
Homey BNB V4 contains an unauthenticated SQL injection vulnerability in the 'hosting_id' parameter, allowing for unauthorized database query manipulation.
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter, potentially allowing for unauthorized database access.
osCommerce 2
osCommerce 2
osCommerce 2
A security vulnerability exists in the Nimiq Proof-of-Stake protocol implementation within the Albatross consensus algorithm, potentially impacting network stability or integrity.
Docker Model Runner (DMR), used for managing AI models, contains a high-severity vulnerability that could lead to unauthorized access or model manipulation.
A high-severity vulnerability in Kaniko, a container image builder, could allow attackers to compromise build environments within Kubernetes clusters.
OpenEMR, an open-source medical practice management application, contains a security vulnerability that could lead to unauthorized access or data compromise.
A high-severity security vulnerability has been identified in Gradio, an open-source Python package used for rapid prototyping of machine learning models.
A security vulnerability has been detected in Tenda F453 1
A vulnerability was detected in Tenda F453 1
A flaw has been found in Tenda F453 1
A vulnerability has been found in Tenda F453 1
A vulnerability was found in Tenda F453 1
A security vulnerability in the Gradio Python package could allow attackers to compromise applications built for rapid machine learning prototyping.
A Blind SQL Injection vulnerability exists in the Service Dependencies deletion function due to the failure to sanitize array keys.
Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by injecting SQL syntax into username and password fields
Statamic CMS, a Laravel and Git-powered content management system, contains a high-severity vulnerability that could allow for unauthorized system manipulation.
PublicCMS v5 is affected by a high-severity security vulnerability that could lead to unauthorized system access or data compromise.
Statmatic is a Laravel and Git powered content management system (CMS)
CleverTap Web SDK version 1
CleverTap Web SDK version 1
Kiteworks is a private data network (PDN)
Statamic CMS, built on Laravel and Git, is vulnerable to a high-severity security flaw that could compromise the integrity of the content management system.
A high-severity flaw was identified in the REXML library, a Ruby-based XML toolkit, which could lead to service disruption or data exposure.
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby
SODOLA SL902-SWTGW124AS firmware versions through 200