Friday, June 12, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Friday's disclosures center on widely deployed infrastructure and web platforms, including a maximum-severity flaw in MariaDB Server and high-impact issues across Ubiquiti's UniFi OS and UID Enterprise Agent, cPanel's WordPress Toolkit, and the ClipBucket video platform. The brief covers 12 critical CVEs, unchanged from the prior day, alongside 61 high-priority vulnerabilities, a 65% increase. Notable entries include CVE-2026-49261 (CVSS 10, MariaDB Server), CVE-2026-47369 (CVSS 9.9, Ubiquiti UniFi OS), and CVE-2026-47365 (CVSS 9.9, cPanel WordPress Toolkit). Remote code execution, authentication bypass, and unauthenticated access dominate the affected products, spanning database, network management, hosting, and WordPress ecosystems. No patches were available at disclosure time for the tracked critical issues, so teams should prioritize compensating controls and monitor vendor advisories closely; seven CVEs carry confirmed active exploitation.

  • MariaDB Server CVE-2026-49261 reaches the maximum CVSS 10 rating, with critical flaws also affecting Ubiquiti UniFi OS and UID Enterprise Agent (CVSS 9.9)
  • 12 critical CVEs (CVSS 9.0+), unchanged from the prior day
  • 61 high-priority CVEs (CVSS 7.0-8.9), a 65% increase from 37 the prior day
  • Remote code execution and authentication bypass patterns affect cPanel WordPress Toolkit, ClipBucket, and Hippoo Mobile App for WooCommerce
  • Patch availability stands at 0% for the tracked critical vulnerabilities, requiring interim mitigations across database, hosting, and network-management systems
  • 7 vulnerabilities have confirmed active exploitation, including Ivanti Sentry (CVSS 10), Check Point Security Gateway, and Cisco Catalyst SD-WAN Manager

Immediate action: Prioritize MariaDB Server, Ubiquiti UniFi OS and UID Enterprise Agent, cPanel WordPress Toolkit, and ClipBucket deployments for immediate review, and apply compensating controls for actively exploited products including Ivanti Sentry, Check Point Security Gateway, SolarWinds Serv-U, and Cisco Catalyst SD-WAN Manager. With no patches available for the tracked critical issues at disclosure, restrict network exposure of affected services and monitor vendor channels for fixes.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation