Friday, May 1, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Friday's disclosures center on Progress Software MOVEit, Shopizer, and Totolink router platforms, with several remote code execution flaws affecting widely deployed enterprise and edge infrastructure. The brief includes 8 critical CVEs (unchanged from the prior day) and 99 high-priority vulnerabilities (down 1%). Notable entries include CVE-2026-4670 (CVSS 9.8) in MOVEit, CVE-2026-36767 (CVSS 10) in Shopizer, and CVE-2026-7546 (CVSS 9.8) in Totolink NR1800X routers. Attack patterns skew toward unauthenticated RCE and authentication bypass, with file transfer and e-commerce platforms representing the highest-impact targets. Patches are currently unavailable for the disclosed set, requiring compensating controls and exposure reduction until vendor fixes ship.

  • Progress Software MOVEit, Shopizer, and Totolink lead today's critical disclosures, with MOVEit and Shopizer representing high-value enterprise targets
  • 8 critical CVEs disclosed, unchanged from the prior day
  • 99 high-priority CVEs disclosed, a 1% decrease from the prior day
  • Unauthenticated RCE and authentication bypass dominate, affecting file transfer (MOVEit), e-commerce (Shopizer), and edge networking (Totolink, JeeSite)
  • 0% patch availability across the disclosed set, requiring compensating controls for MOVEit, Shopizer, and Totolink deployments
  • 13 CVEs flagged as actively exploited, including cPanel/WHM, PaperCut NG/MF, JetBrains TeamCity, and ConnectWise ScreenConnect

Immediate action: Prioritize compensating controls for Progress MOVEit, Shopizer storefronts, and Totolink NR1800X/A8000RU devices, and validate exposure of cPanel/WHM, PaperCut, TeamCity, and ConnectWise ScreenConnect instances against the active exploitation list. With no patches currently available for the disclosed critical set, restrict network exposure, enforce strict authentication, and monitor vendor advisories for fixes.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation