Wednesday, March 25, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Wednesday's vulnerability disclosures are headlined by multiple critical Mozilla Firefox and Thunderbird flaws, including two perfect CVSS 10.0 sandbox escapes (CVE-2026-4688, CVE-2026-4725) and several additional 9.8-rated issues spanning privilege escalation and code execution. The day's 30 critical CVEs represent a 43% increase over Tuesday, while the 100 high-priority disclosures held steady. A critical WordPress vulnerability (CVE-2026-4001, CVSS 9.8) and a GitHub Actions workflow flaw (CVE-2026-33475, CVSS 9.1) round out the most severe new disclosures. Among the 14 actively exploited vulnerabilities, Apple products account for five entries and Google Chromium and Skia carry two, alongside ongoing exploitation of Craft CMS, Laravel Livewire, Zimbra, and Wing FTP Server. No patches are currently available for today's disclosed CVEs, making network-level mitigations and monitoring essential in the interim.

  • Two Mozilla Firefox/Thunderbird sandbox escape vulnerabilities rated CVSS 10.0, with six additional critical Mozilla flaws scoring 9.8
  • 30 critical CVEs disclosed, up 43% from Tuesday's 21
  • 100 high-priority CVEs, unchanged from the prior day
  • WordPress RCE (CVE-2026-4001) and GitHub Actions workflow compromise (CVE-2026-33475) affect widely deployed platforms
  • 0% patch availability across all disclosed CVEs — no vendor fixes released yet
  • 14 actively exploited vulnerabilities spanning Apple, Google Chromium, Zimbra, Craft CMS, and Laravel Livewire

Immediate action: Prioritize Mozilla Firefox and Thunderbird updates as soon as patches become available, given the two CVSS 10.0 sandbox escapes and multiple 9.8-rated flaws. Review exposure to WordPress, GitHub Actions, and the actively exploited products — Apple, Chromium, Zimbra, Craft CMS, and Wing FTP Server — and apply compensating controls such as WAF rules and network segmentation until vendor patches are released.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation