Saturday, March 14, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Saturday's vulnerability disclosures include a maximum-severity sandbox escape in SandboxJS (CVE-2026-26954, CVSS 10.0) and critical remote code execution flaws in GNU inetutils telnetd (CVE-2026-32746) and HMS Networks Ewon industrial gateways (CVE-2026-25823, CVE-2026-25818). Nine critical vulnerabilities were disclosed, a 10% decrease from the prior day, alongside 100 high-priority issues holding steady. Actively exploited vulnerabilities rose 18% to 13, with confirmed exploitation targeting Ivanti Endpoint Manager (CVE-2026-1603), Broadcom VMware Aria Operations (CVE-2026-22719), and Qualcomm chipsets (CVE-2026-21385). Attack patterns center on remote code execution, authentication bypass, and privilege escalation across enterprise infrastructure, ICS/SCADA systems, and mobile platforms. No patches are currently available for Saturday's disclosures, requiring organizations to prioritize compensating controls and network segmentation.

  • Maximum-severity sandbox escape in SandboxJS (CVE-2026-26954, CVSS 10.0) enables arbitrary code execution outside sandboxed environments
  • 9 critical CVEs disclosed (down 10% from prior day), including RCE flaws in GNU inetutils telnetd and OneUptime monitoring platform
  • 100 high-priority CVEs maintained the same volume as the prior day, spanning enterprise and consumer products
  • ICS/SCADA exposure from HMS Networks Ewon Flexy and Cosy+ gateway vulnerabilities (CVSS 9.8 and 9.1) affecting industrial control environments
  • 0% patch availability across Saturday's disclosures — compensating controls and network isolation are the primary mitigation path
  • 13 actively exploited vulnerabilities confirmed, including Ivanti EPM, VMware Aria Operations, and multiple Apple products

Immediate action: Prioritize network segmentation for systems running SandboxJS, GNU inetutils telnetd, HMS Networks Ewon gateways, and Ivanti Endpoint Manager, as these represent the highest-risk attack surfaces from this disclosure cycle. With no patches currently available, implement compensating controls including WAF rules, access restrictions, and enhanced monitoring for exploitation indicators on affected platforms.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation