Monday, May 18, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Monday's disclosures concentrate on WordPress plugin code, GitBucket developer tooling, and ACL Analytics, with three critical CVEs at CVSS 9.8 enabling remote compromise of web-facing and developer-adjacent systems. Critical volume held steady at 3 (0% change) while high-priority disclosures dropped to 23, a 60% decline from the prior day's 57. CVE-2018-25335 affects a WordPress Peugeot plugin, CVE-2018-25332 targets GitBucket, and CVE-2018-25320 impacts ACL Analytics, all rated CVSS 9.8 with remote attack vectors. Two actively exploited vulnerabilities were observed in Cisco Catalyst SD-WAN (CVE-2026-20182) and Microsoft (CVE-2026-42897), both at CVSS 9.5, indicating continued attacker focus on edge networking and enterprise platforms. No patches are currently available across the 26 disclosed CVEs, requiring defenders to rely on compensating controls, network segmentation, and exposure reduction until vendor fixes ship.

  • WordPress plugin, GitBucket, and ACL Analytics carry the day's three critical CVEs, all CVSS 9.8 with remote attack vectors
  • Critical CVEs held steady at 3 (0% change from prior day)
  • High-priority CVEs dropped to 23, a 60% decline from the prior day's 57
  • Remote code execution dominates the critical tier across web plugin, source control, and analytics platforms
  • Patch availability sits at 0% across all 26 disclosures, leaving mitigation as the primary defensive option
  • Two actively exploited CVEs affect Cisco Catalyst SD-WAN and Microsoft platforms at CVSS 9.5

Immediate action: Prioritize exposure review for WordPress installations running the affected Peugeot plugin, GitBucket developer instances, and ACL Analytics deployments, alongside Cisco Catalyst SD-WAN edge devices where active exploitation is confirmed. With no patches available for today's disclosures, apply network segmentation, restrict administrative access, and monitor for indicators of compromise on the affected products until vendor updates are released.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation