Sunday, March 29, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Sunday's disclosures include 10 actively exploited vulnerabilities targeting F5 BIG-IP, Apple products, Zimbra Collaboration Suite, and Craft CMS, all carrying CVSS 9.5 scores. Critical CVEs dropped to 7 (down 53% from Saturday's 15), while 98 high-priority vulnerabilities were disclosed (down 2%). Among the critical findings, CVE-2025-53521 affects F5 BIG-IP infrastructure, CVE-2025-43510 and CVE-2025-43520 target multiple Apple products, and CVE-2025-66376 impacts Synacor Zimbra mail servers. Attack patterns center on remote code execution across web application frameworks including Laravel Livewire, Craft CMS, and Langflow, alongside security tool compromise via CVE-2026-33634 in Aquasecurity Trivy. Patch availability currently stands at 0%, requiring defenders to prioritize compensating controls and network-level mitigations for exposed services.

  • F5 BIG-IP, Apple, and Zimbra among vendors with actively exploited CVSS 9.5 vulnerabilities requiring immediate attention
  • 7 critical CVEs disclosed (down 53% from prior day's 15), with 105 total vulnerabilities tracked
  • 98 high-priority CVEs disclosed (down 2% from 100), maintaining elevated volume
  • Remote code execution dominates attack patterns across Craft CMS, Laravel Livewire, Langflow, and Wing FTP Server
  • 0% patch availability across all disclosed CVEs — compensating controls and network segmentation are essential
  • 10 vulnerabilities confirmed under active exploitation, unchanged from the prior day

Immediate action: Prioritize network-level mitigations for internet-facing F5 BIG-IP, Zimbra, Wing FTP Server, and Craft CMS instances, as all have confirmed active exploitation with no patches currently available. Apply compensating controls such as WAF rules, access restrictions, and enhanced monitoring for Apple products, Laravel Livewire, and Langflow deployments until vendor patches are released.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation