Saturday, February 28, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Yesterday's disclosures reveal 24 critical vulnerabilities affecting a broad range of products including HP FreeFlow and scripting components, WeGIA Web Manager, Xerox FreeFlow Core, and Copeland XWEB Pro — both scoring a perfect CVSS 10. Critical CVEs rose 33% from the prior day while high-priority vulnerabilities held steady at 97 (down 3%). Notable entries include CVE-2026-28409 in WeGIA Web Manager and CVE-2026-21718 in Copeland XWEB Pro, both with maximum severity scores, alongside multiple CVSS 9.8 flaws in SODOLA firmware, Totolink routers, and Vikunja project management software. Microsoft Windows and Office account for the majority of the 17 actively exploited vulnerabilities, with legacy flaws in Zimbra, GitLab, and Roundcube Webmail also under active exploitation. Patch availability currently sits at 0%, making compensating controls and network segmentation essential while vendors release fixes.

  • Two maximum-severity CVSS 10 vulnerabilities disclosed in WeGIA Web Manager (CVE-2026-28409) and Copeland XWEB Pro (CVE-2026-21718)
  • 24 critical CVEs disclosed, a 33% increase from the prior day's 18
  • 97 high-priority CVEs, a slight 3% decrease from the prior day's 100
  • Remote code execution and authentication bypass patterns dominate, affecting HP, Xerox FreeFlow Core, Totolink routers, SODOLA firmware, and OpenStack Vitrage
  • 0% patch availability across all 121 disclosed CVEs — no vendor fixes currently released
  • 17 actively exploited vulnerabilities spanning Microsoft Windows, Office, Apple OS, Google Chromium, and Roundcube Webmail

Immediate action: Prioritize mitigation for Microsoft Windows and Office systems, which represent the largest cluster of actively exploited vulnerabilities, and isolate any internet-facing Copeland XWEB Pro, WeGIA, and Roundcube Webmail instances. With 0% patch availability, apply network segmentation, restrict access to affected services, and monitor vendor advisories closely for upcoming fixes.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation