Monday, March 30, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Monday's vulnerability disclosures are dominated by critical flaws in MLflow and OpenClaw, with a perfect CVSS 10.0 remote code execution vulnerability in MLflow (CVE-2025-15379) and five additional critical OpenClaw vulnerabilities scoring 9.8-9.9. The day's 68 disclosed CVEs include 7 critical and 61 high-priority issues, with high-severity volume dropping 38% from the prior day while critical counts held steady. Eight vulnerabilities have confirmed active exploitation, targeting Apple products, Zimbra Collaboration Suite, Craft CMS, Laravel Livewire, Langflow, and Aquasecurity Trivy. Attack patterns center on remote code execution and authentication bypass across both ML/AI platforms and widely deployed enterprise software. No patches are currently available for any of the disclosed vulnerabilities, requiring defenders to rely on compensating controls and network-level mitigations.

  • MLflow CVE-2025-15379 scores a perfect CVSS 10.0 — assess exposure in any ML pipeline environments immediately
  • 7 critical CVEs disclosed (unchanged from prior day), with 5 affecting OpenClaw at CVSS 9.8-9.9
  • 61 high-priority CVEs, down 38% from the prior day's 98
  • Active exploitation confirmed across Apple products, Zimbra ZCS, Craft CMS, Laravel Livewire, Langflow, and Trivy
  • Patch availability stands at 0% — no vendor fixes released for any of the 68 disclosed vulnerabilities
  • 8 actively exploited vulnerabilities span enterprise collaboration, CMS, and AI/ML tooling categories

Immediate action: Organizations running MLflow, OpenClaw, Apple products, Zimbra, Craft CMS, Laravel Livewire, Langflow, or Trivy should audit exposure immediately and apply network segmentation or access restrictions as interim mitigations. With zero patches currently available, prioritize monitoring for exploitation indicators and restrict public-facing access to affected services until vendor fixes are released.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation