Sunday, April 12, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Yesterday's disclosures include a CVSS 10.0 vulnerability in the Sonos Era 300 (CVE-2026-4149) alongside two critical AWS flaws affecting AWS CLI and aws-mcp-server (CVE-2026-5059, CVE-2026-5058), both scoring 9.8. Critical CVEs dropped to 9, down 55% from the prior day's 20, while high-priority disclosures fell 26% to 74. Five separate critical vulnerabilities (CVE-2026-6112 through CVE-2026-6116) target the Totolink A7100RU router, all rated CVSS 9.8, indicating a broad attack surface in that device. Two vulnerabilities are under active exploitation—Google Dawn (CVE-2026-5281) and TrueConf Client (CVE-2026-3502)—both rated 9.5. No patches are currently available for any of the 83 disclosed CVEs, requiring defenders to rely on compensating controls and network-level mitigations.

  • Sonos Era 300 carries the day's only CVSS 10.0 rating (CVE-2026-4149), representing the highest-severity disclosure
  • Critical CVEs at 9, down 55% from 20 the prior day; high-priority CVEs at 74, down 26% from 100
  • Two AWS services affected at CVSS 9.8: AWS CLI Command (CVE-2026-5059) and aws-mcp-server (CVE-2026-5058)
  • Five distinct command injection or RCE vulnerabilities target the Totolink A7100RU router (CVE-2026-6112 through CVE-2026-6116)
  • Patch availability stands at 0% across all 83 disclosed CVEs—compensating controls are the only current option
  • Two CVEs under confirmed active exploitation: Google Dawn and TrueConf Client, both at CVSS 9.5

Immediate action: Prioritize network segmentation and access restrictions for Sonos Era 300 devices, Totolink A7100RU routers, and any systems using AWS CLI or aws-mcp-server. With zero patches available across all disclosures, apply compensating controls such as WAF rules, network isolation, and enhanced monitoring for exploitation indicators on Google Dawn and TrueConf Client.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation