Monday, March 9, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Monday's vulnerability disclosures include critical remote code execution flaws in Wavlink routers and Delta Electronics COMMGR2 industrial software, both scoring CVSS 9.8. The brief covers 2 critical CVEs (down 60% from Sunday) and 61 high-priority CVEs (down 25%), reflecting a quieter start to the week. Fifteen vulnerabilities have confirmed active exploitation, spanning Roundcube Webmail, VMware Aria Operations, Google Chromium, GitLab, and legacy flaws in Apple, Hikvision, and Rockwell Automation products. Attack patterns include authentication bypass, remote code execution, and memory corruption across networking equipment, enterprise collaboration platforms, and industrial control systems. No patches are currently available for the disclosed CVEs, making compensating controls and network segmentation essential in the interim.

  • CVE-2026-3703 and CVE-2026-3630 rated CVSS 9.8 — critical RCE in Wavlink NU516U1 routers and Delta Electronics COMMGR2 industrial software
  • 2 critical CVEs disclosed, down 60% from Sunday's 5 critical vulnerabilities
  • 61 high-priority CVEs (CVSS 7.0–8.9), a 25% decrease from the prior day's 81
  • Active exploitation confirmed in Roundcube Webmail, VMware Aria Operations, Google Chromium, Qualcomm chipsets, and GitLab
  • 0% patch availability across all disclosed CVEs — no vendor fixes released yet
  • 15 actively exploited vulnerabilities include legacy flaws dating back to 2008 in Microsoft Windows and 2017 in Hikvision products

Immediate action: Prioritize network segmentation and access restrictions for Wavlink routers, Delta Electronics COMMGR2 systems, and any exposed Roundcube Webmail or VMware Aria Operations instances. With no patches currently available, apply compensating controls such as WAF rules, disabling unnecessary services, and monitoring for indicators of compromise associated with the 15 actively exploited CVEs.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation