Saturday, January 3, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Yesterday's vulnerability disclosures included 1 critical CVE (CVSS 9.0+), a 67% decrease from the prior day's 3 critical issues. High-priority vulnerabilities totaled 30, representing a 33% reduction from 45. Five actively exploited vulnerabilities remain on the CISA KEV list, affecting Gladinet CentreStack/Triofox, Apple products, ASUS Live Update, Digiever DS-2105 Pro, and MongoDB Server. The single new critical vulnerability CVE-2025-14998 (CVSS 9.8) affects the Branda WordPress plugin through a privilege escalation flaw enabling account takeover. Patch availability stands at 0%, requiring organizations to implement compensating controls until vendor fixes become available.

  • 1 critical CVE disclosed, down 67% from prior day's 3 critical issues
  • 30 high-priority CVEs (CVSS 7.0-8.9), a 33% decrease from 45
  • 5 actively exploited vulnerabilities affecting Gladinet, Apple, ASUS, Digiever, and MongoDB
  • 0% patch availability across disclosed vulnerabilities
  • WordPress environments using Branda plugin face privilege escalation risk (CVE-2025-14998)

Immediate action: Organizations running Gladinet CentreStack/Triofox, Apple products, ASUS systems with Live Update, Digiever DS-2105 Pro, or MongoDB Server should prioritize monitoring for exploitation indicators on these actively targeted platforms. With 0% patch availability for yesterday's disclosures, implement network segmentation and access controls as interim mitigations while monitoring vendor security advisories.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation