Thursday, January 8, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Archived Security Brief

Yesterday's vulnerability disclosures included 18 critical-severity CVEs, representing a 29% increase from the prior day's 14 critical findings. High-priority vulnerabilities (CVSS 7.0-8.9) totaled 97, a 10% increase from 88 previously tracked. Four actively exploited vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog, including CVE-2023-52163 affecting Digiever DS-2105 Pro, CVE-2025-14847 in MongoDB Server, CVE-2009-0556 targeting Microsoft Office, and CVE-2025-37164 in HP OneView. Notable critical CVEs include CVE-2019-25296 enabling arbitrary file uploads in the WP Cost Estimation WordPress plugin, CVE-2025-15018 allowing privilege escalation in the Optional Email WordPress plugin, and CVE-2025-12543 affecting the Undertow HTTP server. Patch availability currently stands at 0%, requiring organizations to implement compensating controls until vendor remediation is released.

  • 18 critical CVEs disclosed (29% increase from prior day's 14)
  • 97 high-priority CVEs tracked (10% increase from 88)
  • 4 actively exploited vulnerabilities added to KEV catalog affecting Digiever, MongoDB, Microsoft Office, and HP OneView
  • 0% patch availability for newly disclosed vulnerabilities
  • WordPress plugins WP Cost Estimation and Optional Email contain critical authentication bypass and file upload flaws

Immediate action: Organizations using MongoDB Server, HP OneView, Microsoft Office, and Digiever surveillance systems should prioritize reviewing exposure to actively exploited vulnerabilities. With no patches currently available for newly disclosed critical CVEs, implement network segmentation and enhanced monitoring for affected WordPress installations and Undertow HTTP server deployments.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation