Saturday, January 24, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Yesterday's disclosures included 26 critical-severity CVEs, a 7% decrease from the prior day's 28. High-priority vulnerabilities held steady at 100, while actively exploited CVEs increased 11% to 10 entries including Microsoft Windows, Cisco Unified Communications Manager, and VMware vCenter Server. Notable critical vulnerabilities include CVE-2026-24304 affecting Azure Resource Manager with privilege escalation, CVE-2026-0768 and CVE-2026-0769 targeting Langflow with remote code execution, and multiple MCP server command injection flaws in Framelink Figma and Ollama integrations. Patch availability remains at 0%, requiring compensating controls for affected systems.

  • 26 critical CVEs disclosed, down 7% from prior day's 28
  • 100 high-priority vulnerabilities, unchanged from previous day
  • 10 actively exploited CVEs including Microsoft Windows, Cisco UCM, HPE OneView, and VMware vCenter
  • 0% patch availability across disclosed vulnerabilities
  • AI agent and MCP server components heavily impacted: Langflow, MetaGPT, Kalrav AI, Ollama MCP, Figma MCP

Immediate action: Prioritize review of Microsoft Windows, Cisco Unified Communications Manager, and VMware vCenter Server environments given active exploitation status. With zero patches currently available, implement network segmentation and monitoring for AI/MCP components including Langflow and MetaGPT deployments.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation