Friday, April 24, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Friday's vulnerability landscape is dominated by critical flaws affecting Microsoft Bing, Microsoft Entra ID, and HP enterprise products, with two CVSS 10.0 issues requiring immediate attention. The day brought 37 critical CVEs (up 147% from yesterday) and 91 high-priority CVEs (down 9% from yesterday). Notable disclosures include CVE-2026-33819 affecting Microsoft Bing, CVE-2026-35431 in Microsoft Entra ID, and CVE-2026-41228 enabling code execution in HP products. Remote code execution and authentication bypass patterns dominate today's disclosures, with WordPress, Google Chrome, and Microsoft Dynamics also affected. No patches are currently available for these disclosures, requiring defensive monitoring and compensating controls until vendor fixes ship.

  • Microsoft products lead disclosures with critical flaws in Bing, Entra ID, Partner Center, and Dynamics
  • 37 critical CVEs disclosed, a 147% increase from yesterday's 15
  • 91 high-priority CVEs disclosed, a 9% decrease from yesterday's 100
  • Remote code execution and authentication bypass patterns affect HP, WordPress, and Google Chrome
  • 0% patch availability across critical disclosures requires immediate compensating controls
  • 15 actively exploited vulnerabilities span Microsoft Office, Adobe Acrobat, Apache ActiveMQ, and JetBrains TeamCity

Immediate action: Security teams should prioritize Microsoft Bing, Entra ID, and HP enterprise systems for immediate review, alongside WordPress and Google Chrome deployments exposed to the internet. With 0% patch availability for today's critical disclosures, implement network segmentation, enhanced monitoring, and access restrictions on affected systems while tracking vendor advisories for forthcoming fixes.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation