Wednesday, April 29, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Wednesday's disclosed vulnerabilities center on networking infrastructure and browser security, with Totolink A8000RU routers accounting for five critical CVEs and Mozilla Firefox/Thunderbird facing a sandbox escape flaw. The brief includes 16 critical CVEs, down 50% from the prior day, and 100 high-priority issues, unchanged from yesterday. Notable critical entries include CVE-2026-7321 (CVSS 9.6) affecting Firefox and Thunderbird sandboxes, CVE-2026-7248 (CVSS 9.8) in D-Link DI devices, and CVE-2026-24178 (CVSS 9.8) in NVIDIA NVFlare Dashboard. Attack patterns trend toward remote code execution and unauthenticated access against consumer routers, IoT cameras, and enterprise dashboards. No vendor patches are currently available for the disclosed issues, requiring compensating controls and network segmentation; 13 CVEs across Apache ActiveMQ, Microsoft Defender, and SimpleHelp show active exploitation.

  • Totolink A8000RU routers dominate disclosures with five critical CVEs (CVE-2026-7202, 7203, 7204, 7240, 7241) at CVSS 9.8
  • Critical CVE volume drops 50% to 16 disclosures compared to 32 the prior day
  • High-priority CVE count holds steady at 100, matching yesterday's volume
  • Remote code execution and unauthenticated access dominate, affecting D-Link DI, NVIDIA NVFlare, and AIOT camera firmware
  • Patch availability sits at 0% across disclosed critical vulnerabilities, requiring interim mitigations
  • 13 actively exploited CVEs span Apache ActiveMQ, Microsoft Defender, SimpleHelp, and ConnectWise ScreenConnect

Immediate action: Prioritize isolation and access restriction for Totolink A8000RU routers, D-Link DI devices, NVIDIA NVFlare Dashboard, and Mozilla Firefox/Thunderbird deployments where sandbox integrity is critical. With no patches available for the new critical disclosures, apply network segmentation and monitor exploitation indicators for actively exploited products including Apache ActiveMQ, Microsoft Defender, and SimpleHelp.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation