Friday, May 1, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Friday's disclosures center on Progress Software MOVEit, Shopizer, and Totolink router platforms, with several remote code execution flaws affecting widely deployed enterprise and edge infrastructure. The brief includes 8 critical CVEs (unchanged from the prior day) and 99 high-priority vulnerabilities (down 1%). Notable entries include CVE-2026-4670 (CVSS 9.8) in MOVEit, CVE-2026-36767 (CVSS 10) in Shopizer, and CVE-2026-7546 (CVSS 9.8) in Totolink NR1800X routers. Attack patterns skew toward unauthenticated RCE and authentication bypass, with file transfer and e-commerce platforms representing the highest-impact targets. Patches are currently unavailable for the disclosed set, requiring compensating controls and exposure reduction until vendor fixes ship.

  • Progress Software MOVEit, Shopizer, and Totolink lead today's critical disclosures, with MOVEit and Shopizer representing high-value enterprise targets
  • 8 critical CVEs disclosed, unchanged from the prior day
  • 99 high-priority CVEs disclosed, a 1% decrease from the prior day
  • Unauthenticated RCE and authentication bypass dominate, affecting file transfer (MOVEit), e-commerce (Shopizer), and edge networking (Totolink, JeeSite)
  • 0% patch availability across the disclosed set, requiring compensating controls for MOVEit, Shopizer, and Totolink deployments
  • 13 CVEs flagged as actively exploited, including cPanel/WHM, PaperCut NG/MF, JetBrains TeamCity, and ConnectWise ScreenConnect

Immediate action: Prioritize compensating controls for Progress MOVEit, Shopizer storefronts, and Totolink NR1800X/A8000RU devices, and validate exposure of cPanel/WHM, PaperCut, TeamCity, and ConnectWise ScreenConnect instances against the active exploitation list. With no patches currently available for the disclosed critical set, restrict network exposure, enforce strict authentication, and monitor vendor advisories for fixes.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation