Sunday, May 10, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Archived Security Brief

Sunday's disclosures center on WordPress plugin vulnerabilities, with multiple critical flaws affecting MStore API, Plugin Download, and TheCartPress carrying CVSS 9.8 ratings. The day brought 8 critical CVEs (down 71% from Saturday's 28) and 65 high-priority vulnerabilities (down 35% from 100). Notable disclosures include CVE-2021-47933 in WordPress MStore API, CVE-2021-47923 affecting OpenCart, and CVE-2026-44313 in Arch Linkwarden, all rated 9.1 or higher. Attack patterns concentrate on web application infrastructure and OAuth2 library implementations, with HP enterprise applications also represented. Patch availability sits at 0% across yesterday's disclosures, requiring defenders to rely on workarounds and compensating controls until vendor fixes arrive.

  • WordPress plugin ecosystem accounts for the majority of critical disclosures, with MStore API, Plugin Download, and TheCartPress all rated CVSS 9.8
  • Critical CVEs dropped 71% to 8 compared to Saturday's 28
  • High-priority CVEs decreased 35% to 65 from prior day's 100
  • OAuth2 library and OpenCart e-commerce platform vulnerabilities expand the web application attack surface beyond WordPress
  • Patch availability stands at 0% for yesterday's disclosures, leaving defenders dependent on mitigations
  • 4 vulnerabilities have confirmed active exploitation, including BerriAI LiteLLM, ConnectWise ScreenConnect, Microsoft Windows, and Linux Kernel

Immediate action: Prioritize WordPress administrators reviewing affected plugins (MStore API, Plugin Download, TheCartPress) and consider disabling vulnerable extensions until patches are released. Organizations running ConnectWise ScreenConnect, BerriAI LiteLLM, or recent Linux Kernel and Windows builds should verify exposure given confirmed active exploitation, while OpenCart and Linkwarden operators should apply available compensating controls given the 0% patch availability.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation