Tuesday, May 12, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Tuesday's disclosures center on enterprise cloud and developer infrastructure, with SAP Enterprise Search, AWS credential handling, Docker Compose, and GitHub Actions OIDC headlining the critical set. The brief covers 12 critical CVEs (up 140% from 5) and 81 high-priority CVEs (up 286% from 21), reflecting a significant expansion in disclosed vulnerabilities compared to the prior day. Notable issues include CVE-2026-42869 (CVSS 10) in Docker Compose setup, CVE-2026-7813 (CVSS 9.9) in pgAdmin 4, and CVE-2026-34260 (CVSS 9.6) affecting SAP Enterprise Search. Attack patterns concentrate on credential exposure, AI platform compromise via Intel DeepChat, and supply chain risk through GitHub Actions OIDC and Docker tooling. No vendor patches are currently confirmed available across the disclosed set, and one Linux Kernel issue (CVE-2026-31431) is under active exploitation, warranting prioritized mitigation planning.

  • SAP, AWS, Docker, GitHub Actions, and pgAdmin dominate today's critical disclosures across cloud and developer toolchains
  • 12 critical CVEs disclosed, a 140% increase from yesterday's 5
  • 81 high-priority CVEs disclosed, a 286% increase from yesterday's 21
  • Credential exposure and supply chain attack vectors stand out, including AWS S3 proxy abuse, Docker Compose RCE, and GitHub Actions OIDC weaknesses
  • 0% patch availability across disclosed critical CVEs, with Dell ECS, pgAdmin 4, and SAP Commerce Cloud among unpatched systems
  • One actively exploited CVE in the Linux Kernel (CVE-2026-31431, CVSS 9.5) requires mitigation prioritization

Immediate action: Security teams should prioritize compensating controls for SAP Enterprise Search and Commerce Cloud, Docker Compose deployments, pgAdmin 4 instances, GitHub Actions OIDC configurations, and Dell ECS systems while monitoring for vendor advisories. With 0% patch availability across the critical set and active exploitation confirmed in the Linux Kernel, focus on network segmentation, credential rotation for cloud-attached systems, and detection coverage until fixes are released.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation