Critical vulnerabilities, curated daily for security professionals
📊
Archived Security Brief
Friday's disclosures center on widely deployed consumer and developer platforms, with two Google Chrome flaws, multiple WordPress vulnerabilities, and a Kubernetes platform issue affecting enterprise environments. Yesterday brought 19 critical CVEs (up 19% from 16) and 64 high-priority CVEs (down 36% from 100). Notable issues include CVE-2026-5229 (CVSS 9.8) in WordPress, CVE-2026-42589 (CVSS 9.8) in Docker Gotenberg, and CVE-2026-41615 (CVSS 9.6) in Microsoft Authenticator. Attack patterns lean toward remote code execution and authentication weaknesses across web platforms, container tooling, and identity services. No patches are currently flagged as available in today's data, so defenders should treat affected systems with compensating controls until vendor fixes ship.
Google Chrome carries two critical CVEs (CVE-2026-8511, CVE-2026-8580 at CVSS 9.6), impacting browser fleets across consumer and enterprise endpoints
Critical CVEs rose 19% to 19 disclosures, driven by web platforms, container tooling, and identity services
High-priority CVEs fell 36% to 64, narrowing the secondary triage queue
Patch availability stands at 0%, requiring compensating controls for Chrome, WordPress, Kubernetes, and Microsoft Authenticator exposures
Two KEV entries confirm exploitation: CVE-2026-42208 in BerriAI LiteLLM (9.5) and CVE-2026-20182 in Cisco Catalyst SD (10.0)
Immediate action: Prioritize Google Chrome browser fleets, WordPress sites, Docker Gotenberg deployments, and Cisco Catalyst SD-WAN appliances, with attention to Microsoft Authenticator and Kubernetes control planes. With 0% patch availability reported, apply network segmentation, restrict administrative interfaces, and monitor for exploitation indicators on the two confirmed KEV entries while tracking vendor advisories for fixes.
How to read this brief
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges — the access they need first. No privileges means no login required.
No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
Seven sandbox escapes in vm2 Node.js library disclosed in one day
Seven independent sandbox-escape vulnerabilities in the vm2 Node.js sandbox library were disclosed together on May 13-14, 2026. Each lets attacker-controlled JavaScript break out of the sandbox and run as the host Node.js process. All seven were patched in 3.11.0 or 3.11.2, but the cluster is the latest in a long pattern of vm2 escapes — the editorial recommendation is to migrate away from vm2, not just upgrade.
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
A use-after-free vulnerability in the Google Chrome Mojo component allows remote attackers to potentially perform a sandbox escape via a crafted HTML page.
A stored Cross-Site Scripting (XSS) vulnerability in PrestaShop allows unauthenticated attackers to trigger a back-office takeover via the Contact Us form.
The Form Notify plugin for WordPress suffers from an authentication bypass vulnerability due to improper verification of user-controlled cookie data during LINE OAuth login.
The InfusedWoo Pro plugin for WordPress is vulnerable to an authorization bypass that allows unauthenticated attackers to perform destructive actions on site content.
A stored Cross-Site Scripting (XSS) vulnerability in the vCluster Platform allows attackers to execute arbitrary scripts and potentially escalate privileges.
Crabbox contains an environment variable exposure vulnerability that allows attackers to exfiltrate sensitive local secrets to remote command environments.
A stored Cross-Site Scripting (XSS) vulnerability in the SiYuan Marketplace allows attackers to execute arbitrary HTML/JS via malicious package metadata.
The Akilli Commerce E-Commerce Website is susceptible to Blind SQL Injection, allowing attackers to manipulate database queries via special characters.
The Note Mark application fails to enforce entropy or length requirements on JWT_SECRET configurations, significantly weakening authentication security.
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system
Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc
Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system