Saturday, May 16, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Archived Security Brief

HP phpMyFAQ and Apache Velocity dominate Saturday's critical disclosures, with multiple remote code execution paths affecting web-facing application stacks. The day brought 6 critical CVEs (down 68% from prior day) and 39 high-priority vulnerabilities (down 39%), reflecting typical weekend disclosure cadence. Notable critical issues include CVE-2026-46364 in HP phpMyFAQ (CVSS 9.8), CVE-2026-41258 affecting Apache Velocity template rendering (CVSS 9.1), and CVE-2026-44717 in MCP Calculate Server (CVSS 9.8). Attack patterns concentrate on web application platforms, template injection, and AI/ML infrastructure components like Intel Open WebUI. Patches are not yet broadly available across these disclosures, so defenders should focus on identifying exposure and applying vendor mitigations or compensating controls.

  • HP phpMyFAQ affected by two critical vulnerabilities (CVE-2026-46364, CVE-2026-45010) enabling remote compromise of FAQ management systems
  • 6 critical CVEs disclosed, down 68% from the prior day's 19
  • 39 high-priority CVEs disclosed, down 39% from the prior day's 64
  • Remote code execution patterns dominate across Apache Velocity templates, MCP Calculate Server, and WordPress plugin ecosystems
  • Patch availability sits at 0% across the day's critical disclosures, requiring interim mitigations and exposure reviews
  • 2 CVEs in the CISA KEV catalog including CVE-2026-20182 affecting Cisco Catalyst SD infrastructure

Immediate action: Prioritize inventory and exposure review for HP phpMyFAQ deployments, Apache Velocity-based applications, Intel Open WebUI instances, and Cisco Catalyst SD environments where CVE-2026-20182 is under active exploitation. With no patches available for the day's critical disclosures, apply vendor-recommended workarounds, restrict network access to affected services, and increase monitoring for exploitation indicators until fixes are released.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation