Critical vulnerabilities, curated daily for security professionals
📊
Archived Security Brief
HP phpMyFAQ and Apache Velocity dominate Saturday's critical disclosures, with multiple remote code execution paths affecting web-facing application stacks. The day brought 6 critical CVEs (down 68% from prior day) and 39 high-priority vulnerabilities (down 39%), reflecting typical weekend disclosure cadence. Notable critical issues include CVE-2026-46364 in HP phpMyFAQ (CVSS 9.8), CVE-2026-41258 affecting Apache Velocity template rendering (CVSS 9.1), and CVE-2026-44717 in MCP Calculate Server (CVSS 9.8). Attack patterns concentrate on web application platforms, template injection, and AI/ML infrastructure components like Intel Open WebUI. Patches are not yet broadly available across these disclosures, so defenders should focus on identifying exposure and applying vendor mitigations or compensating controls.
HP phpMyFAQ affected by two critical vulnerabilities (CVE-2026-46364, CVE-2026-45010) enabling remote compromise of FAQ management systems
6 critical CVEs disclosed, down 68% from the prior day's 19
39 high-priority CVEs disclosed, down 39% from the prior day's 64
Remote code execution patterns dominate across Apache Velocity templates, MCP Calculate Server, and WordPress plugin ecosystems
Patch availability sits at 0% across the day's critical disclosures, requiring interim mitigations and exposure reviews
2 CVEs in the CISA KEV catalog including CVE-2026-20182 affecting Cisco Catalyst SD infrastructure
Immediate action: Prioritize inventory and exposure review for HP phpMyFAQ deployments, Apache Velocity-based applications, Intel Open WebUI instances, and Cisco Catalyst SD environments where CVE-2026-20182 is under active exploitation. With no patches available for the day's critical disclosures, apply vendor-recommended workarounds, restrict network access to affected services, and increase monitoring for exploitation indicators until fixes are released.
How to read this brief
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges — the access they need first. No privileges means no login required.
No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
Seven sandbox escapes in vm2 Node.js library disclosed in one day
Seven independent sandbox-escape vulnerabilities in the vm2 Node.js sandbox library were disclosed together on May 13-14, 2026. Each lets attacker-controlled JavaScript break out of the sandbox and run as the host Node.js process. All seven were patched in 3.11.0 or 3.11.2, but the cluster is the latest in a long pattern of vm2 escapes — the editorial recommendation is to migrate away from vm2, not just upgrade.
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The section of this advisory includes Show Control Connections guidance to help with system checks.
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to the affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric.
phpMyFAQ contains an unauthenticated SQL injection vulnerability in its captcha handling methods, allowing attackers to extract sensitive database information.
OpenMRS Core fails to properly sandbox Apache Velocity templates, allowing authenticated users with specific privileges to achieve arbitrary Java reflection and code execution.
The LDAP authentication endpoint in Open WebUI fails to validate non-empty passwords, allowing unauthenticated attackers to bypass authentication and obtain session tokens.
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2