Monday, May 18, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Monday's disclosures concentrate on WordPress plugin code, GitBucket developer tooling, and ACL Analytics, with three critical CVEs at CVSS 9.8 enabling remote compromise of web-facing and developer-adjacent systems. Critical volume held steady at 3 (0% change) while high-priority disclosures dropped to 23, a 60% decline from the prior day's 57. CVE-2018-25335 affects a WordPress Peugeot plugin, CVE-2018-25332 targets GitBucket, and CVE-2018-25320 impacts ACL Analytics, all rated CVSS 9.8 with remote attack vectors. Two actively exploited vulnerabilities were observed in Cisco Catalyst SD-WAN (CVE-2026-20182) and Microsoft (CVE-2026-42897), both at CVSS 9.5, indicating continued attacker focus on edge networking and enterprise platforms. No patches are currently available across the 26 disclosed CVEs, requiring defenders to rely on compensating controls, network segmentation, and exposure reduction until vendor fixes ship.

  • WordPress plugin, GitBucket, and ACL Analytics carry the day's three critical CVEs, all CVSS 9.8 with remote attack vectors
  • Critical CVEs held steady at 3 (0% change from prior day)
  • High-priority CVEs dropped to 23, a 60% decline from the prior day's 57
  • Remote code execution dominates the critical tier across web plugin, source control, and analytics platforms
  • Patch availability sits at 0% across all 26 disclosures, leaving mitigation as the primary defensive option
  • Two actively exploited CVEs affect Cisco Catalyst SD-WAN and Microsoft platforms at CVSS 9.5

Immediate action: Prioritize exposure review for WordPress installations running the affected Peugeot plugin, GitBucket developer instances, and ACL Analytics deployments, alongside Cisco Catalyst SD-WAN edge devices where active exploitation is confirmed. With no patches available for today's disclosures, apply network segmentation, restrict administrative access, and monitor for indicators of compromise on the affected products until vendor updates are released.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation