Tuesday, May 19, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Tuesday's disclosures center on Microsoft Azure Local, SGLang AI runtimes, and WordPress, with multiple remote code execution flaws affecting widely deployed enterprise and developer infrastructure. The brief covers 10 critical CVEs (up 233% from yesterday's 3) and 35 high-priority vulnerabilities (up 52% from 23). Notable issues include CVE-2026-42822 (CVSS 10) in Azure Local Disconnected, CVE-2026-27130 (CVSS 9.9) in Dokploy deployment platform, and three SGLang multimodal runtime flaws (CVE-2026-7301, CVE-2026-7302, CVE-2026-7304). Attack patterns skew toward RCE and unauthenticated access against cloud orchestration, AI inference services, and WordPress ecosystems. No vendor patches are currently available across this batch, requiring compensating controls and exposure reduction as the primary near-term posture.

  • Microsoft Azure Local Disconnected hit with CVE-2026-42822 at maximum CVSS 10 severity
  • Critical CVE count rose 233% day-over-day, from 3 to 10
  • High-priority CVE count rose 52% day-over-day, from 23 to 35
  • Remote code execution dominates, with SGLang AI runtime (3 CVEs), Dokploy, lwIP, and WordPress all affected
  • Patch availability sits at 0% across the day's critical and high disclosures
  • Two actively exploited CVEs in the wild: Cisco Catalyst SD-WAN (CVE-2026-20182) and Microsoft (CVE-2026-42897)

Immediate action: Prioritize exposure reduction for Azure Local Disconnected, Dokploy, SGLang inference endpoints, and WordPress deployments, and verify Cisco Catalyst SD-WAN and affected Microsoft systems against the two actively exploited CVEs. With no vendor patches yet published for the critical batch, apply network segmentation, restrict management interface exposure, and monitor for indicators tied to the listed CVE IDs until fixes are released.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation