Critical vulnerabilities, curated daily for security professionals
📊
Archived Security Brief
Tuesday's disclosures center on a small batch of high-priority vulnerabilities with no critical-severity CVEs published in the last 24 hours. Critical CVE volume held flat at zero while high-priority disclosures rose 33% to four entries compared to three the prior day. The Known Exploited Vulnerabilities catalog includes ten actively exploited issues spanning Drupal Core (CVE-2026-9082), Trend Micro Apex One (CVE-2026-34926), and Microsoft Defender (CVE-2026-45498, CVE-2026-41091). Several KEV entries reach back to legacy Microsoft Internet Explorer, DirectX, and Adobe Acrobat issues, indicating ongoing opportunistic targeting of unpatched estates. No patches are currently linked in today's dataset, so defenders should rely on vendor advisories for remediation guidance.
Trend Micro Apex One and Microsoft Defender appear in today's actively exploited set, putting endpoint security tooling itself in the threat path
Critical CVEs held steady at 0, unchanged from the prior day
High-priority CVEs increased 33% to 4, up from 3 the prior day
Active exploitation observed against Drupal Core (CVE-2026-9082) and Langflow (CVE-2025-34291), spanning web CMS and AI tooling
Patch availability sits at 0% in today's dataset; remediation requires direct reference to vendor advisories
10 vulnerabilities tracked as actively exploited, flat versus the prior day
Immediate action: Prioritize patching Trend Micro Apex One, Microsoft Defender, Drupal Core, and Langflow deployments given confirmed active exploitation across these products. With no patches surfaced in today's feed, consult each vendor's advisory directly and apply available updates or mitigations before resuming normal change windows.
How to read this brief
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges — the access they need first. No privileges means no login required.
No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
Hirschmann HiSecOS web server version 05 is vulnerable to a high-severity security flaw that could compromise the integrity of the management interface.