Sunday, May 31, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Sunday's disclosures center on widely deployed infrastructure and developer tooling, including Palo Alto Networks PAN-OS, the LiteSpeed cPanel plugin, and GitHub Actions OIDC, all carrying CVSS 9.5 ratings. The brief covers 1 critical CVE (down 94% from 18 the prior day) and 30 high-priority CVEs (down 52% from 63), reflecting a much lighter critical workload than Saturday. The lone critical entry is CVE-2018-25412 (CVSS 9.8) in Delta Sql, while CVE-2026-0257 in Palo Alto PAN-OS and CVE-2026-45321 in GitHub Actions OIDC stand out among the high-severity set. Affected components span network security appliances, hosting control panels, and CI/CD identity flows, increasing exposure for organizations running internet-facing management interfaces and automated build pipelines. No patches are currently reflected for these entries, so teams should prioritize compensating controls and monitor vendor advisories for fix availability.

  • Palo Alto Networks PAN-OS (CVE-2026-0257, CVSS 9.5) leads the day's high-impact set affecting internet-facing network security appliances
  • Critical CVEs fell to 1, a 94% decrease from 18 the prior day
  • High-priority CVEs totaled 30, a 52% decrease from 63 the prior day
  • Developer and hosting infrastructure is heavily represented, including LiteSpeed cPanel Plugin (CVE-2026-48172) and GitHub Actions OIDC (CVE-2026-45321)
  • Patch availability stands at 0%, requiring reliance on configuration hardening and access restrictions until fixes ship
  • 5 vulnerabilities have confirmed active exploitation, spanning PAN-OS, cPanel, and CI/CD tooling

Immediate action: Prioritize Palo Alto PAN-OS, LiteSpeed cPanel, and GitHub Actions OIDC environments, restricting access to management and CI/CD interfaces and reviewing them for signs of exploitation. With no patches currently available for these entries, apply vendor-recommended mitigations and network-level controls while monitoring advisories for fix releases.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation