Saturday, June 6, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Archived Security Brief

Saturday's disclosures are led by infrastructure and e-commerce platform flaws, including a maximum-severity Kubernetes identity configuration vulnerability (CVE-2026-46389, CVSS 10) and a perfect-score WooCommerce product slider plugin flaw (CVE-2026-49777, CVSS 10). The day brought 10 critical CVEs, down 41% from the prior day's 17, alongside 30 high-priority vulnerabilities, a 63% decrease from 82. Notable critical issues include Termix remote code execution flaws (CVE-2026-45744 and CVE-2026-45748, CVSS 9.9 and 9.8) and dual Morse Micro HaLowLink 2 wireless gateway vulnerabilities (CVE-2026-7762 and CVE-2026-7763, both CVSS 9.8). Affected products span container orchestration, WordPress/WooCommerce plugins, industrial UPS controllers (NetMan 204), and embedded networking hardware, with remote code execution and authentication bypass the dominant attack patterns. No patches were available for these disclosures at publication, so teams should prioritize mitigations and exposure reduction; six separately tracked vulnerabilities across Ivanti, Oracle, Linux, Android, Magento, and SolarWinds remain under active exploitation.

  • Kubernetes UDS identity configuration flaw (CVE-2026-46389) and ShapedPlugin WooCommerce Product Slider Pro (CVE-2026-49777) both rated CVSS 10, affecting container orchestration and e-commerce platforms
  • 10 critical CVEs disclosed, down 41% from 17 the prior day
  • 30 high-priority CVEs disclosed, down 63% from 82 the prior day
  • Remote code execution and authentication bypass dominate, impacting Termix (CVE-2026-45744/45748), Morse Micro HaLowLink 2 gateways, and DTS Electronics Redline WR3200 routers
  • 0% patch availability across these disclosures, leaving NetMan 204 UPS controllers and WordPress/WooCommerce plugins exposed pending vendor fixes
  • Six actively exploited vulnerabilities span Ivanti vTM, Oracle WebLogic, Linux Kernel, Android Framework, Magento, and SolarWinds Serv-U

Immediate action: Prioritize Kubernetes identity configurations (CVE-2026-46389) and WooCommerce/WordPress plugin deployments (CVE-2026-49777, CVE-2026-10580), then assess Termix, Morse Micro HaLowLink 2, and NetMan 204 exposure for remote code execution risk. With no patches available for these disclosures, apply vendor mitigations, restrict network exposure of affected management interfaces, and monitor for vendor advisories. Separately, ensure the six actively exploited vulnerabilities across Ivanti, Oracle, Linux, Android, Magento, and SolarWinds are remediated.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation