Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Active exploit activity
Fckeditor RCE now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Active exploit activity
Tp-link Tl-wr841n Firmware Command Injection now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical Sir Gnuboard SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
VMware vCenter Server Remote Code Execution
A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authentic...
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary d...
Nothing flagged in this category for this digest.
Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart...
SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn.
phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code...
Flysystem is an open source file storage library for PHP.
Shopware is an open source eCommerce platform.
There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product.