Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Active exploit activity
Maianscriptworld Maian Cart RCE now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Active exploit activity
Django-unicorn Unicorn cross-site scripting now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical Ardour Use-After-Free (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
The Unicorn framework through 0.35.3 for Django allows XSS via component.name.
Nothing flagged in this category for this digest.
Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeCont...
Google Chromium Indexed DB API Use-After-Free
An issue was discovered in Digi RealPort for Windows through 4.8.488.0.
In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, maki...
Google Chromium Portals Use-After-Free
The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute...
Tad Book3 editing book page does not perform identity verification.
VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.