Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Apache Log4j2 RCE is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Markdown To Pdf Project Markdown To Pdf RCE (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Max-3000 Maxsite Cms RCE (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Fortinet FortiOS Arbitrary File Download
Zoho Desktop Central Authentication Bypass
Apache Log4j2 Remote Code Execution
Realtek Jungle SDK Remote Code Execution
Fuel CMS SQL Injection
Pi-Hole AdminLTE Remote Code Execution
MongoDB mongo-express Remote Code Execution
Apache Solr DataImportHandler Code Injection
Linux Kernel Improper Privilege Management
Sonatype Nexus Repository Manager Incorrect Access Control
Embedthis GoAhead Remote Code Execution
Red Hat JBoss Application Server Remote Code Execution
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front...
Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.
Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory travers...
An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR.
Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14...
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary...