Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical exposure
New critical Gerapy RCE (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical disclosure (CVSS 9.8) — high severity with a short public awareness window before exploit material typically surfaces.
Critical exposure
New critical disclosure (CVSS 9.8) — high severity with a short public awareness window before exploit material typically surfaces.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details.
Gerapy is a distributed crawler management framework.
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framewor...
basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier.