Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Microsoft Win32k Memory Corruption is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Commscope Arris Tr3300 Firmware Command Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Commscope Arris Tr3300 Firmware Command Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
SonicWall SonicOS Buffer Overflow
Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation
Microsoft Windows Error Reporting Manager Privilege Escalation
Microsoft Windows Privilege Escalation
Microsoft Windows AppX Deployment Server Privilege Escalation
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation
Microsoft Win32k Privilege Escalation
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation
Microsoft Task Scheduler Privilege Escalation
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation
Microsoft Windows Privilege Escalation
Microsoft Win32k Privilege Escalation
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as res...
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter.
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin para...
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat,...
Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp...
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter.
Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddn...
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnera...
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnera...
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnera...