Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Microsoft Windows Buffer Overflow is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Gitlab Info Disclosure (CVSS 10) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Stopbadbots Block And Stop Bad Bots SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Google Chromium V8 Type Confusion
Debian-specific Redis Server Lua Sandbox Escape
Microsoft Office Access Connectivity Engine Remote Code Execution
Microsoft Windows Event Tracing Privilege Escalation
SonicWall Secure Remote Access (SRA) SQL Injection
Atlassian Confluence Server Pre-Authorization Arbitrary File Read
SonicWall SMA100 Directory Traversal
Microsoft Windows Privilege Escalation
Microsoft DirectX Graphics Kernel Privilege Escalation
Microsoft DirectX Graphics Kernel Privilege Escalation
Microsoft Windows Privilege Escalation
Microsoft Internet Explorer Information Disclosure
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement t...
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series...
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in...
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a ca...
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 be...
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement...
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in...
The SpeakOut!
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket...
Tenda AC9 v15.03.2.21_cn was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function.