Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Adobe Flash Player Buffer Overflow is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical OSGeo JAI-EXT RCE (CVSS 10) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Vmware Identity Manager Auth Bypass (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Microsoft Windows CLFS Driver Privilege Escalation
Kaseya VSA Remote Code Execution
Drupal Core Remote Code Execution
Microsoft Internet Explorer Memory Corruption
Adobe Flash Player Use-After-Free
Adobe Flash Player Use-After-Free
Adobe Flash Player Heap-Based Buffer Overflow
Adobe Flash Player Use-After-Free
Adobe Flash Player Remote Code Execution
Adobe Flash Player Stack-Based Buffer Overflow
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code...
A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause...
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers...
Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810.
Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810.
Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810.
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.
OSGeo GeoServer JAI-EXT Code Injection
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests.