Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Microsoft Win32k Privilege Escalation is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical 5 Stars Rating Funnel Project 5 Stars Rating Funnel SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Devbunch Master Elements SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
WSO2 Multiple Products Unrestrictive Upload of File
Microsoft Windows User Profile Service Privilege Escalation
Linux Kernel Privilege Escalation
Microsoft Windows User Profile Service Privilege Escalation
Microsoft Win32k Privilege Escalation
Microsoft Win32k Privilege Escalation
Jenkins Script Security Plugin Sandbox Bypass
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initia...
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead...
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJ...
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpo...
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement...
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unau...
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, w...
SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion vulnerability which allow attackers to...
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][out...
Mitel MiVoice Connect Data Validation