Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Microsoft Internet Explorer Info Disclosure is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Eclipse Threadx Usbx Buffer Overflow (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Cdatatec Fd702xw-x-r430 Firmware Command Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
QNAP NAS File Station Cross-Site Scripting
QNAP NAS File Station Command Injection
QNAP NAS File Station Cross-Site Scripting
Kaseya VSA SQL Injection
Microsoft Windows Kernel Privilege Escalation
Microsoft Windows Search Remote Code Execution
Artifex Ghostscript Type Confusion
Microsoft Internet Explorer Privilege Escalation
Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation
Microsoft XML Core Services Information Disclosure
Microsoft Windows SMBv1 Information Disclosure
Microsoft Internet Explorer Memory Corruption
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
New critical Ibm Elastic Storage System exposure disclosed.
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request.
In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack.
An issue in H v1.0 allows attackers to bypass authentication via a session replay attack.
C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6.
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted...
Badminton Center Management System 1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_court_rental, id.
Water-billing-management-system v1.0 is vulnerable to SQL Injection via /wbms/classes/Master.php?f=delete_client, id
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=update_application_status