Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Atlassian Bitbucket Server And Data Center Command Injection is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Phpgurukul Bus Pass Management System SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Moodle RCE (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Microsoft Exchange Server Server-Side Request Forgery
Microsoft Exchange Server Remote Code Execution
Atlassian Bitbucket Server and Data Center Command Injection
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/downloa...
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.
A limited SQL injection risk was identified in the "browse list of users" site administration page.
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.
SonicJS through 0.6.0 allows file overwrite.