Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Active exploit activity
Zoneminder cross-site scripting now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Active exploit activity
Zoneminder CSRF now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical Huawei Emui Privilege Escalation (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
Fortinet Multiple Products Authentication Bypass
ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripti...
ZoneMinder is a free, open source Closed-circuit television software application.
ZoneMinder is a free, open source Closed-circuit television software application.
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
Nothing flagged in this category for this digest.
DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool.
Parrot Bebop 4.7.1.
The MediaProvider module has a vulnerability of unauthorized data read.
The control component has a spoofing vulnerability.
Some smartphones have configuration issues.
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which wo...
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauth...
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.
Certain Stimulsoft GmbH products are affected by: Remote Code Execution.
SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategory...