Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Android Framework Privilege Escalation is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Filereplicationpro File Replication Pro privilege escalation (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Auto Dealer Management System Project Auto Dealer Management System SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Novi Survey Insecure Deserialization
Android Framework Privilege Escalation
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection informa...
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol confi...
Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will b...
Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability.
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute for...
BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware.
AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.
bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.
lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.
Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admi...