Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Zyxel Multiple Firewalls Command Injection is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Active exploit activity
Online Security Guards Hiring System Project Online Security Guards Hiring System cross-site scripting now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical Uniview Camera Firmware Code Execution (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Zyxel Multiple Firewalls OS Command Injection
Pydio Cells allows users by default to create so-called external users in order to share files with them.
Pydio Cells through 4.1.2 allows SSRF.
Pydio Cells through 4.1.2 allows XSS.
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.
A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic.
Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.
An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24.
Nothing flagged in this category for this digest.
Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCM...
Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability.
Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the...
KramerAV VIA GO² < 4.0.1.1326 is vulnerable to unauthenticated file upload resulting in Remote Code Execution (RCE).
KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any re...
D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address paramete...
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible
An issue was discovered in BMC Patrol through 23.1.00.