Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Microsoft Win32k Privilege Escalation is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Active exploit activity
Public exploit or PoC linked — exploitation bar is lower than disclosure-only CVEs.
Critical exposure
New critical Tp-link Tl-wr940n Firmware Buffer Overflow (CVSS 9.9) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Vmware Aria Operations for Networks Command Injection
Roundcube Webmail SQL Injection
Roundcube Webmail Cross-Site Scripting (XSS)
Roundcube Webmail Remote Code Execution
Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free
Microsoft Win32k Privilege Escalation
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name para...
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.a...
Nothing flagged in this category for this digest.
Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list.
An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via craf...
Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow...
Grafana is validating Azure AD accounts based on the email claim.
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods...
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KD...
Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.
Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component Upload...
funadmin v3.3.2 and v3.3.3 are vulnerable to Insecure file upload via the plugins install.
TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm.