Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Active exploit activity
Openclinic Ga Project Openclinic Ga Info Disclosure now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Active exploit activity
Openclinic Ga Project Openclinic Ga Path Traversal now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical disclosure (CVSS 10) — high severity with a short public awareness window before exploit material typically surfaces.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
An issue was discovered in OpenClinic GA 5.247.01.
An issue was discovered in OpenClinic GA 5.247.01.
djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure.
Jenkins Command Line Interface (CLI) Path Traversal
Nothing flagged in this category for this digest.
A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unautho...
An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacke...
lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process.
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint.
SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalat...
SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalat...
An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially cr...
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML...
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function.
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read a...