Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Ivanti Cloud Services Appliance (CSA) SQL Injection is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Palo Alto Networks Expedition Command Injection (CVSS 9.9) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Wpuserplus Userplus Privilege Escalation (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Ivanti Cloud Services Appliance (CSA) SQL Injection
Ivanti Cloud Services Appliance (CSA) OS Command Injection
Fortinet Multiple Products Format String
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with t...
An issue was discovered in Trusted Firmware-M through 2.1.0.
ssoready is a single sign on provider implemented via docker.
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n)...
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object inje...
Palo Alto Networks Expedition OS Command Injection
An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as r...
Palo Alto Networks Expedition SQL Injection
The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restric...
Mozilla Firefox Use-After-Free