Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Active exploit activity
Appsmith DoS now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Active exploit activity
Nagios Log Server cross-site scripting now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical Open-emr Openemr SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload int...
An issue was discovered in Appsmith before 1.51.
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10.
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
Microsoft Office Spoofing Vulnerability
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instanc...
Nothing flagged in this category for this digest.
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \open...
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow
Netwrix Password Secure 9.2.0.32454 allows OS command injection.
Netwrix Password Secure through 9.2 allows command injection.
An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the c...
A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13.
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key
CrushFTP Authentication Bypass
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems Social Share And...