Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
DrayTek Vigor Routers Command Injection is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Pnfpb Push Notification For Post And Buddypress SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Quantumcloud Simple Video Directory SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
SAP NetWeaver Deserialization
DrayTek Vigor Routers OS Command Injection
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before usin...
The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL state...
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing ma...
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard...
The TicketBAI Facturas para WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valid...
An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensiti...
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs.
Atheos is a self-hosted browser-based cloud IDE.
Spotipy is a Python library for the Spotify Web API.