Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
ASUS Routers Auth Bypass is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical Roundcube Webmail RCE (CVSS 9.9) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
Critical exposure
New critical Llamaindex RCE (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Craft CMS External Control of Assumed-Immutable Web Parameter
ConnectWise ScreenConnect Improper Authentication
Craft CMS Code Injection
ASUS RT-AX55 Routers OS Command Injection
ASUS Routers Improper Authentication
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges.
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19.
An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400.
An authentication bypass vulnerability exists in HPE StoreOnce Software.
RoundCube Webmail Deserialization of Untrusted Data
Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data