Active exploit activity
CVE-2023-32235 Ghost Directory Traversal
- Public exploit or PoC available
- Exploit activity linked
Ghost Directory Traversal now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Active exploit activity
Ghost Directory Traversal now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Active exploit activity
JetBrains TeamCity Auth Bypass now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
3s-software Codesys Gateway-server: EPSS 60% → 70% · rising (+11%) — EPSS is climbing faster than peer CVEs in this window, a leading indicator even before KEV or public exploit linkage.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical.
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin...
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is...
A vulnerability was found in atjiu pybbs up to 6.0.0.
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0.
Microsoft SharePoint Deserialization of Untrusted Data
Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges...
Citrix NetScaler ADC and Gateway Out-of-Bounds Read
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation.
Google Chromium Mojo Sandbox Escape
Cisco Identity Services Engine — public exploit or PoC linked.
Cisco Identity Services Engine — public exploit or PoC linked.
3s-software Codesys Gateway-server Directory Traversal
PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php.
Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php.
ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi.
Openfiler v2.x contains a command injection vulnerability in the system.html page.
MASA CMS is an Enterprise Content Management platform based on open source technology.
ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py.
Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allow...
The ASPECT system allows users to bypass authentication.
Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated rem...