Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Confirmed in-the-wild exploitation per CISA KEV — active threat momentum, not theoretical risk.
Active exploit activity
Public exploit or PoC linked — exploitation bar is lower than disclosure-only CVEs.
Critical exposure
New critical Allskyteam Allsky RCE (CVSS 10) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Fortinet Multiple Products Improper Verification of Cryptographic Signature
SQL injection vulnerability in Summar Software´s Portal del Empleado.
esm.sh is a nobuild content delivery network(CDN) for modern web development.
Nothing flagged in this category for this digest.
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to p...
NVIDIA Isaac Lab contains a deserialization vulnerability.
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted inpu...
Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the parameter fac_passw...
Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the parameter password.
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an inco...
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an inco...
A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary...
Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow.
The Open edX Platform is a learning management platform.