Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Microsoft Office Memory Corruption is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Emerging exploitation risk
Sonicspot Audioactive Player: EPSS 10% → 28% · rising (+18%) — EPSS is climbing faster than peer CVEs in this window, a leading indicator even before KEV or public exploit linkage.
Critical exposure
New critical Gongrzhe Terminal-controller-mcp Command Injection (CVSS 10) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Hewlett Packard Enterprise (HPE) OneView Code Injection
Microsoft Office PowerPoint Code Injection
Nothing flagged in this category for this digest.
Sonicspot Audioactive Player Buffer Overflow
Sorinara Streaming Audio Player Buffer Overflow
Urusoft Viplay3 Buffer Overflow
Mini-stream Easy Rm-mp3 Converter Buffer Overflow
Digimode10 Maya Buffer Overflow
Microchip Mplab Ide Buffer Overflow
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH church-management...
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery dzs-videogallery allows Object Injection.This is...
A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary...
LibreChat is a ChatGPT clone with additional features.
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware.
The Tarkov Data Manager is a tool to manage the Tarkov item data.
The Tarkov Data Manager is a tool to manage the Tarkov item data.
The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces.
An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections...