Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Active exploit activity
Sourcefabric Rpi-jukebox-rfid cross-site scripting now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Active exploit activity
Dlink Dir-825 Firmware Buffer Overflow now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical Nyariv Sandboxjs RCE (CVSS 10) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Nothing flagged in this category for this digest.
A security flaw has been discovered in D-Link DIR-825 up to 2.10.
A vulnerability was identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0.
Nothing flagged in this category for this digest.
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and set...
RCE
Wildfire IM is an instant messaging and real-time audio/video solution.
vLLM is an inference and serving engine for large language models (LLMs).
Signal K Server is a server application that runs on a central hub in a boat.
continuwuity is a Matrix homeserver written in Rust.
When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specif...
Group-Office is an enterprise customer relationship management and groupware tool.
The NixOs Odoo package is an open source ERP and CRM system.
SandboxJS is a JavaScript sandboxing library.