Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Ivanti Endpoint Manager Mobile (EPMM) RCE is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Active exploit activity
Xibosignage Xibo Path Traversal now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical disclosure (CVSS 9.9) — high severity with a short public awareness window before exploit material typically surfaces.
CISA KEV — confirmed in-the-wild exploitation.
Ivanti Endpoint Manager Mobile (EPMM) Code Injection
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability.
Fortinet FortiWeb Path Traversal
Horilla is a free and open source Human Resource Management System (HRMS).
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns avai...
Microsoft Windows Management Console (MMC) Improper Neutralization
Xibo is a content management system (CMS).
Nothing flagged in this category for this digest.
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parame...
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol...
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1...
Nix is a package manager for Linux and other Unix systems.
PraisonAI is a multi-agent teams system.
PraisonAI is a multi-agent teams system.
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default.
Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific...
Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to co...