Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
Microsoft Visual Basic For Applications (VBA) privilege escalation is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Critical exposure
New critical disclosure (CVSS 9.9) — high severity with a short public awareness window before exploit material typically surfaces.
Critical exposure
New critical Talend Esb Runtime RCE (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.
CISA KEV — confirmed in-the-wild exploitation.
Adobe Acrobat and Reader Prototype Pollution
Fortinet FortiClient EMS SQL Injection
Microsoft Windows Link Following
Microsoft Windows Out-of-Bounds Read
Microsoft Exchange Server Deserialization of Untrusted Data
Adobe Acrobat Use-After-Free
Microsoft Visual Basic for Applications Insecure Library Loading
Nothing flagged in this category for this digest.
Nothing flagged in this category for this digest.
A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to writ...
A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play...
An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauth...
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can...
An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled stri...
Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exp...
Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malici...
The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question...
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fai...
A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring p...