Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.
Three highest-priority changes — analyst brief, not a CVE dump.
Critical active threat
WebPros CPanel & WHM And WP2 (WordPress Squared) Auth Bypass is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.
Active exploit activity
Tuzitio Camaleon Cms Path Traversal now has public exploit or PoC linkage — assume opportunistic scanning and targeted follow-on activity.
Critical exposure
New critical disclosure (CVSS 10) — high severity with a short public awareness window before exploit material typically surfaces.
CISA KEV — confirmed in-the-wild exploitation.
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).
Google Chromium CSS Use-After-Free
Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stor...
A flaw was found in BusyBox.
JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or...
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
SumatraPDF is a multi-format reader for Windows.
Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras.
NiceGUI is a Python-based UI framework.
deepHas provides a test for the existence of a nested object key and optionally returns that key.
Erugo is a self-hosted file-sharing platform.
Nothing flagged in this category for this digest.
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServ...
Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radi...
An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permi...
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any write...
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.