Week of September 1, 2026
This is an archived issue. See the latest digest or all issues.
Exploitation probability spikes overnight. Public exploits land. CVEs cross into confirmed in-the-wild use. That movement, the change, is what ESIP scores and surfaces.
Silence is not clearance: a CVE that didn't move isn't a safe one, just one nothing has happened to that week. When something does move, that change is the exposure signal.
Remote code execution in Gitea through the diffpatch API, confirmed exploited with a public PoC and evidence piling up fast. High velocity. Treat as immediate.
A 2019 Microsoft SQL Server RCE, government-confirmed as exploited and corroborated by ENISA EUVD, with exploitation probability now climbing. Confirmed at critical severity. Act now.
A memory-overflow flaw in NetScaler ADC and Gateway, now government-confirmed as exploited and corroborated by ENISA EUVD. Confirmed at critical severity. Act now.
Command injection through Rails Active Storage image transforms, now weaponized with a Metasploit module. Active and escalating. Review against your inventory.
An insecure default in Rails Action Pack, paired with CVE-2025-24293 in one public exploit chain. Active and escalating. Review against your inventory.
SQL injection in ProFTPD mod_sql, now weaponized on ExploitDB. Active and escalating. Review against your inventory.
Browse every issue, or read the latest.