New that day
- highpatchedexploited Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12).
- highpatchedexploited Versa Concerto Improper Authentication Vulnerability Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12).
- highpatchedexploited Vite Vitejs Improper Access Control Vulnerability Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12).
- highpatchedexploited Prettier eslint-config-prettier Embedded Malicious Code Vulnerability Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12).