Analyst decision point
This daily CVE digest is an intake queue, not a list of confirmed incidents.
- Evidence
- Generated from NVD, CISA KEV, and EPSS across 247 CVEs.
- Mapping
- ATT&CK mapping is intentionally absent at digest level. Map behavior only from reviewed exploitation evidence.
- Next action
- Sort by exploit signal, product exposure, business criticality, and telemetry availability.
Attack understanding
Turn vulnerability volume into defender priorities
The digest is designed to help a defender decide what to inspect first without converting CVSS or EPSS into unsupported attack claims.
Total intake
NVD records inside the source window.
High / critical
Severity triage candidates, not incident evidence.
CISA KEV
Known exploited entries require faster exposure review.
Exploit signals
Records with exploitation context in the generated intake.
This digest separates vulnerability prioritization from threat behavior. Do not infer malware, vendor compromise, actor identity, or ATT&CK techniques from a CVE list alone.
Automation Boundary
This digest is automated CVE intake, not a reviewed threat-activity claim. It ranks public NVD records with EPSS enrichment and CISA KEV context so defenders have a daily review queue. Items without an exploitation signal should be treated as vulnerability-prioritization leads, not evidence of active intrusion.
Daily Counts
- NVD CVEs published in the source window: 247
- High or critical CVEs considered for ranking: 134
- CISA KEV additions on 2026-07-16: 3
- Ranked items published here: 10
Top 10 CVE Intake
| Rank | CVE | CVSS | EPSS percentile | CVE summary |
|---|---|---|---|---|
| 1 | CVE-2021-27137 | HIGH 8.1 | 91.8% | An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticat... |
| 2 | CVE-2026-46339 | CRITICAL 10.0 | 90.6% | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, a... |
| 3 | CVE-2026-59865 | CRITICAL 9.3 | 86.7% | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota info read x-ms-kiota-info.languagesInformation.<language>.dependencyIn... |
| 4 | CVE-2026-59867 | HIGH 7.1 | 77.6% | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading... |
| 5 | CVE-2026-30618 | CRITICAL 9.8 | 74.2% | xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker... |
| 6 | CVE-2026-59861 | HIGH 7.5 | 70.9% | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and ot... |
| 7 | CVE-2026-44596 | CRITICAL 9.8 | 69.2% | Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/jav... |
| 8 | CVE-2026-63305 | CRITICAL 9.2 | 69.1% | AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are conca... |
| 9 | CVE-2026-63304 | CRITICAL 9.2 | 68.5% | AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function in... |
| 10 | CVE-2026-59866 | CRITICAL 9.3 | 68.5% | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values w... |
Source Notes
The source window is 2026-07-15T18:30:00.000Z to 2026-07-16T18:29:59.999Z. AttackTrace uses NVD publication timestamps, CISA KEV date-added values, and FIRST EPSS enrichment. Reviewed threat-activity briefs remain separate and require source-backed exploitation or campaign evidence.
Ranked CVEs
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal f...
Open NVD record9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/...
Open NVD recordKiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI d...
Open NVD recordKiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` o...
Open NVD recordxszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure...
Open NVD recordKiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeFor...
Open NVD recordYamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, acco...
Open NVD recordAVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft...
Open NVD recordAVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitized keyword parameters inside single quotes without...
Open NVD recordKiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class...
Open NVD recordDefender review
How to use this digest
This digest is an intake queue. Treat it as a prioritization input, then verify product presence, exposure, patch state, and detection coverage in your own environment.
Investigate
- 01Identify which ranked CVEs affect products present in your environment.
- 02Separate externally exposed systems from internal-only assets.
- 03Compare KEV, EPSS, vendor, and NVD source status before assigning urgency.
Detect
- 01Check whether affected products produce logs useful for exploitation attempts.
- 02Avoid creating ATT&CK detections until sources describe observed behavior.
- 03Record missing telemetry as a coverage gap for product owners.
Respond
- 01Patch or mitigate based on exposure and exploit signal.
- 02Promote only source-backed exploitation cases into reviewed threat activity.
- 03Archive non-applicable products so the queue stays usable tomorrow.
Separate KEV-backed exploitation from high CVSS records with no exploit signal.
Confirm affected products and versions before assigning remediation urgency.
Record evidence gaps instead of converting unknowns into exposure claims.
Escalate reviewed threat-activity candidates only when exploitation or campaign evidence exists.
Evidence presentation
Source window and ranking boundary
Ranking is derived from public vulnerability feeds. It should guide review order, not replace asset inventory or incident evidence.
Source window starts 2026-07-15T18:30:00.000Z.
Source window ends 2026-07-16T18:29:59.999Z.
NVD provides vulnerability details and CVSS context.
CISA KEV and EPSS provide exploitation and probability context.
Record history
Update history
Update history
- Published
- 2026-07-16
- Generated
- 2026-07-17T19:00:10.631Z
- CVEs included
- 247