ScanForge Security Digest 2618-01

This week saw moderate vulnerability activity with 24 critical CVEs and 66 high-severity issues reported, though no new actively exploited vulnerabilities were added to CISA's catalog. Notable threats include a remote code execution vulnerability in the widely-used llama.cpp library, SQL injection flaws in Saltcorn database applications, and web shell upload capabilities in 7oroof Medcity systems—all requiring prompt patching. Recent security news highlights an uptick in supply chain attacks through legitimate repositories, account takeover campaigns targeting financial platforms, and continued exploitation of cloud infrastructure, indicating threat actors are diversifying tactics beyond traditional vulnerability exploitation. Organizations should prioritize patching the identified critical CVEs affecting their deployed infrastructure, enforce strict code review practices for open-source dependencies, and implement enhanced monitoring for suspicious account activities and cloud access patterns. The absence of KEV entries this period provides a brief window to address known critical risks before active exploitation becomes widespread.