Do Son CISA adds 4 flaws to KEV, including critical Versa Concerto auth bypass (CVSS 9.2) & malicious "Prettier" package. Patch by Feb 12 to stop active attacks.
CVE-2025-34026
ProjectDiscovery revealed critical zero-days (CVSS 10) in Versa Concerto, enabling full RCE and host compromise via auth bypass and Docker escape.