Do Son CISA adds 4 flaws to KEV, including critical Versa Concerto auth bypass (CVSS 9.2) & malicious "Prettier" package. Patch by Feb 12 to stop active attacks.
Versa Concerto
ProjectDiscovery revealed critical zero-days (CVSS 10) in Versa Concerto, enabling full RCE and host compromise via auth bypass and Docker escape.