Saturday, November 22, 2025 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Saturday's vulnerability landscape demonstrates significant moderation with 6 critical vulnerabilities (50% decrease from yesterday's 12), including two maximum severity CVSS 10.0 issues affecting unknown systems and Grafana Enterprise SCIM provisioning. High-priority CVEs remained unchanged at 44, while nine actively exploited CISA KEV vulnerabilities continue to require priority weekend remediation. The disclosure environment features two CVSS 10.0 vulnerabilities and four CVSS 9.8/9.1 vulnerabilities enabling unauthenticated remote code execution and authentication bypass attacks. Patch availability improved to 24% from yesterday's 17%, enabling more direct remediation heading into the weekend.

  • Critical CVE count decreased 50% from 12 to 6 vulnerabilities, indicating significantly reduced weekend disclosure activity
  • Two CVSS 10.0 vulnerabilities require immediate weekend assessment: CVE-2025-65108 (unknown vendor) and CVE-2025-41115 (Grafana Enterprise SCIM provisioning)
  • CVE-2025-11456 (CVSS 9.8) affects The ELEX WordPress HelpDesk, CVE-2025-11127 (CVSS 9.8) affects Mstoreapp Mobile App WordPress plugin, CVE-2025-64310 (CVSS 9.8) affects EPSON WebConfig projector products
  • High-priority vulnerabilities unchanged at 44 CVEs, maintaining consistent disclosure levels from yesterday
  • Patch availability improved to 24% (up from 17%), enabling direct weekend remediation for nearly one-quarter of new vulnerabilities
  • Nine actively exploited CISA KEV vulnerabilities remain unchanged, requiring priority weekend remediation before Monday operations resume

Immediate action: WEEKEND PRIORITY ACTION: Security teams must immediately assess CVE-2025-65108 and CVE-2025-41115 (both CVSS 10.0) to determine environmental presence and impact despite vendor uncertainty. Priority weekend patching should address the three CVSS 9.8 unauthenticated remote code execution vulnerabilities, particularly CVE-2025-11456 (WordPress HelpDesk), CVE-2025-11127 (WordPress Mobile App plugin), and CVE-2025-64310 (EPSON projector products) where weekend vendor patch deployment may be feasible. With 24% patch availability (7% improvement), organizations should leverage weekend maintenance windows for direct remediation where possible. The nine actively exploited CISA KEV vulnerabilities require continued weekend focus, with network segmentation, administrative access restrictions, and Web Application Firewall deployment as compensating controls for the remaining 76% unpatched vulnerabilities until vendors release updates.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation