CVE-2022-37055
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Critical vulnerabilities, curated daily for security professionals
See how vulnerabilities affect your specific environment
CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework
Yesterday's disclosures included 4 critical vulnerabilities (CVSS 9.0+), a notable increase from zero critical issues the prior day. High-priority CVEs decreased 76% to 23 from the previous day's 95. Eleven actively exploited vulnerabilities remain on the CISA KEV list, including CVE-2025-66644 affecting Array Networks ArrayOS AG, CVE-2025-6218 in RARLAB WinRAR, and CVE-2025-62221 targeting Microsoft Windows. Notable critical disclosures include CVE-2025-66203 (CVSS 9.9) in StreamVault video download integration, CVE-2025-68668 (CVSS 9.9), and CVE-2025-13915 (CVSS 9.8) affecting IBM API Connect. Patch availability stands at 0%, requiring organizations to implement compensating controls until vendor fixes become available.
Immediate action: Priority review is recommended for organizations using IBM API Connect, Array Networks ArrayOS AG, RARLAB WinRAR, and Microsoft Windows systems. With no patches currently available, implement network segmentation and enhanced monitoring for affected products while awaiting vendor updates.
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
Array Networks ArrayOS AG OS Command Injection Vulnerability - Active in CISA KEV catalog.
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
Microsoft Windows Use After Free Vulnerability - Active in CISA KEV catalog.
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability - Active in CISA KEV catalog.
Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability - Active in CISA KEV catalog.
Google Chromium Out of Bounds Memory Access Vulnerability - Active in CISA KEV catalog.
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Use-After-Free WebKit Vulnerability - Active in CISA KEV catalog.
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Digiever DS-2105 Pro Missing Authorization Vulnerability - Active in CISA KEV catalog.
StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.
Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter.
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
Cola Dnslog v1
A vulnerability has been found in UTT čŋå 512W up to 1
A vulnerability was found in UTT čŋå 512W up to 1
A vulnerability was determined in UTT čŋå 512W up to 1
A vulnerability was identified in UTT čŋå 512W up to 1
LMDeploy is a toolkit for compressing, deploying, and serving LLMs
Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package
Gitea before 1
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution
IBM Concert 1
IBM Concert 1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd
A vulnerability exists in the libxmljs 1
Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H
Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2
A path traversal vulnerability in Croogo CMS 4
NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform
A vulnerability was found in Alteryx Server
A vulnerability was identified in simstudioai sim up to 0
n8n is an open source workflow automation platform
n8n is an open source workflow automation platform