Sunday, December 28, 2025 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Yesterday's disclosures included 2 critical-severity vulnerabilities, down 50% from the prior day's 4 critical issues. High-priority CVEs dropped 43% to 13 entries, while actively exploited vulnerabilities held steady at 11 KEV entries affecting products from D-Link, Microsoft, Apple, Google, and ASUS. Notable critical vulnerabilities include CVE-2025-54322 (CVSS 10.0) affecting Xspeeder SXZOS and CVE-2025-66203 (CVSS 9.9) in StreamVault video download integration. Current patch availability stands at 0%, indicating organizations should prioritize compensating controls until vendor updates become available.

  • Critical CVEs down 50% from prior day (2 vs 4)
  • High-priority CVEs decreased 43% (13 vs 23)
  • 11 actively exploited vulnerabilities affecting D-Link routers, Microsoft Windows, Apple products, Google Chromium, and WinRAR
  • 0% patch availability for disclosed vulnerabilities
  • Network infrastructure and consumer software heavily represented including ASUS Live Update and Gladinet CentreStack

Immediate action: Organizations using D-Link routers, Microsoft Windows, Apple products, Google Chromium, WinRAR, or Gladinet CentreStack should review exposure to actively exploited vulnerabilities. With no patches currently available, implement network segmentation and monitoring controls for affected systems.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation