Critical vulnerabilities, curated daily for security professionals
📊
Archived Security Brief
Yesterday's disclosures included 2 critical-severity vulnerabilities, down 50% from the prior day's 4 critical issues. High-priority CVEs dropped 43% to 13 entries, while actively exploited vulnerabilities held steady at 11 KEV entries affecting products from D-Link, Microsoft, Apple, Google, and ASUS. Notable critical vulnerabilities include CVE-2025-54322 (CVSS 10.0) affecting Xspeeder SXZOS and CVE-2025-66203 (CVSS 9.9) in StreamVault video download integration. Current patch availability stands at 0%, indicating organizations should prioritize compensating controls until vendor updates become available.
Critical CVEs down 50% from prior day (2 vs 4)
High-priority CVEs decreased 43% (13 vs 23)
11 actively exploited vulnerabilities affecting D-Link routers, Microsoft Windows, Apple products, Google Chromium, and WinRAR
0% patch availability for disclosed vulnerabilities
Network infrastructure and consumer software heavily represented including ASUS Live Update and Gladinet CentreStack
Immediate action: Organizations using D-Link routers, Microsoft Windows, Apple products, Google Chromium, WinRAR, or Gladinet CentreStack should review exposure to actively exploited vulnerabilities. With no patches currently available, implement network segmentation and monitoring controls for affected systems.
How to read this brief
CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).
Exploitability — how hard the flaw is to attack, read from the CVSS vector:
Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
No / Low / High privileges — the access they need first. No privileges means no login required.
No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.
The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.
🔴 Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.
💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove
Section Navigation
⚠️
CISA Known Exploited Vulnerabilities
⚠️ CISA KEVURGENT
CVE-2022-37055
9.5
D-LinkRouters
🔴 Actively exploited in the wild
D-Link Routers Buffer Overflow Vulnerability - Active in CISA KEV catalog.
⚠️ CISA KEVURGENT
CVE-2025-66644
9.5
Array Networks ArrayOS AG
🔴 Actively exploited in the wild
Array Networks ArrayOS AG OS Command Injection Vulnerability - Active in CISA KEV catalog.
⚠️ CISA KEVURGENT
CVE-2025-6218
9.5
RARLABWinRAR
🔴 Actively exploited in the wild
RARLAB WinRAR Path Traversal Vulnerability - Active in CISA KEV catalog.
StreamVault is a video download integrationMultiple Products
StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.
Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.