Critical vulnerabilities, curated daily for security professionals
Friday's brief covers 3 critical-severity CVEs disclosed yesterday, up 200% from Thursday's single critical vulnerability. High-priority disclosures decreased significantly to 45 CVEs, down 53% from the prior day's 95. Five vulnerabilities are confirmed actively exploited in the wild, including CVE-2025-14611 affecting Gladinet CentreStack and Triofox, CVE-2025-43529 targeting Apple products, and CVE-2025-59374 impacting ASUS Live Update. Notable critical vulnerabilities include CVE-2025-14998 (CVSS 9.8) affecting the Branda WordPress plugin with privilege escalation via account takeover, and CVE-2025-66398 (CVSS 9.6) targeting Signal K Server deployments. Patch availability stands at 0%, requiring organizations to implement compensating controls until vendor fixes are released.
Immediate action: Organizations using Gladinet CentreStack/Triofox, Apple products, ASUS Live Update, Digiever DS-2105 Pro, or MongoDB should prioritize review of the actively exploited CVEs and implement network-level mitigations. With no patches currently available, compensating controls such as access restrictions and enhanced monitoring are essential until vendor updates are released.
CVSS score (e.g. 9.1) โ severity from 0โ10. Red marks critical (9+), orange high (7โ8.9).
Exploitability โ how hard the flaw is to attack, read from the CVSS vector:
The lower the bar on all three, the easier to exploit at scale โ โNetwork ยท No privileges ยท No interactionโ is the worst case: hit from anywhere, no credentials, no victim action.
๐ด Actively exploited โ confirmed under attack in the wild (CISAโs Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.
EPSS ยท Nth percentile โ FIRST.orgโs estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% โ a statistical signal itโs unusually likely to be targeted, separate from whether attacks are confirmed.
Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability - Active in CISA KEV catalog.
Apple Multiple Products Use-After-Free WebKit Vulnerability - Active in CISA KEV catalog.
ASUS Live Update Embedded Malicious Code Vulnerability - Active in CISA KEV catalog.
Digiever DS-2105 Pro Missing Authorization Vulnerability - Active in CISA KEV catalog.
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability - Active in CISA KEV catalog.
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. The first is Unauthenticated WebSocket Request Enumeration: When a WebSocket client connects to the SignalK stream endpoint with the `serverevents=all` query parameter, the server sends all cached server events including `ACCESS_REQUEST` events that contain details about pending access requests. The `startServerEvents` function iterates over `app.lastServerEvents` and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when `allow_readonly` is true), attackers receive these events containing request IDs, client identifiers, descriptions, requested permissions, and IP addresses. The second is Unauthenticated Token Polling: The access request status endpoint at `/signalk/v1/access/requests/:id` returns the full state of an access request without requiring authentication. When an administrator approves a request, the response includes the issued JWT token in plaintext. The `queryRequest` function returns the complete request object including the token field, and the REST endpoint uses readonly authentication, allowing unauthenticated access. An attacker has two paths to exploit these vulnerabilities. Either the attacker creates their own access request (using the IP spoofing vulnerability to craft a convincing spoofed request), then polls their own request ID until an administrator approves it, receiving the JWT token; or the attacker passively monitors the WebSocket stream to discover request IDs from legitimate devices, then polls those IDs and steals the JWT tokens when administrators approve them, hijacking legitimate device credentials. Both paths require zero authentication and enable complete authentication bypass. Version 2.19.0 fixes the underlying issues.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin & Your native, mobile iPhone App and Android App allows Reflected XSS
A high-severity remote code execution vulnerability exists in feast-dev/feast version 0
ZBL EPON ONU Broadband Router V100R001 contains a privilege escalation vulnerability that allows limited administrative users to elevate access by sending requests to configuration endpoints
VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection
NuCom 11N Wireless Router 5
A security flaw has been discovered in Seeyon Zhiyuan OA Web Application System up to 20251222
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Epic Games Psyonix Rocket League <=1
Cypress Solutions CTM-200 2
meterN 1
A weakness has been identified in UTT ่ฟๅ 512W 1
A security vulnerability has been detected in UTT ่ฟๅ 512W 1
A vulnerability was detected in UTT ่ฟๅ 512W 1
A flaw has been found in UTT ่ฟๅ 512W 1
Selea CarPlateServer 4
Selea CarPlateServer 4
KZTech JT3500V 4G LTE CPE 2
Cypress Solutions CTM-200/CTM-ONE 1
Signal K Server is a server application that runs on a central hub in a boat
A security flaw has been discovered in itsourcecode School Management System 1
A vulnerability has been found in code-projects Online Guitar Store 1
A vulnerability was found in code-projects Online Guitar Store 1
A vulnerability was determined in code-projects Online Guitar Store 1
A vulnerability was identified in code-projects Online Guitar Store 1
A security vulnerability has been detected in Yonyou KSOA 9
A vulnerability was detected in Yonyou KSOA 9
A vulnerability was found in Yonyou KSOA 9
A vulnerability was determined in Yonyou KSOA 9
A vulnerability was identified in jackying H-ui
A vulnerability was detected in Yonyou KSOA 9
A flaw has been found in Yonyou KSOA 9
A vulnerability has been found in Yonyou KSOA 9
A vulnerability was determined in code-projects Content Management System 1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omar Mohamed Mohamoud LIVE TV allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christopher Churchill allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matamko En Masse allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zckevin ZhinaTwitterWidget allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proloy Chakroborty ZD Scribd iPaper allows Reflected XSS
Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala allows Reflected XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osuthorpe Easy Social allows Reflected XSS