Mar 31, 2022 Cyber Threat Intelligence

Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.

Daily summary

  • Dasan Gigabit Passive Optical Network (GPON) Routers: 2 CVEs added to CISA KEV today.
  • 8 new critical disclosures — review patch status on exposed services.

Top threats today

Three highest-priority changes — analyst brief, not a CVE dump.

Critical active threat

CVE-2018-10561 Dasan GPON Routers Authentication Bypass

  • Actively exploited (CISA KEV)
  • Listed on CISA KEV
  • Authentication bypass — unauthenticated access risk

Dasan Gigabit Passive Optical Network (GPON) Routers Auth Bypass is on CISA KEV — confirmed in-the-wild exploitation. Expect continued targeting while the issue remains on the catalog.

Critical exposure

CVE-2022-24796 Raspberrymatic RCE

  • CVSS 10
  • Remote code execution exposure

New critical Raspberrymatic RCE (CVSS 10) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Critical exposure

CVE-2022-24803 Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension.

  • CVSS 10

New critical disclosure (CVSS 10) — high severity with a short public awareness window before exploit material typically surfaces.

Active exploitation

CISA KEV — confirmed in-the-wild exploitation.

Microsoft Windows User Profile Service Privilege Escalation

View KEV additions

Exploit & PoC activity

Nothing flagged in this category for this digest.

View new exploit links

Exploitation dynamics

Nothing flagged in this category for this digest.

See EPSS increases

New critical disclosures

CVE-2021-43479 CVSS 9.8

A Remote Code Execution (RCE) vulnerability exists in The-Secretary 2.5 via install.php.

CVE-2021-43484 CVSS 9.8

A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate th...

CVE-2021-43506 CVSS 9.8

An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter in Login.php.

CVE-2021-43722 CVSS 9.8

D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow.

CVE-2022-24136 CVSS 9.8

Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php.

CVE-2022-24796 CVSS 10

RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware...

CVE-2022-24803 CVSS 10

Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension.

CVE-2022-26546 CVSS 9.1

Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and...

View critical disclosures

cvelogic Threat Intelligence