Nov 25, 2022 Cyber Threat Intelligence

Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.

Daily summary

  • 10 new critical disclosures — review patch status on exposed services.

Top threats today

Three highest-priority changes — analyst brief, not a CVE dump.

Critical exposure

CVE-2022-44843 Totolink A7100ru Firmware Command Injection

  • CVSS 9.8

New critical Totolink A7100ru Firmware Command Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Critical exposure

CVE-2022-44844 Totolink A7100ru Firmware Command Injection

  • CVSS 9.8

New critical Totolink A7100ru Firmware Command Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Critical exposure

CVE-2022-45206 Jeecg Boot SQL Injection

  • CVSS 9.8

New critical Jeecg Boot SQL Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Active exploitation

CISA KEV — confirmed in-the-wild exploitation.

Nothing flagged in this category for this digest.

View KEV additions

Exploit & PoC activity

Nothing flagged in this category for this digest.

View new exploit links

Exploitation dynamics

Nothing flagged in this category for this digest.

See EPSS increases

New critical disclosures

CVE-2022-36133 CVSS 9.1

The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass.

CVE-2022-37720 CVSS 9

Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS).

CVE-2022-37721 CVSS 9

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and...

CVE-2022-41705 CVSS 9.8

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server.

CVE-2022-44843 CVSS 9.8

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/...

CVE-2022-44844 CVSS 9.8

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/...

CVE-2022-45152 CVSS 9.1

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle.

CVE-2022-45206 CVSS 9.8

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.

CVE-2022-45207 CVSS 9.8

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.

CVE-2022-45476 CVSS 9.8

Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for downl...

View critical disclosures

cvelogic Threat Intelligence