Dec 4, 2025 Cyber Threat Intelligence

Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.

Daily summary

  • 9 new critical disclosures — review patch status on exposed services.

Top threats today

Three highest-priority changes — analyst brief, not a CVE dump.

Critical exposure

CVE-2025-29269 Allnet All-rut22gw Firmware Command Injection

  • CVSS 9.8

New critical Allnet All-rut22gw Firmware Command Injection (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Critical exposure

CVE-2025-53963 An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices.

  • CVSS 9.8
  • Remote code execution exposure

New critical Thermofisher Ion Torrent Onetouch 2 Firmware Code Execution (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Critical exposure

CVE-2025-29268 ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.

  • CVSS 9.8

New critical disclosure (CVSS 9.8) — high severity with a short public awareness window before exploit material typically surfaces.

Active exploitation

CISA KEV — confirmed in-the-wild exploitation.

Nothing flagged in this category for this digest.

View KEV additions

Exploit & PoC activity

Nothing flagged in this category for this digest.

View new exploit links

Exploitation dynamics

Nothing flagged in this category for this digest.

See EPSS increases

New critical disclosures

CVE-2024-45538 CVSS 9.6

Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-...

CVE-2025-29268 CVSS 9.8

ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.

CVE-2025-29269 CVSS 9.8

ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endp...

CVE-2025-53963 CVSS 9.8

An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices.

CVE-2025-54303 CVSS 9.8

The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API.

CVE-2025-54304 CVSS 9.8

An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices.

CVE-2025-63362 CVSS 9.8

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows...

CVE-2025-65346 CVSS 9.1

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.

CVE-2025-66571 CVSS 9.3

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id PO...

View critical disclosures

cvelogic Threat Intelligence