Dec 12, 2025
2 new incidents, 1 with updates.
Started
- ClosedHighPatched
Google Chromium: Chromium Out of Bounds Memory Access Vulnerability
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to CISA KEV on 2025-12-12.
Google ChromiumClosed Dec 12, 2025
- ClosedHighPatched
Sierra Wireless AirLink ALEOS: AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-12-12.
Sierra Wireless AirLink ALEOSClosed Dec 12, 2025
Updated
- ClosedCriticalPatched
React2Shell: CVSS 10 unauthenticated RCE in React Server Components and Next.js
A flaw in how React Server Components deserialize Flight payloads let an unauthenticated request run code on the server. Next.js App Router apps were affected by default. China-nexus groups including Earth Lamia and Jackpot Panda exploited it within hours of disclosure. CVE-2025-66478 (the Next.js id) was rejected as a duplicate.
React Server Components (react-server-dom-*), Next.jsClosed Dec 12, 2025
