NVD disclosure day

Published threat advisories for December 27, 2025

CVE-2025-54322

Xspeeder SXZOS Root Code Execution Vulnerability

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A critical vulnerability exists in Xspeeder SXZOS, allowing unauthenticated root remote code execution via base64-encoded Python code in the `chkid` parameter of vLogin.py. This could lead to a complete system compromise, making it crucial to identify and assess affected systems.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-66203

StreamVault RCE via yt-dlp Argument Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical Remote Code Execution vulnerability exists in StreamVault's administrative API, allowing attackers to inject commands via yt-dlp arguments, potentially compromising the server.

NVD modified: NVD date unavailable