Jared's Technology Podcast Network · Jared Rimer

Sans Newsbites for December 12, 2025: CVE numbers and many CVSS scores of 9s and 10s

December 20, 2025·1 hr 32 min·5 clips

Fortinet, Ivanti, and SAP each shipped critical flaws with CVSS scores of 9.8, 9.9, and 9.6.

Sans episode 31 starts by telling listeners to get the patchbook out. Jared Reimer says the issue is packed with CVEs and CVSS scores ranging from 7 to 10. He says he is not going to read every number aloud for Braille readers. Instead, he has numbered each item so the show is easier to follow when a display jumps. That numbering also helps listeners keep their place if they need to move around. He notes that the editorial team information and contact details sit on separate pages. The file is now 22 pages long. He also says the program is running a little late. He mentions being sick in September and October, which made it hard to keep up. He adds that he is still trying to get as caught up as possible. The tone stays practical and direct. He reminds listeners that these products should be updated. He describes the issues as sevens and nines and says anything above seven is high, with nines and tens needing immediate attention. The episode then turns to Adobe security bulletins. Jared says Adobe released five bulletins covering 138 vulnerabilities. He highlights 117 flaws in Adobe Experience Manager. Two of those are critical DOM based cross site scripting issues, and he says they can allow arbitrary code execution through malicious script injection. He moves on to Adobe ColdFusion and says seven of the twelve fixes there are rated critical. He lists possible consequences like arbitrary file system write, arbitrary code execution, security feature bypass, and escalation issues. He admits he is not familiar with every term and pauses on the unfamiliar security jargon. He then discusses the Adobe DNG Software Development Kit. He says four flaws were fixed there, three of them critical. He points out an integer overflow or wraparound issue that could lead to arbitrary code execution. He also mentions a heap based buffer overflow. He adds an out of bounds read that could expose memory. The main point stays clear throughout: these are not abstract warnings, they are patches that matter now.

As heard by us

A plainspoken security bulletin that makes urgent CVEs easier to follow.

Sans episode 31 is a plainspoken security update that walks through a stack of CVEs without losing the thread. Jared Reimer keeps the focus on patch urgency, and the numbered layout is explained well enough for Braille readers to follow.

Read the full review in PlayNext →

Why you'd press play

You want the patch urgency without the corporate gloss.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Jared's Technology Podcast Network