December 2025
5,771 CVEs published, +81% on November 2025 and +64% on December 2024. CISA added 20 to KEV.
2025 month by month
- Critical
- 3968% of the 4,785 with a CVSS score
- Added to CISA KEV
- 2019 of this month's CVEs are in KEV, listed a median 10 days after publication
- Vendors
- 2,1785,773 products
- Top weakness
- XSSCWE-79 · 826 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux, Linux Kernel1,0551nonenew
- 2Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Wpe Webkit450103new
- 3Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 62111nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra-safepolicy, Linux Astra Modules15171new
- 5CanonicalUbuntu, Apport, Maas1421nonenew
- 6AdobeAdobe Experience Manager, Experience Manager, Adobe Experience Manager Cloud Service1376nonenew
- 7GoogleAndroid, Chrome, Google Chrome13323new
- 8Ооо «ред Софт»Ред Ос, Ред База Данных8632new
- 9GoCode.gitea.io/gitea, Github.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost8361new
- 10Ао «ивк»Альт Сп 10, Альт 8 Сп774nonenew
- 11npmN8N, @vitejs/plugin-rsc, React-server-dom-webpack7592new
- 12code-projectsStudent File Management System, Refugee Food Management System, Simple Stock System740nonenew
- 13PyPIPicklescan, Weblate, Mcp-server-git7481new
- 14MicrosoftWindows Server 2025, Windows 11 Version 24h2, Windows 11 Version 25h27232new
- 15ApplemacOS, iOS and iPadOS, Visionos6824new
- 16PackagistGetgrav/grav, Feehi/feehicms, Thorsten/phpmyfaq649nonenew
- 17Axiomthemes777, Agricola, Algenix580nonenew
- 18TendaWH450 Firmware, WH450, M35112nonenew
- 19Ао «сбертех»Platform V Sberlinux OS Server491nonenew
- 20AncorathemesChildhope, Chinchilla, Detailx481nonenew
- 21MavenOrg.jenkins-ci.main:jenkins-core, Org.nutz:nutzboot-parent, Org.apache.streampark:streampark482nonenew
- 22FabianStudent File Management System, Refugee Food Management System, Currency Exchange System460nonenew
- 23RuijieRg-eap602 Firmware, X30 Pro Firmware, Rg-ew300 Pro Firmware410nonenew
- 24ItsourcecodeStudent Management System, Online Cake Ordering System, Covid Tracking System390nonenew
- 25Mediatek, Inc.Mt2718, Mt6739, Mt6761, Mt6765, Mt6768, Mt6781, Mt6789, Mt6833, Mt6835, Mt6853, Mt6855, Mt6877, Mt6878, Mt6879, Mt6883, Mt6885, Mt6886, Mt6889, Mt6893, Mt6895, Mt6897, Mt6899, Mt6983, Mt6985, Mt6989, Mt6991, Mt8196, Mt8676, Mt8678, Mt8792, MT8793, Mt2735, Mt6833, Mt6833p, Mt6853, Mt6853t, Mt6855, Mt6855t, Mt6873, Mt6875, Mt6875t, Mt6877, Mt6877t, Mt6877tt, Mt6880, Mt6883, Mt6885, Mt6889, Mt6890, Mt6891, Mt6893, Mt8675, Mt8771, Mt8791, Mt8791t, MT8797, Mt6739, Mt6761, Mt6765, Mt6768, Mt6781, Mt6789, Mt6833, Mt6835, Mt6853, Mt6855, Mt6877, Mt6878, Mt6879, Mt6883, Mt6885, Mt6886, Mt6889, Mt6893, Mt6895, Mt6897, Mt6899, Mt6983, Mt6985, Mt6989, Mt6991, Mt8186, Mt8188, Mt8196, Mt8667, Mt8673, Mt8676, Mt8678, Mt8765, Mt8766, Mt8768, Mt8771, Mt8781, Mt8791t, Mt8792, Mt8793, Mt8795t, Mt8796, Mt8798, Mt8873, MT8883300nonenew
Severity
How this month's CVEs score on CVSS; 986 have no score yet. Severity is not exploitation.
- Critical396
- High1,715
- Medium2,480
- Low194
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS826
- CWE-862Missing Authorization418
- CWE-89SQL Injection285
- CWE-74Injection209
- CWE-352CSRF191
- CWE-98169
- CWE-22Path Traversal143
- CWE-94Code Injection141
- CWE-78OS Command Injection118
- CWE-284Improper Access Control103
- CWE-787Out-of-bounds Write102
- CWE-434Unrestricted File Upload101
- CWE-502Deserialization96
- CWE-119Memory Buffer Bounds94
- CWE-20Improper Input Validation93
- CWE-77Command Injection85
- CWE-12179
- CWE-200Information Exposure78
- CWE-306Missing Auth for Critical Function78
- CWE-639Auth Bypass via User Key75
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,42322% of sector-tagged CVEs
- Operating Systems1,37921% of sector-tagged CVEs
- OSS Libraries5509% of sector-tagged CVEs
- Enterprise Software5128% of sector-tagged CVEs
- Consumer Software3465% of sector-tagged CVEs
- ICS / OT / IoT3105% of sector-tagged CVEs
- Networking Infrastructure2784% of sector-tagged CVEs
- Mobile Apps2444% of sector-tagged CVEs
- 7 smaller sectors931
- Not yet classified449
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 74Injection | 352CSRF | 98 | 22Path Traversal | 94Code Injection | 78OS Command Injection | 284Improper Access Control |
|---|---|---|---|---|---|---|---|---|---|---|
| Linux | ||||||||||
| Сообщество Свободного Программного Обеспечения | 2 | 1 | 1 | 1 | 1 | |||||
| Red Hat Inc. | 1 | 1 | 1 | |||||||
| Ооо «русбитех-астра» | 1 | 1 | 3 | 1 | 1 | |||||
| Canonical Ltd. | 1 | |||||||||
| Adobe Systems Inc. | 116 | 1 | 1 | |||||||
| Adobe | 115 | 1 | 1 | |||||||
| 1 | 8 | |||||||||
| Ооо «ред Софт» | 7 | 2 | 1 | 1 | 1 | 1 | 2 | 1 | ||
| Ао «ивк» | 1 | 1 | ||||||||
| Go | 5 | 4 | 7 | 1 | 4 | |||||
| npm | 9 | 1 | 2 | 4 | 2 |
In the news
The CVEs security news mentioned most in December 2025.
- CVE-2025-13659Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, pot...18.8
- CVE-2025-34392Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE19.8
- CVE-2025-50165Windows Graphics Component Remote Code Execution Vulnerability19.8
- CVE-2025-64374WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability19.9
CVEs published in December 2025
36 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2025-20393Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution VulnerabilityKEV10.0
- CVE-2025-37164A remote code execution issue exists in HPE OneView.KEV10.0
- CVE-2025-52691Upload Arbitrary FilesKEV10.0
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, rea...KEV10.0
- CVE-2025-68613n8n Vulnerable to Remote Code Execution via Expression InjectionKEV9.9
- CVE-2025-14611Gladinet CentreStack and TrioFox Hard Coded AES KeysKEV9.8
- CVE-2025-14733WatchGuard Firebox iked Out of Bounds Write VulnerabilityKEV9.8
- CVE-2025-59374"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds coul...KEV9.8
- CVE-2025-59718A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, Fo...KEV9.8
- CVE-2025-14174Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security sev...KEV8.8
- CVE-2025-34291Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCEKEV8.8
- CVE-2025-43529A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, vision...KEV8.8
- CVE-2025-68645A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestF...KEV8.8
- CVE-2025-8110File overwrite in file update API in GogsKEV8.8
- CVE-2025-43510A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, ...KEV7.8
- CVE-2025-48572In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution pr...KEV7.8
- CVE-2025-62221Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2025-14847Zlib compressed protocol header length confusion may allow memory readKEV7.5
- CVE-2025-66644Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.KEV7.2
- CVE-2025-68461Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.KEV7.2
- CVE-2025-40602A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).KEV6.6
- CVE-2025-43520A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macO...KEV5.5
- CVE-2025-48633In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of...KEV5.5
- CVE-2025-59719An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to byp...9.8
- CVE-2025-69286RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability9.8
- CVE-2025-12106Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses9.1
- CVE-2025-56083OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta...8.8
- CVE-2025-57201AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server function. This vulnerability allows atta...8.8
- CVE-2025-68700RAGFlow Remote Code Execution Vulnerability8.8
- CVE-2025-67644LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method7.3
- CVE-2025-68460Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.7.2
- CVE-2025-14284Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute...6.1
- CVE-2025-64627Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4
- CVE-2024-29370In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exce...5.3
- CVE-2025-14966FastAdmin Backend Controller Backend.php selectpage sql injection4.7
- CVE-2025-1525008CMS Novel System Template mtpls.inc.php code injection4.7