CISA Known Exploited Vulnerabilities
KEV additions — December 2025
20 CVEs entered the KEV catalog in December 2025.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added December 29, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-14847 | MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability | 7.5 | 83.2 % | Jan 19, 2026 |
Added December 22, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-52163 | Digiever DS-2105 Pro Missing Authorization Vulnerability | 8.8 | 96.9 % | Jan 12, 2026 |
Added December 19, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-14733 | WatchGuard Firebox Out of Bounds Write Vulnerability | 9.8 | 26.5 % | Dec 26, 2025 |
Added December 17, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-20393 | Cisco Multiple Products Improper Input Validation Vulnerability | 10 | 32.4 % | Dec 24, 2025 |
| CVE-2025-40602 | SonicWall SMA1000 Missing Authorization Vulnerability | 6.6 | 2.8 % | Dec 24, 2025 |
| CVE-2025-59374 | ASUS Live Update Embedded Malicious Code Vulnerability | 9.8 | 1.2 % | Jan 7, 2026 |
Added December 16, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-59718 | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability | 9.8 | 68.3 % | Dec 23, 2025 |
Added December 15, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-14611 | Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability | 9.8 | 53.3 % | Jan 5, 2026 |
| CVE-2025-43529 | Apple Multiple Products Use-After-Free WebKit Vulnerability | 8.8 | 8.8 % | Jan 5, 2026 |
Added December 12, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-4063 | Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability | 8.8 | 27.3 % | Jan 2, 2026 |
| CVE-2025-14174 | Google Chromium Out of Bounds Memory Access Vulnerability | 8.8 | 22.3 % | Jan 2, 2026 |
Added December 11, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-58360 | OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability | 9.8 | 60.0 % | Jan 1, 2026 |
Added December 9, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-6218 | RARLAB WinRAR Path Traversal Vulnerability | 7.8 | 90.5 % | Dec 30, 2025 |
| CVE-2025-62221 | Microsoft Windows Use After Free Vulnerability | 7.8 | 2.5 % | Dec 30, 2025 |
Added December 8, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2022-37055 | D-Link Routers Buffer Overflow Vulnerability | 9.8 | 55.5 % | Dec 29, 2025 |
| CVE-2025-66644 | Array Networks ArrayOS AG OS Command Injection Vulnerability | 9.8 | 3.4 % | Dec 29, 2025 |
Added December 5, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-55182ransomware | Meta React Server Components Remote Code Execution Vulnerability | 10 | 99.8 % | Dec 12, 2025 |
Added December 3, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-26828 | OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability | 8.8 | 39.4 % | Dec 24, 2025 |
Added December 2, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-48572 | Android Framework Privilege Escalation Vulnerability | 7.8 | 0.3 % | Dec 23, 2025 |
| CVE-2025-48633 | Android Framework Information Disclosure Vulnerability | 5.5 | 0.3 % | Dec 23, 2025 |