CISA Known Exploited Vulnerabilities
KEV additions — December 2025
20 CVEs entered the KEV catalog in December 2025.
Added December 29, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-14847 | MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability | 7.5 | 64.8 % | January 19, 2026 |
Added December 22, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-52163 | Digiever DS-2105 Pro Missing Authorization Vulnerability | 8.8 | 67.5 % | January 12, 2026 |
Added December 19, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-14733 | WatchGuard Firebox Out of Bounds Write Vulnerability | 9.8 | 44.2 % | December 26, 2025 |
Added December 17, 20253
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-20393 | Cisco Multiple Products Improper Input Validation Vulnerability | 10 | 5.0 % | December 24, 2025 |
| CVE-2025-40602 | SonicWall SMA1000 Missing Authorization Vulnerability | 6.6 | 0.3 % | December 24, 2025 |
| CVE-2025-59374 | ASUS Live Update Embedded Malicious Code Vulnerability | 9.8 | 31.8 % | January 7, 2026 |
Added December 16, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-59718 | Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability | 9.8 | 2.4 % | December 23, 2025 |
Added December 15, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-14611 | Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability | 9.8 | 58.3 % | January 5, 2026 |
| CVE-2025-43529 | Apple Multiple Products Use-After-Free WebKit Vulnerability | 8.8 | 0.0 % | January 5, 2026 |
Added December 12, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-4063 | Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability | 8.8 | 0.8 % | January 2, 2026 |
| CVE-2025-14174 | Google Chromium Out of Bounds Memory Access Vulnerability | 8.8 | 0.8 % | January 2, 2026 |
Added December 11, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-58360 | OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability | 9.8 | 85.7 % | January 1, 2026 |
Added December 9, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-6218 | RARLAB WinRAR Path Traversal Vulnerability | 7.8 | 6.6 % | December 30, 2025 |
| CVE-2025-62221 | Microsoft Windows Use After Free Vulnerability | 7.8 | 2.7 % | December 30, 2025 |
Added December 8, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2022-37055 | D-Link Routers Buffer Overflow Vulnerability | 9.8 | 69.8 % | December 29, 2025 |
| CVE-2025-66644 | Array Networks ArrayOS AG OS Command Injection Vulnerability | 9.8 | 3.1 % | December 29, 2025 |
Added December 5, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-55182ransomware | Meta React Server Components Remote Code Execution Vulnerability | 10 | 59.6 % | December 12, 2025 |
Added December 3, 20251
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-26828 | OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability | 8.8 | 80.0 % | December 24, 2025 |
Added December 2, 20252
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-48572 | Android Framework Privilege Escalation Vulnerability | 7.8 | 0.3 % | December 23, 2025 |
| CVE-2025-48633 | Android Framework Information Disclosure Vulnerability | 5.5 | 0.2 % | December 23, 2025 |