Week 50, 2025
8 December to 14 December 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,733
- Critical
- 124
- High
- 551
- Added to KEV
- 7
Critical 124High 551Medium 849Low 52Not scored 157All 1,733 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2025-14174
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a…
Google · Chrome
ExploitedHigh8.8 - CVE-2018-4063
An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP…
Sierra Wireless
ExploitedHigh8.8 - CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
geoserver · geoserver
ExploitedHigh8.2 - CVE-2025-62221
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2025-6218
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
RARLAB · WinRAR
ExploitedHigh7.8 - CVE-2022-37055
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
Product not named
ExploitedCritical9.8 - CVE-2025-66644
Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.
Array Networks · ArrayOS AG
ExploitedHigh7.2
Most severe new CVEsBy CVSS score
- CVE-2025-34392
Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE
Barracuda Networks · RMM
Critical10.0 - CVE-2025-14306
Directory Traversal in Robocode's CacheCleaner Component
Robocode Project · Robocode
Critical10.0 - CVE-2025-34394
Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE
Barracuda Networks · RMM
Critical10.0 - CVE-2025-34393
Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE
Barracuda Networks · RMM
Critical10.0 - CVE-2025-14308
Integer Overflow in Robocode's Buffer Write Method
Robocode Project · Robocode
Critical10.0 - CVE-2025-42880
Code Injection vulnerability in SAP Solution Manager
SAP_SE · SAP Solution Manager
Critical9.9 - CVE-2025-64721
Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise
sandboxie-plus · Sandboxie
Critical9.9 - CVE-2023-53739
Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
Tinycontrol · Tinycontrol LAN Controller v
Critical9.9 - CVE-2025-13184
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password
Toto Link · X5000R's (AX1800 router)
Critical9.8 - CVE-2025-11693
Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File
recorp · Export WordPress Pages to Static HTML & PDF — Static Site Export
Critical9.8
Vendors with the most CVEs
Most common weaknesses
- CWE-79 Cross-site scripting (XSS)319
- CWE-862 Missing authorization129
- CWE-89 SQL injection110
- CWE-74 Injection85
- CWE-352 Cross-site request forgery (CSRF)75
- CWE-78 OS command injection55
- CWE-22 Path traversal46
- CWE-20 Improper input validation44
- CWE-284 Improper access control35
- CWE-787 Out-of-bounds write34