Week 51, 2025
15 December to 21 December 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,263
- Critical
- 115
- High
- 503
- Added to KEV
- 7
Critical 115High 503Medium 509Low 35Not scored 101All 1,263 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2025-14733
WatchGuard Firebox iked Out of Bounds Write Vulnerability
WatchGuard · Fireware OS
ExploitedCritical9.3 - CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
Cisco · Cisco Secure Email
ExploitedCritical10.0 - CVE-2025-59374
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain…
ASUS · live update
ExploitedCritical9.3 - CVE-2025-40602
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
SonicWall · SMA1000
ExploitedMedium6.6 - CVE-2025-59718
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through…
Fortinet · FortiSwitchManager
ExploitedCritical9.1 - CVE-2025-43529
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS…
Apple · Safari
ExploitedHigh8.8 - CVE-2025-14611
Gladinet CentreStack and TrioFox Hard Coded AES Keys
Gladinet · CentreStack and TrioFox
ExploitedHigh7.1
Most severe new CVEsBy CVSS score
- CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
n8n-io · n8n
ExploitedCritical10.0 - CVE-2025-37164
A remote code execution issue exists in HPE OneView.
Hewlett Packard Enterprise (HPE) · HPE OneView
ExploitedCritical10.0 - CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
Cisco · Cisco Secure Email
ExploitedCritical10.0 - CVE-2025-44005
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol…
smallstep · Step-CA
Critical10.0 - CVE-2025-62521
ChurchCRM has unauthenticated RCE in its Install Wizard
ChurchCRM · CRM
Critical10.0 - CVE-2025-63414
A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By…
Product not named
Critical10.0 - CVE-2025-65037
Azure Container Apps Remote Code Execution Vulnerability
Microsoft · Azure Container Apps
Critical10.0 - CVE-2025-65041
Microsoft Partner Center Elevation of Privilege Vulnerability
Microsoft · Microsoft Partner Center
Critical10.0 - CVE-2025-68110
ChurchCRM discloses database information on error message
ChurchCRM · CRM
Critical10.0 - CVE-2025-14700
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
Arcadia Technology, LLC · Crafty Controller
Critical9.9