Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 52, 2025

22 December to 28 December 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
907
Critical
81
High
303
Added to KEV
1

Critical 81High 303Medium 266Low 23Not scored 234All 907 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2023-52163

    Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported…

    Product not named

    ExploitedHigh8.8

Most severe new CVEsBy CVSS score

  • CVE-2025-54322

    Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP…

    Xspeeder · SXZOS

    Critical10.0
  • CVE-2025-66209

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

    coollabsio · coolify

    Critical10.0
  • CVE-2025-14931

    Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability

    Hugging Face · smolagents

    Critical10.0
  • CVE-2025-66203

    StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection

    lemon8866 · StreamVault

    Critical10.0
  • CVE-2024-57521

    SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.

    Product not named

    Critical10.0
  • CVE-2025-67288

    An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is…

    Product not named

    Critical10.0
  • CVE-2025-67109

    Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with…

    Product not named

    Critical10.0
  • CVE-2025-67108

    eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.

    Product not named

    Critical10.0
  • CVE-2025-68668

    n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

    n8n-io · n8n

    Critical9.9
  • CVE-2025-68667

    Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

    continuwuity · continuwuity

    Critical9.9

Vendors with the most CVEs

  1. Linux340
  2. Tenda13
  3. Hugging Face11
  4. Tencent11
  5. IBM10
  6. RealDefense10
  7. Soda PDF10
  8. Gitea9
  9. Pexip9
  10. SOUND4 Ltd.8

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)83
  2. CWE-862 Missing authorization44
  3. CWE-89 SQL injection38
  4. CWE-352 Cross-site request forgery (CSRF)31
  5. CWE-74 Injection29
  6. CWE-502 Deserialization of untrusted data24
  7. CWE-119 Memory buffer bounds error23
  8. CWE-121 Stack-based buffer overflow22
  9. CWE-94 Code injection21
  10. CWE-306 Missing authentication for a critical function20