Week 1, 2026

29 December to 4 January 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 930
Critical: 55
High: 228
Added to KEV: 1

Critical 55High 228Medium 427Low 36Not scored 184All 930 in the list

Added to KEVAttackers use these now; patch them first

CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
MongoDB Inc. · MongoDB Server
ExploitedHigh8.7

Most severe new CVEsBy CVSS score

CVE-2025-52691
Upload Arbitrary Files
SmarterTools · SmarterMail
ExploitedCritical10.0
CVE-2025-64121
Nuvation Energy Multi-Stack Controller Authentication Bypass
Nuvation Energy · Multi-Stack Controller (MSC)
Critical10.0
CVE-2025-68562
WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability
RomanCode · MapSVG
Critical9.9
CVE-2025-68897
WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability
Mohammad I. Okfie · IF AS Shortcode
Critical9.9
CVE-2025-68926
RustFS has a gRPC Hardcoded Token Authentication Bypass
rustfs · rustfs
Critical9.8
CVE-2025-68706
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting…
Product not named
Critical9.8
CVE-2025-14998
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
wpmudev · Branda – White Label & Branding, Free Login Page Customizer
Critical9.8
CVE-2025-66848
JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier),…
Product not named
Critical9.8
CVE-2025-67268
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which…
Product not named
Critical9.8
CVE-2023-54257
net: macb: fix a memory corruption in extended buffer descriptor mode
Linux · Linux
Critical9.8

Week 1, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses