Week 49, 2025
1 December to 7 December 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 817CVEs publishedin the whole week
- 60CriticalCVSS 9.0 and above
- 289HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…
Meta · react-server-dom-webpack
ExploitedCritical10.0 - CVE-2021-26828
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via…
Product not named
ExploitedHigh8.8 - CVE-2025-48572
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of…
Google · Android
ExploitedHigh7.8 - CVE-2025-48633
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code.…
Google · Android
ExploitedMedium5.5
Most severe new CVEsBy CVSS score
- CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…
Meta · react-server-dom-webpack
ExploitedCritical10.0 - CVE-2025-13390
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
listingthemes · WP Directory Kit
Critical10.0 - CVE-2025-34256
Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass
Advantech Co., Ltd. · WISE-DeviceOn Server
Critical10.0 - CVE-2025-63531
A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize…
Product not named
Critical10.0 - CVE-2025-11778
Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
SGE-PLC1000 SGE-PLC50 · Circutor
Critical10.0 - CVE-2025-66570
cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)
yhirose · cpp-httplib
Critical10.0 - CVE-2025-66489
Cal.com Authentication Bypass via bad TOTP + password checks
calcom · cal.com
Critical9.9 - CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
hwk-fr · Advanced Custom Fields: Extended
Critical9.8 - CVE-2024-32641
Masa CMS Vulnerable to Pre-Auth RCE via JSON API
MasaCMS · MasaCMS
Critical9.8 - CVE-2025-29268
ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.
Product not named
Critical9.8