Week 1, 2026
29 December to 4 January 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 930CVEs publishedin the whole week
- 55CriticalCVSS 9.0 and above
- 228HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
MongoDB Inc. · MongoDB Server
ExploitedHigh8.7
Most severe new CVEsBy CVSS score
- CVE-2025-52691
Upload Arbitrary Files
SmarterTools · SmarterMail
ExploitedCritical10.0 - CVE-2025-64121
Nuvation Energy Multi-Stack Controller Authentication Bypass
Nuvation Energy · Multi-Stack Controller (MSC)
Critical10.0 - CVE-2025-68562
WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerability
RomanCode · MapSVG
Critical9.9 - CVE-2025-68897
WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability
Mohammad I. Okfie · IF AS Shortcode
Critical9.9 - CVE-2025-68926
RustFS has a gRPC Hardcoded Token Authentication Bypass
rustfs · rustfs
Critical9.8 - CVE-2025-68706
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting…
Product not named
Critical9.8 - CVE-2025-14998
Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover
wpmudev · Branda – White Label & Branding, Free Login Page Customizer
Critical9.8 - CVE-2025-66848
JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier),…
Product not named
Critical9.8 - CVE-2025-67268
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which…
Product not named
Critical9.8 - CVE-2023-54257
net: macb: fix a memory corruption in extended buffer descriptor mode
Linux · Linux
Critical9.8