Week 49, 2025

1–7 December 2025

New CVEs: 823
Critical: 62
High: 296
Newly exploited: 4
Advisories: 228
Malicious pkgs: 556

Newly exploited 4

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2025-55182 KEV Dec 5, 2025 · ransomware React Server Components are Vulnerable to RCE
Meta · react-server-dom-turbopack · react-server-dom-webpack · react-server-dom-parcel

EPSS 100%
High 8.8
CVE-2021-26828 KEV Dec 3, 2025 OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.…
EPSS 39%
High 7.8
CVE-2025-48572 KEV Dec 2, 2025 In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of pri…
Google · Android
Medium 5.5
CVE-2025-48633 KEV Dec 2, 2025 In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. …
Google · Android

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2025-55182 React Server Components are Vulnerable to RCE
Meta · react-server-dom-turbopack · react-server-dom-webpack · react-server-dom-parcel

EPSS 100%
Critical 9.4
CVE-2025-34291 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Langflow · Langflow

EPSS 93%
Critical 9.8
CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
hwk-fr · Advanced Custom Fields: Extended

EPSS 69%
Critical 9.8
CVE-2024-32641 Masa CMS Vulnerable to Pre-Auth RCE via JSON API
MasaCMS · MasaCMS

EPSS 13%
Critical 9.8
CVE-2025-29268 ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.
EPSS 9.1%
Critical 10.0
CVE-2025-13390 WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
listingthemes · WP Directory Kit

EPSS 4.7%
Critical 9.3
CVE-2025-34319 TOTOLINK N300RT <= V2.1.8-B20201030.1539 Boa formWsc RCE
Totolink · N300RT

EPSS 4.3%
Critical 9.8
CVE-2025-13342 Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
shabti · Frontend Admin by DynamiApps

EPSS 2.3%
Critical 9.8
CVE-2025-66401 MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
kapilduraphe · mcp-watch

EPSS 2.2%
Critical 9.8
CVE-2025-51683 A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request …
EPSS 2.1%
Critical 9.8
CVE-2025-29269 ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.
EPSS 2%
Critical 9.8
CVE-2025-51682 mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. A…
EPSS 1.7%
Critical 9.4
CVE-2025-11779 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
SGE-PLC1000 SGE-PLC50 · Circutor

EPSS 1.2%
Critical 9.8
CVE-2025-60854 A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web a…
EPSS 1.2%
Critical 9.1
CVE-2025-65346 alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
EPSS 1%

All 62 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.4
CVE-2025-66516 Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
Apache Software Foundation · Apache Tika PDF parser module · Apache Tika parsers · Apache Tika core

EPSS 89%
Medium 4.7
CVE-2025-14094 Edimax BR-6478AC V3 formSysCmd sub_44CCE4 os command injection
Edimax · BR-6478AC V3

EPSS 20%
Medium 4.7
CVE-2025-14093 Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injection
Edimax · BR-6478AC V3

EPSS 20%
High 8.8
CVE-2025-57201 AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server fu…
EPSS 17%
Medium 4.7
CVE-2025-14092 Edimax BR-6478AC V3 formDebugDiagnosticRun sub_416898 os command injection
Edimax · BR-6478AC V3

EPSS 17%
High 8.8
CVE-2025-13065 Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
brainstormforce · Starter Templates – AI-Powered Templates for Elementor & Gutenberg

EPSS 14%
High 8.8
CVE-2025-14107 ZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injection
ZSPACE · Q2C NAS

EPSS 12%
High 8.8
CVE-2025-14106 ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection
ZSPACE · Q2C NAS

EPSS 12%

Advisories

USN-7879-4 linux-gcp-6.14, linux-raspi vulnerabilities 200 CVEs
SUSE-SU-2025:4320-1 Security update for the Linux Kernel 196 CVEs
USN-7769-1 linux, linux-aws, linux-gcp, linux-gcp-6.14, linux-oracle, linux-realtime vulnerabilities 183 CVEs
USN-7910-2 linux-azure vulnerabilities 178 CVEs
USN-7909-4 linux-gcp, linux-gke, linux-gkeop vulnerabilities 178 CVEs
USN-7910-1 linux-azure-fips vulnerabilities 178 CVEs
USN-7909-3 linux-aws-fips, linux-fips, linux-gcp-fips vulnerabilities 178 CVEs
USN-7909-2 linux-intel-iot-realtime, linux-realtime vulnerabilities 178 CVEs
USN-7909-1 linux, linux-aws, linux-aws-5.15, linux-gcp-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx, linux-oracle, linux-oracle-5.15, linux-xilinx-zynqmp vulnerabilities 178 CVEs
USN-7774-1 linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-raspi, linux-xilinx-zynqmp vulnerabilities 142 CVEs