Flaws added in December 2025
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in December 2025. For the newest, see Exploited flaws.
In December 2025, CISA added 20 flaws to its list of vulnerabilities being used in attacks, 9 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Android (2), MongoDB (1) and Digiever (1).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in December 2025, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-14847At work |
MongoDB and MongoDB Server. Attackers are using a flaw in MongoDB and MongoDB Server. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-52163At work |
Digiever DS-2105 Pro. Attackers can run commands on Digiever DS-2105 Pro. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-14733† Used in ransomwareAt work |
WatchGuard Firebox. Attackers can run their own code on WatchGuard Firebox from anywhere, without logging in. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-59374At home |
ASUS Live Update. A tampered release of ASUS Live Update was published with malicious code built in. | At home |
CVE-2025-40602At work |
SonicWall SMA1000 appliance. Someone who already has a foothold can use SonicWall SMA1000 appliance to take full control of the machine. | At work |
CVE-2025-20393At work |
Cisco products. Attackers can run commands on Cisco products from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-59718At work |
Fortinet products. Attackers are using a flaw in Fortinet products. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-43529At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2025-14611At work |
Gladinet CentreStack and Triofox. Attackers can read files on Gladinet CentreStack and Triofox that should be out of reach from anywhere, without logging in. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-14174At home |
Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over. | At home |
CVE-2018-4063At work |
Sierra Wireless AirLink ALEOS. Attackers can run their own code on Sierra Wireless AirLink ALEOS. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-58360At work |
OSGeo GeoServer. Attackers can read files on OSGeo GeoServer that should be out of reach. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-62221At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2025-6218At home |
WinRAR. A booby-trapped web page can run an attacker's code through WinRAR. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-66644At work |
Array Networks ArrayOS AG. Attackers can run commands on Array Networks ArrayOS AG. | At work |
CVE-2022-37055At home |
D-Link Routers. Attackers can corrupt memory in D-Link Routers, which they use to take it over. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-55182† Used in ransomwareAt home |
Meta React Server Components. Attackers can run their own code on Meta React Server Components from anywhere, without logging in. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2021-26828At work |
OpenPLC ScadaBR. Attackers can upload a file to OpenPLC ScadaBR and make it run. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-48633At home |
Android Framework. Someone who already has a foothold can use Android Framework to take full control of the machine. | At home |
CVE-2025-48572At home |
Android Framework. Someone who already has a foothold can use Android Framework to take full control of the machine. | At home |
Companies
The flaws were in 19 companies’ products; the most were in Android’s (2).
| Company | Flaws | Ransomware |
|---|---|---|
| Android | 2 | – |
| Apple | 1 | – |
| Array Networks | 1 | – |
| ASUS | 1 | – |
| Cisco | 1 | – |
| D-Link | 1 | – |
| Digiever | 1 | – |
| Fortinet | 1 | – |
| Gladinet | 1 | – |
| 1 | – | |
| Meta | 1 | 1 |
| Microsoft | 1 | – |
| MongoDB | 1 | – |
| OpenPLC | 1 | – |
| OSGeo | 1 | – |
| 4 others | 4 |
Other months
Every month since CISA started the list; December 2025 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.