By publication date

Exploited and new serious CVEs: December 2025

217 records · 23 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 3

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
24Monitor	CVE-2025-65442Proof of concept	DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code orxxyopen · novel · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.3%	Dec 29, 2025
31Monitor	CVE-2025-69200Proof of concept	phpMyFAQ has unauthenticated config backup download via /api/setup/backupphpmyfaq · phpmyfaq · CWE-202 Pre-auth	High7.5	—	2.1%	Dec 29, 2025
24Monitor	CVE-2025-14175Proof of concept	Weak Algorithm Support in SSH Server on TL-WR820Ntp-link · tl-wr820n firmware · CWE-327 Pre-auth Weak crypto	Medium6.0	—	0.2%	Dec 29, 2025
39Monitor	CVE-2025-68860Proof of concept	WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerabilitymobile builder · mobile builder · CWE-288 Pre-auth Auth bypass	Critical9.8	—	0.5%	Dec 29, 2025
15Monitor	CVE-2025-69015Proof of concept	WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerabilityautomattic · crowdsignal forms · CWE-862 Broken access control (IDOR)	Low3.8	—	0.3%	Dec 30, 2025
26Monitor	CVE-2025-65925Proof of concept	An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13.zeroheight · zeroheight · CWE-287 Pre-auth Auth bypass	Medium6.5	—	0.2%	Dec 30, 2025
49Plan	CVE-2025-68926Proof of concept	RustFS has a gRPC Hardcoded Token Authentication Bypassrustfs · rustfs · CWE-287 Pre-auth Auth bypass	Critical9.8	—	31.8%	Dec 30, 2025
31Monitor	CVE-2025-69256Proof of concept	serverless MCP Server vulnerable to command injection in list-projects toolserverless · serverless · CWE-77 pre-auth RCE Command injection	High7.5	—	2.3%	Dec 30, 2025
4Monitor	CVE-2025-69210Proof of concept	FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Uploadfacturascripts · facturascripts · CWE-79 XSS	Low1.2	—	0.9%	Dec 30, 2025
30Monitor	CVE-2025-66723Proof of concept	inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attainmusicbrands · engine dj desktop · CWE-732 Pre-auth	High7.5	—	0.4%	Dec 30, 2025
37Monitor	CVE-2025-15114No exploit	Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerabilitykseniasecurity · lares firmware · CWE-403 Pre-auth	Critical9.3	—	0.5%	Dec 30, 2025
17Monitor	CVE-2025-14783Proof of concept	Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectsmub · easy digital downloads – ecommerce payments and subscriptions made easy · CWE-640 Pre-auth	Medium4.3	—	0.3%	Dec 31, 2025
31Monitor	CVE-2025-15276Proof of concept	FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerabilityfontforge · fontforge · CWE-502 RCE Deserialization	High7.8	—	0.3%	Dec 31, 2025
28Monitor	CVE-2025-2026Proof of concept	The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a nullmoxa · nport 6100-g2/6200-g2 series · CWE-170	High7.1	—	0.4%	Dec 31, 2025
21Monitor	CVE-2025-59136Proof of concept	WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerabilityefí bank · gerencianet oficial · CWE-201 Pre-auth	Medium5.3	—	0.6%	Dec 31, 2025
21Monitor	CVE-2025-62126Proof of concept	WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerabilityrazvan stanga · varnish/nginx proxy caching · CWE-201 Pre-auth	Medium5.3	—	0.7%	Dec 31, 2025
35Monitor	CVE-2025-69286Proof of concept	RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerabilityinfiniflow · ragflow · CWE-340 Pre-auth Auth bypass	High8.9	—	0.7%	Dec 31, 2025

CVE-2025-65442
24Monitor
DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
- XSS
xxyopen · novelDec 29, 2025
CVE-2025-69200
31Monitor
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
phpmyfaq · phpmyfaqDec 29, 2025
CVE-2025-14175
24Monitor
Weak Algorithm Support in SSH Server on TL-WR820N
MediumCVSS 6.0Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
tp-link · tl-wr820n firmwareDec 29, 2025
CVE-2025-68860
39Monitor
WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
mobile builder · mobile builderDec 29, 2025
CVE-2025-69015
15Monitor
WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability
LowCVSS 3.8Proof of conceptEPSS 0%
- Broken access control (IDOR)
automattic · crowdsignal formsDec 30, 2025
CVE-2025-65925
26Monitor
An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
zeroheight · zeroheightDec 30, 2025
CVE-2025-68926
49Plan
RustFS has a gRPC Hardcoded Token Authentication Bypass
CriticalCVSS 9.8Proof of conceptEPSS 31%
- Pre-auth
- Auth bypass
rustfs · rustfsDec 30, 2025
CVE-2025-69256
31Monitor
serverless MCP Server vulnerable to command injection in list-projects tool
HighCVSS 7.5Proof of conceptEPSS 2%
- pre-auth RCE
- Command injection
serverless · serverlessDec 30, 2025
CVE-2025-69210
4Monitor
FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
LowCVSS 1.2Proof of conceptEPSS 0%
- XSS
facturascripts · facturascriptsDec 30, 2025
CVE-2025-66723
30Monitor
inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows atta
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
inmusicbrands · engine dj desktopDec 30, 2025
CVE-2025-15114
37Monitor
Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
kseniasecurity · lares firmwareDec 30, 2025
CVE-2025-14783
17Monitor
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
smub · easy digital downloads – ecommerce payments and subscriptions made easyDec 31, 2025
CVE-2025-15276
31Monitor
FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Deserialization
fontforge · fontforgeDec 31, 2025
CVE-2025-2026
28Monitor
The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null
HighCVSS 7.1Proof of conceptEPSS 0%
moxa · nport 6100-g2/6200-g2 seriesDec 31, 2025
CVE-2025-59136
21Monitor
WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
efí bank · gerencianet oficialDec 31, 2025
CVE-2025-62126
21Monitor
WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerability
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
razvan stanga · varnish/nginx proxy cachingDec 31, 2025
CVE-2025-69286
35Monitor
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
HighCVSS 8.9Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
infiniflow · ragflowDec 31, 2025