По дате публикации
Эксплуатируемые и новые серьёзные CVE: декабрь 2025 г.
218 записей · 23 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 3 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
26Наблюдать | CVE-2025-60458Proof of concept | UxPlay 1.72 contains a double free vulnerability in its RTSP request handling.antimof · uxplay · CWE-400 | Средняя6,5 | — | 0,3 % | 29 дек. 2025 г. |
24Наблюдать | CVE-2025-65442Proof of concept | DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code orxxyopen · novel · CWE-79 | Средняя6,1 | — | 0,3 % | 29 дек. 2025 г. |
31Наблюдать | CVE-2025-69200Proof of concept | phpMyFAQ has unauthenticated config backup download via /api/setup/backupphpmyfaq · phpmyfaq · CWE-202 | Высокая7,5 | — | 2,1 % | 29 дек. 2025 г. |
24Наблюдать | CVE-2025-14175Proof of concept | Weak Algorithm Support in SSH Server on TL-WR820Ntp-link · tl-wr820n firmware · CWE-327 | Средняя6,0 | — | 0,2 % | 29 дек. 2025 г. |
39Наблюдать | CVE-2025-68860Proof of concept | WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerabilitymobile builder · mobile builder · CWE-288 | Критическая9,8 | — | 0,5 % | 29 дек. 2025 г. |
15Наблюдать | CVE-2025-69015Proof of concept | WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerabilityautomattic · crowdsignal forms · CWE-862 | Низкая3,8 | — | 0,3 % | 30 дек. 2025 г. |
26Наблюдать | CVE-2025-65925Proof of concept | An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13.zeroheight · zeroheight · CWE-287 | Средняя6,5 | — | 0,2 % | 30 дек. 2025 г. |
49В плане | CVE-2025-68926Proof of concept | RustFS has a gRPC Hardcoded Token Authentication Bypassrustfs · rustfs · CWE-287 | Критическая9,8 | — | 31,8 % | 30 дек. 2025 г. |
31Наблюдать | CVE-2025-69256Proof of concept | serverless MCP Server vulnerable to command injection in list-projects toolserverless · serverless · CWE-77 | Высокая7,5 | — | 2,3 % | 30 дек. 2025 г. |
4Наблюдать | CVE-2025-69210Proof of concept | FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Uploadfacturascripts · facturascripts · CWE-79 | Низкая1,2 | — | 0,9 % | 30 дек. 2025 г. |
30Наблюдать | CVE-2025-66723Proof of concept | inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attainmusicbrands · engine dj desktop · CWE-732 | Высокая7,5 | — | 0,4 % | 30 дек. 2025 г. |
37Наблюдать | CVE-2025-15114Эксплойта нет | Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerabilitykseniasecurity · lares firmware · CWE-403 | Критическая9,3 | — | 0,5 % | 30 дек. 2025 г. |
17Наблюдать | CVE-2025-14783Proof of concept | Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectsmub · easy digital downloads – ecommerce payments and subscriptions made easy · CWE-640 | Средняя4,3 | — | 0,3 % | 31 дек. 2025 г. |
31Наблюдать | CVE-2025-15276Proof of concept | FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerabilityfontforge · fontforge · CWE-502 | Высокая7,8 | — | 0,3 % | 31 дек. 2025 г. |
28Наблюдать | CVE-2025-2026Proof of concept | The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a nullmoxa · nport 6100-g2/6200-g2 series · CWE-170 | Высокая7,1 | — | 0,4 % | 31 дек. 2025 г. |
21Наблюдать | CVE-2025-59136Proof of concept | WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerabilityefí bank · gerencianet oficial · CWE-201 | Средняя5,3 | — | 0,6 % | 31 дек. 2025 г. |
21Наблюдать | CVE-2025-62126Proof of concept | WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerabilityrazvan stanga · varnish/nginx proxy caching · CWE-201 | Средняя5,3 | — | 0,7 % | 31 дек. 2025 г. |
35Наблюдать | CVE-2025-69286Proof of concept | RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerabilityinfiniflow · ragflow · CWE-340 | Высокая8,9 | — | 0,7 % | 31 дек. 2025 г. |
- CVE-2025-6045826Наблюдать
UxPlay 1.72 contains a double free vulnerability in its RTSP request handling.
СредняяCVSS 6,5Proof of conceptEPSS 0 %antimof · uxplay29 дек. 2025 г.
- CVE-2025-6544224Наблюдать
DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or
СредняяCVSS 6,1Proof of conceptEPSS 0 %xxyopen · novel29 дек. 2025 г.
- CVE-2025-6920031Наблюдать
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %phpmyfaq · phpmyfaq29 дек. 2025 г.
- CVE-2025-1417524Наблюдать
Weak Algorithm Support in SSH Server on TL-WR820N
СредняяCVSS 6,0Proof of conceptEPSS 0 %tp-link · tl-wr820n firmware29 дек. 2025 г.
- CVE-2025-6886039Наблюдать
WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %mobile builder · mobile builder29 дек. 2025 г.
- CVE-2025-6901515Наблюдать
WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability
НизкаяCVSS 3,8Proof of conceptEPSS 0 %automattic · crowdsignal forms30 дек. 2025 г.
- CVE-2025-6592526Наблюдать
An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13.
СредняяCVSS 6,5Proof of conceptEPSS 0 %zeroheight · zeroheight30 дек. 2025 г.
- CVE-2025-6892649В плане
RustFS has a gRPC Hardcoded Token Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 31 %rustfs · rustfs30 дек. 2025 г.
- CVE-2025-6925631Наблюдать
serverless MCP Server vulnerable to command injection in list-projects tool
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %serverless · serverless30 дек. 2025 г.
- CVE-2025-692104Наблюдать
FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
НизкаяCVSS 1,2Proof of conceptEPSS 0 %facturascripts · facturascripts30 дек. 2025 г.
- CVE-2025-6672330Наблюдать
inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows atta
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %inmusicbrands · engine dj desktop30 дек. 2025 г.
- CVE-2025-1511437Наблюдать
Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability
КритическаяCVSS 9,3Эксплойта нетEPSS 0 %kseniasecurity · lares firmware30 дек. 2025 г.
- CVE-2025-1478317Наблюдать
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
СредняяCVSS 4,3Proof of conceptEPSS 0 %smub · easy digital downloads – ecommerce payments and subscriptions made easy31 дек. 2025 г.
- CVE-2025-1527631Наблюдать
FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %fontforge · fontforge31 дек. 2025 г.
- CVE-2025-202628Наблюдать
The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %moxa · nport 6100-g2/6200-g2 series31 дек. 2025 г.
- CVE-2025-5913621Наблюдать
WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability
СредняяCVSS 5,3Proof of conceptEPSS 0 %efí bank · gerencianet oficial31 дек. 2025 г.
- CVE-2025-6212621Наблюдать
WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerability
СредняяCVSS 5,3Proof of conceptEPSS 0 %razvan stanga · varnish/nginx proxy caching31 дек. 2025 г.
- CVE-2025-6928635Наблюдать
RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
ВысокаяCVSS 8,9Proof of conceptEPSS 0 %infiniflow · ragflow31 дек. 2025 г.