İçeriğe atla
Noroxi

Yayın tarihine göre

Aralık 2025: sömürülen ve yeni ciddi CVE kayıtları

217 kayıt · 23 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 3 / 3

  • CVE-2025-65442
    24İzleyin

    DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    xxyopen · novel29 Ara 2025

  • CVE-2025-69200
    31İzleyin

    phpMyFAQ has unauthenticated config backup download via /api/setup/backup

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    phpmyfaq · phpmyfaq29 Ara 2025

  • CVE-2025-14175
    24İzleyin

    Weak Algorithm Support in SSH Server on TL-WR820N

    OrtaCVSS 6,0Kavram kanıtıEPSS %0

    tp-link · tl-wr820n firmware29 Ara 2025

  • CVE-2025-68860
    39İzleyin

    WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    mobile builder · mobile builder29 Ara 2025

  • CVE-2025-69015
    15İzleyin

    WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability

    DüşükCVSS 3,8Kavram kanıtıEPSS %0

    automattic · crowdsignal forms30 Ara 2025

  • CVE-2025-65925
    26İzleyin

    An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    zeroheight · zeroheight30 Ara 2025

  • CVE-2025-68926
    49Planlayın

    RustFS has a gRPC Hardcoded Token Authentication Bypass

    KritikCVSS 9,8Kavram kanıtıEPSS %31

    rustfs · rustfs30 Ara 2025

  • CVE-2025-69256
    31İzleyin

    serverless MCP Server vulnerable to command injection in list-projects tool

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    serverless · serverless30 Ara 2025

  • CVE-2025-69210
    4İzleyin

    FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

    DüşükCVSS 1,2Kavram kanıtıEPSS %0

    facturascripts · facturascripts30 Ara 2025

  • CVE-2025-66723
    30İzleyin

    inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows atta

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    inmusicbrands · engine dj desktop30 Ara 2025

  • CVE-2025-15114
    37İzleyin

    Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability

    KritikCVSS 9,3İstismar yokEPSS %0

    kseniasecurity · lares firmware30 Ara 2025

  • CVE-2025-14783
    17İzleyin

    Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    smub · easy digital downloads – ecommerce payments and subscriptions made easy31 Ara 2025

  • CVE-2025-15276
    31İzleyin

    FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    fontforge · fontforge31 Ara 2025

  • CVE-2025-2026
    28İzleyin

    The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    moxa · nport 6100-g2/6200-g2 series31 Ara 2025

  • CVE-2025-59136
    21İzleyin

    WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    efí bank · gerencianet oficial31 Ara 2025

  • CVE-2025-62126
    21İzleyin

    WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerability

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    razvan stanga · varnish/nginx proxy caching31 Ara 2025

  • CVE-2025-69286
    35İzleyin

    RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

    YüksekCVSS 8,9Kavram kanıtıEPSS %0

    infiniflow · ragflow31 Ara 2025