CVEs published December 1 to December 7, 2025
817 CVEs were published Dec 1 to Dec 7, 2025, 60 of them critical. CISA added 4 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 817
- Critical
- 60
- Added to CISA KEV
- 4
- Busiest day
- Tue, Dec 2 (177)
- Quietest day
- Sun, Dec 7 (23)
- December 1, 2025143 CVEs · 10 critical
- December 2, 2025177 CVEs · 17 critical
- December 3, 202594 CVEs · 11 critical
- December 4, 2025169 CVEs · 13 critical
- December 5, 2025145 CVEs · 7 critical
- December 6, 202566 CVEs · 2 critical
- December 7, 202523 CVEs
Added to CISA KEV 4
- CVE-2025-48572In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.Google Android
- CVE-2025-48633In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic Google Android
- CVE-2021-26828OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP f
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0…Meta react-server-dom-webpack · Meta react-server-dom-tu… +4