Zero-day report: December 2025
CISA added 20 exploited vulnerabilities to its catalog in December 2025, 9 more than November (11). 13 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Android, with 2.
By technology
Most-hit vendors
Every flaw added in December 2025
- MongoDB · MongoDB and MongoDB ServerMongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
- Digiever · DS-2105 ProDigiever DS-2105 Pro Missing Authorization Vulnerability
- WatchGuard · FireboxWatchGuard Firebox Out of Bounds Write Vulnerability
- Cisco · Multiple ProductsCisco Multiple Products Improper Input Validation Vulnerability
- SonicWall · SMA1000 applianceSonicWall SMA1000 Missing Authorization Vulnerability
- ASUS · Live UpdateASUS Live Update Embedded Malicious Code Vulnerability
- Fortinet · Multiple ProductsFortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
- Gladinet · CentreStack and TriofoxGladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
- Apple · Multiple ProductsApple Multiple Products Use-After-Free WebKit Vulnerability
- Sierra Wireless · AirLink ALEOSSierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
- Google · ChromiumGoogle Chromium Out of Bounds Memory Access Vulnerability
- OSGeo · GeoServerOSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
- RARLAB · WinRARRARLAB WinRAR Path Traversal Vulnerability
- Microsoft · WindowsMicrosoft Windows Use After Free Vulnerability
- D-Link · RoutersD-Link Routers Buffer Overflow Vulnerability
- Array Networks · ArrayOS AGArray Networks ArrayOS AG OS Command Injection Vulnerability
- Meta · React Server ComponentsMeta React Server Components Remote Code Execution Vulnerability
- OpenPLC · ScadaBROpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
- Android · FrameworkAndroid Framework Privilege Escalation Vulnerability
- Android · FrameworkAndroid Framework Information Disclosure Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.