# december 2025 > markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt). ![drybrush poster for december 2025, painted from 5,493 published cves](https://media.cvegen.art/posters/2025-12/1280.jpg?v=da5edbfeb4) what the poster shows: 31 days as bands of dry brush, the first day at the top. 14 ran above the 2025 average for their weekday and sweep fast and wide; the other 17 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else. the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-12.mp4?v=9dc6616474) | fact | value | | --- | --- | | cves | 5,493 | | against an average 2025 month | 1.4× | | busiest day | dec 9, 667 | | rated critical, cvss 9 or higher | 429 | | critical with no login and no click | 352 | | used in real attacks | 23 | ## december 2025 in numbers december 2025 brought 5,493 cves, 1.4 times an average 2025 month. 14 of its 31 days ran above the 2025 average for that weekday. - 667 on dec 9, the busiest day. - 429 rated critical, cvss 9 or higher. 352 of them can be hit over the network with no login and nothing for a user to click. - 784 came in three single drops: the linux kernel team 322 on dec 24, the linux kernel team 244 on dec 30, patchstack 218 on dec 18. ## 23 already used in real attacks cisa kev, as of oct 24, 2026. ### by product - 3 apple products, dec 12, 17 - 2 android framework, dec 8 - 1 meta react server components, dec 3 - 1 arrayos, dec 5 - 1 langflow, dec 5 - 1 fortinet products, dec 9 - 1 microsoft windows, dec 9 - 1 gogs, dec 10 - 1 gladinet centrestack and triofox, dec 12 - 1 google chromium, dec 12 - 1 hewlett packard enterprise oneview, dec 16 - 1 asus live update, dec 17 - 1 cisco products, dec 17 - 1 roundcube webmail, dec 18 - 1 sonicwall sma1000 appliance, dec 18 - 1 mongodb and mongodb server, dec 19 - 1 n8n, dec 19 - 1 watchguard firebox, dec 19 - 1 synacor zimbra collaboration suite, dec 22 - 1 smartertools smartermail, dec 29 ### every cve - dec 3, meta react server components, [cve-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182) - dec 5, langflow langflow, [cve-2025-34291](https://www.cve.org/CVERecord?id=CVE-2025-34291) - dec 5, array networks arrayos ag, [cve-2025-66644](https://www.cve.org/CVERecord?id=CVE-2025-66644) - dec 8, android framework, [cve-2025-48572](https://www.cve.org/CVERecord?id=CVE-2025-48572) - dec 8, android framework, [cve-2025-48633](https://www.cve.org/CVERecord?id=CVE-2025-48633) - dec 9, fortinet multiple products, [cve-2025-59718](https://www.cve.org/CVERecord?id=CVE-2025-59718) - dec 9, microsoft windows, [cve-2025-62221](https://www.cve.org/CVERecord?id=CVE-2025-62221) - dec 10, gogs gogs, [cve-2025-8110](https://www.cve.org/CVERecord?id=CVE-2025-8110) - dec 12, google chromium, [cve-2025-14174](https://www.cve.org/CVERecord?id=CVE-2025-14174) - dec 12, gladinet centrestack and triofox, [cve-2025-14611](https://www.cve.org/CVERecord?id=CVE-2025-14611) - dec 12, apple multiple products, [cve-2025-43510](https://www.cve.org/CVERecord?id=CVE-2025-43510) - dec 12, apple multiple products, [cve-2025-43520](https://www.cve.org/CVERecord?id=CVE-2025-43520) - dec 16, hewlett packard enterprise (hpe) oneview, [cve-2025-37164](https://www.cve.org/CVERecord?id=CVE-2025-37164) - dec 17, cisco multiple products, [cve-2025-20393](https://www.cve.org/CVERecord?id=CVE-2025-20393) - dec 17, apple multiple products, [cve-2025-43529](https://www.cve.org/CVERecord?id=CVE-2025-43529) - dec 17, asus live update, [cve-2025-59374](https://www.cve.org/CVERecord?id=CVE-2025-59374) - dec 18, sonicwall sma1000 appliance, [cve-2025-40602](https://www.cve.org/CVERecord?id=CVE-2025-40602) - dec 18, roundcube webmail, [cve-2025-68461](https://www.cve.org/CVERecord?id=CVE-2025-68461) - dec 19, watchguard firebox, [cve-2025-14733](https://www.cve.org/CVERecord?id=CVE-2025-14733) - dec 19, mongodb mongodb and mongodb server, [cve-2025-14847](https://www.cve.org/CVERecord?id=CVE-2025-14847) - dec 19, n8n n8n, [cve-2025-68613](https://www.cve.org/CVERecord?id=CVE-2025-68613) - dec 22, synacor zimbra collaboration suite (zcs), [cve-2025-68645](https://www.cve.org/CVERecord?id=CVE-2025-68645) - dec 29, smartertools smartermail, [cve-2025-52691](https://www.cve.org/CVERecord?id=CVE-2025-52691) cisa keeps adding older cves when attacks come to light, so this list can still grow. ## this poster | fact | value | | --- | --- | | period | december 1 to 31, 2025 | | cves | 5,493 | | data | cve list v5, cisa kev, drawn 2026-10-24 | | format | 3:4, drawn for 45 × 60 cm | [download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-12/2000.jpg?v=da5edbfeb4) ## other months - before: [november 2025](https://cvegen.art/2025/11.md), 3,020 cves - after: [january 2026](https://cvegen.art/2026/01.md), 4,302 cves - [all months](https://cvegen.art/index.md)