December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-14611 | Hard-Coded AES Keys in Gladinet CentreStack and Triofox Enable Unauthenticated LFI | 7.1 | 53% | KEVPoC | KEV |
| CVE-2025-20393 | Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands | 10.0 | 32% | KEV | KEV |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
| CVE-2025-8110 | Actively Exploited Path Traversal RCE in Gogs (PutContents API) | 8.7 | 85% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 172.233.67.176 | ound connections to suspicious IPs Known C2 infrastructure: 172.233.67.176, 172.237.29.147, 38.54.56.95 (inactive) CVE-2025-14611 | Gl |
| ipv4 | 172.237.29.147 | to suspicious IPs Known C2 infrastructure: 172.233.67.176, 172.237.29.147, 38.54.56.95 (inactive) CVE-2025-14611 | Gladinet CentreSta |
| ipv4 | 38.54.56.95 | Ps Known C2 infrastructure: 172.233.67.176, 172.237.29.147, 38.54.56.95 (inactive) CVE-2025-14611 | Gladinet CentreStack/Triofox Ri |
From the original article
6 min read at recordedfuture.com
December 2025 witnessed a dramatic 120% increase in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 22 vulnerabilities requiring immediate remediation, up from 10 in November. The month was dominated by widespread exploitation of Meta's React Server Components flaw.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.