❌

Reading view

↗️

Flashpoint Weekly Vulnerability Insights and Prioritization Report

✇Threat Intelligence Blog | Flashpoint
By: Flashpoint Intel Team

Blogs

Blog

Flashpoint Weekly Vulnerability Insights and Prioritization Report

Week of December 20 – December 26, 2025

Anticipate, contextualize, and prioritize vulnerabilities to effectively address threats to your organization.

SHARE THIS:
Default Author Image
December 31, 2025

Flashpoint’s VulnDB™ documents over 400,000 vulnerabilities and has over 6,000 entries in Flashpoint’s KEV database, making it a critical resource as vulnerability exploitation rises. However, if your organization is relying solely on CVE data, you may be missing critical vulnerability metadata and insights that hinder timely remediation. That’s why we created this weekly series—where we surface and analyze the most high priority vulnerabilities security teams need to know about.

Key Vulnerabilities:
Week of December 20 – December 26, 2025

Foundational Prioritization

Of the vulnerabilities Flashpoint published this week, there are 34 that you can take immediate action on. They each have a solution, a public exploit exists, and are remotely exploitable. As such, these vulnerabilities are a great place to begin your prioritization efforts.

Diving Deeper – Urgent Vulnerabilities

Of the vulnerabilities Flashpoint published last week, four are highlighted in this week’s Vulnerability Insights and Prioritization Report because they contain one or more of the following criteria:

  • Are in widely used products and are potentially enterprise-affecting
  • Are exploited in the wild or have exploits available
  • Allow full system compromise
  • Can be exploited via the network alone or in combination with other vulnerabilities
  • Have a solution to take action on

In addition, all of these vulnerabilities are easily discoverable and therefore should be investigated and fixed immediately.

To proactively address these vulnerabilities and ensure comprehensive coverage beyond publicly available sources on an ongoing basis, organizations can leverage Flashpoint Vulnerability Intelligence. Flashpoint provides comprehensive coverage encompassing IT, OT, IoT, CoTs, and open-source libraries and dependencies. It catalogs over 100,000 vulnerabilities that are not included in the NVD or lack a CVE ID, ensuring thorough coverage beyond publicly available sources. The vulnerabilities that are not covered by the NVD do not yet have CVE ID assigned and will be noted with a VulnDB ID.

CVE IDTitleCVSS Scores (v2, v3, v4)Exploit StatusExploit ConsequenceRansomware Likelihood ScoreSocial Risk ScoreSolution Availability
CVE-2025-33222NVIDIA Isaac Launchable Unspecified Hardcoded Credentials5.0
9.8
9.3		PrivateCredential DisclosureHighLowYes
CVE-2025-33223NVIDIA Isaac Launchable Unspecified Improper Execution Privileges Remote Code Execution10.0
9.8
9.3		PrivateRemote Code ExecutionHighLowYes
CVE-2025-68613n8n Package for Node.js packages/workflow/src/expression-evaluator-proxy.ts Workflow Expression Evaluation Remote Code Execution9.0
9.9
9.4		PublicRemote Code ExecutionHighHighYes
CVE-2025-14847MongoDB transport/message_compressor_zlib.cpp ZlibMessageCompressor::decompressData() Function Zlib Compressed Protocol Header Handling Remote Uninitialized Memory Disclosure (Mongobleed)10.0
9.8
9.3		PublicUninitialized Memory DisclosureHighHighYes
Scores as of: December 30, 2025

NOTES: The severity of a given vulnerability score can change whenever new information becomes available. Flashpoint maintains its vulnerability database with the most recent and relevant information available. Login to view more vulnerability metadata and for the most up-to-date information.

CVSS scores: Our analysts calculate, and if needed, adjust NVD’s original CVSS scores based on new information being available.

Social Risk Score: Flashpoint estimates how much attention a vulnerability receives on social media. Increased mentions and discussions elevate the Social Risk Score, indicating a higher likelihood of exploitation. The score considers factors like post volume and authors, and decreases as the vulnerability’s relevance diminishes.

Ransomware Likelihood: This score is a rating that estimates the similarity between a vulnerability and those known to be used in ransomware attacks. As we learn more information about a vulnerability (e.g. exploitation method, technology affected) and uncover additional vulnerabilities used in ransomware attacks, this rating can change.

Flashpoint Ignite lays all of these components out. Below is an example of what this vulnerability record for CVE-2025-33223 looks like.



This record provides additional metadata like affected product versions, MITRE ATT&CK mapping, analyst notes, solution description, classifications, vulnerability timeline and exposure metrics, exploit references and more.

Analyst Comments on the Notable Vulnerabilities

Below, Flashpoint analysts describe the five vulnerabilities highlighted above as vulnerabilities that should be of focus for remediation if your organization is exposed.

CVE-2025-33222

NVIDIA Isaac Launchable contains a flaw that is triggered by the use of unspecified hardcoded credentials. This may allow a remote attacker to trivially gain privileged access to the program.

CVE-2025-33223

NVIDIA Isaac Launchable contains an unspecified flaw that is triggered as certain activities are executed with unnecessary privileges. This may allow a remote attacker to potentially execute arbitrary code.

CVE-2025-68613

n8n Package for Node.js contains a flaw in packages/workflow/src/expression-evaluator-proxy.ts that is triggered as workflow expressions are evaluated in an improperly isolated execution context. This may allow an authenticated, remote attacker to execute arbitrary code with the privileges of the n8n process.

CVE-2025-14847

MongoDB contains a flaw in the ZlibMessageCompressor::decompressData() function in mongo/transport/message_compressor_zlib.cpp that is triggered when handling mismatched length fields in Zlib compressed protocol headers. This may allow a remote attacker to disclose uninitialized memory contents on the heap.

Previously Highlighted Vulnerabilities

CVE/VulnDB IDFlashpoint Published Date
CVE-2025-21218Week of January 15, 2025
CVE-2024-57811Week of January 15, 2025
CVE-2024-55591Week of January 15, 2025
CVE-2025-23006Week of January 22, 2025
CVE-2025-20156Week of January 22, 2025
CVE-2024-50664Week of January 22, 2025
CVE-2025-24085Week of January 29, 2025
CVE-2024-40890Week of January 29, 2025
CVE-2024-40891Week of January 29, 2025
VulnDB ID: 389414Week of January 29, 2025
CVE-2025-25181Week of February 5, 2025
CVE-2024-40890Week of February 5, 2025
CVE-2024-40891Week of February 5, 2025
CVE-2024-8266Week of February 12, 2025
CVE-2025-0108Week of February 12, 2025
CVE-2025-24472Week of February 12, 2025
CVE-2025-21355Week of February 24, 2025
CVE-2025-26613Week of February 24, 2025
CVE-2024-13789Week of February 24, 2025
CVE-2025-1539Week of February 24, 2025
CVE-2025-27364Week of March 3, 2025
CVE-2025-27140Week of March 3, 2025
CVE-2025-27135Week of March 3, 2025
CVE-2024-8420Week of March 3, 2025
CVE-2024-56196Week of March 10, 2025
CVE-2025-27554Week of March 10, 2025
CVE-2025-22224Week of March 10, 2025
CVE-2025-1393Week of March 10, 2025
CVE-2025-24201Week of March 17, 2025
CVE-2025-27363Week of March 17, 2025
CVE-2025-2000Week of March 17, 2025
CVE-2025-27636
CVE-2025-29891		Week of March 17, 2025
CVE-2025-1496
Week of March 24, 2025
CVE-2025-27781Week of March 24, 2025
CVE-2025-29913Week of March 24, 2025
CVE-2025-2746Week of March 24, 2025
CVE-2025-29927Week of March 24, 2025
CVE-2025-1974 CVE-2025-2787Week of March 31, 2025
CVE-2025-30259Week of March 31, 2025
CVE-2025-2783Week of March 31, 2025
CVE-2025-30216Week of March 31, 2025
CVE-2025-22457Week of April 2, 2025
CVE-2025-2071Week of April 2, 2025
CVE-2025-30356Week of April 2, 2025
CVE-2025-3015Week of April 2, 2025
CVE-2025-31129Week of April 2, 2025
CVE-2025-3248Week of April 7, 2025
CVE-2025-27797Week of April 7, 2025
CVE-2025-27690Week of April 7, 2025
CVE-2025-32375Week of April 7, 2025
VulnDB ID: 398725Week of April 7, 2025
CVE-2025-32433Week of April 12, 2025
CVE-2025-1980Week of April 12, 2025
CVE-2025-32068Week of April 12, 2025
CVE-2025-31201Week of April 12, 2025
CVE-2025-3495Week of April 12, 2025
CVE-2025-31324Week of April 17, 2025
CVE-2025-42599Week of April 17, 2025
CVE-2025-32445Week of April 17, 2025
VulnDB ID: 400516Week of April 17, 2025
CVE-2025-22372Week of April 17, 2025
CVE-2025-32432Week of April 29, 2025
CVE-2025-24522Week of April 29, 2025
CVE-2025-46348Week of April 29, 2025
CVE-2025-43858Week of April 29, 2025
CVE-2025-32444Week of April 29, 2025
CVE-2025-20188Week of May 3, 2025
CVE-2025-29972Week of May 3, 2025
CVE-2025-32819Week of May 3, 2025
CVE-2025-27007Week of May 3, 2025
VulnDB ID: 402907Week of May 3, 2025
VulnDB ID: 405228Week of May 17, 2025
CVE-2025-47277Week of May 17, 2025
CVE-2025-34027Week of May 17, 2025
CVE-2025-47646Week of May 17, 2025
VulnDB ID: 405269Week of May 17, 2025
VulnDB ID: 406046Week of May 19, 2025
CVE-2025-48926Week of May 19, 2025
CVE-2025-47282Week of May 19, 2025
CVE-2025-48054Week of May 19, 2025
CVE-2025-41651Week of May 19, 2025
CVE-2025-20289Week of June 3, 2025
CVE-2025-5597Week of June 3, 2025
CVE-2025-20674Week of June 3, 2025
CVE-2025-5622Week of June 3, 2025
CVE-2025-5419Week of June 3, 2025
CVE-2025-33053Week of June 7, 2025
CVE-2025-5353Week of June 7, 2025
CVE-2025-22455Week of June 7, 2025
CVE-2025-43200Week of June 7, 2025
CVE-2025-27819Week of June 7, 2025
CVE-2025-49132Week of June 13, 2025
CVE-2025-49136Week of June 13, 2025
CVE-2025-50201Week of June 13, 2025
CVE-2025-49125Week of June 13, 2025
CVE-2025-24288Week of June 13, 2025
CVE-2025-6543Week of June 21, 2025
CVE-2025-3699Week of June 21, 2025
CVE-2025-34046Week of June 21, 2025
CVE-2025-34036Week of June 21, 2025
CVE-2025-34044Week of June 21, 2025
CVE-2025-7503Week of July 12, 2025
CVE-2025-6558Week of July 12, 2025
VulnDB ID: 411705Week of July 12, 2025
VulnDB ID: 411704Week of July 12, 2025
CVE-2025-6222Week of July 12, 2025
CVE-2025-54309Week of July 18, 2025
CVE-2025-53771Week of July 18, 2025
CVE-2025-53770Week of July 18, 2025
CVE-2025-54122Week of July 18, 2025
CVE-2025-52166Week of July 18, 2025
CVE-2025-53942Week of July 25, 2025
CVE-2025-46811Week of July 25, 2025
CVE-2025-52452Week of July 25, 2025
CVE-2025-41680Week of July 25, 2025
CVE-2025-34143Week of July 25, 2025
CVE-2025-50454Week of August 1, 2025
CVE-2025-8875Week of August 1, 2025
CVE-2025-8876Week of August 1, 2025
CVE-2025-55150Week of August 1, 2025
CVE-2025-25256Week of August 1, 2025
CVE-2025-43300Week of August 16, 2025
CVE-2025-34153Week of August 16, 2025
CVE-2025-48148Week of August 16, 2025
VulnDB ID: 416058Week of August 16, 2025
CVE-2025-32992Week of August 16, 2025
CVE-2025-7775Week of August 24, 2025
CVE-2025-8424Week of August 24, 2025
CVE-2025-34159Week of August 24, 2025
CVE-2025-57819Week of August 24, 2025
CVE-2025-7426Week of August 24, 2025
CVE-2025-58367Week of September 1, 2025
CVE-2025-58159Week of September 1, 2025
CVE-2025-58048Week of September 1, 2025
CVE-2025-39247Week of September 1, 2025
CVE-2025-8857Week of September 1, 2025
CVE-2025-58321Week of September 8, 2025
CVE-2025-58366Week of September 8, 2025
CVE-2025-58371Week of September 8, 2025
CVE-2025-55728Week of September 8, 2025
CVE-2025-55190Week of September 8, 2025
VulnDB ID: 419253Week of September 13, 2025
CVE-2025-10035Week of September 13, 2025
CVE-2025-59346Week of September 13, 2025
CVE-2025-55727Week of September 13, 2025
CVE-2025-10159Week of September 13, 2025
CVE-2025-20363Week of September 20, 2025
CVE-2025-20333Week of September 20, 2025
CVE-2022-4980Week of September 20, 2025
VulnDB ID: 420451Week of September 20, 2025
CVE-2025-9900Week of September 20, 2025
CVE-2025-52906Week of September 27, 2025
CVE-2025-51495Week of September 27, 2025
CVE-2025-27224Week of September 27, 2025
CVE-2025-27223Week of September 27, 2025
CVE-2025-54875Week of September 27, 2025
CVE-2025-41244Week of September 27, 2025
CVE-2025-61928Week of October 6, 2025
CVE-2025-61882Week of October 6, 2025
CVE-2025-49844Week of October 6 2025
CVE-2025-57870Week of October 6, 2025
CVE-2025-34224Week of October 6, 2025
CVE-2025-34222Week of October 6, 2025
CVE-2025-40765Week of October 11, 2025
CVE-2025-59230Week of October 11, 2025
CVE-2025-24990Week of October 11, 2025
CVE-2025-61884Week of October 11, 2025
CVE-2025-41430Week of October 11, 2025
VulnDB ID: 424051Week of October 18, 2025
CVE-2025-62645Week of October 18, 2025
CVE-2025-61932Week of October 18, 2025
CVE-2025-59503Week of October 18, 2025
CVE-2025-43995Week of October 18, 2025
CVE-2025-62168Week of October 18, 2025
VulnDB ID: 425182Week of October 25, 2025
CVE-2025-62713Week of October 25, 2025
CVE-2025-54964Week of October 25, 2025
CVE-2024-58274Week of October 25, 2025
CVE-2025-41723Week of October 25, 2025
CVE-2025-20354Week of November 1, 2025
CVE-2025-11953Week of November 1, 2025
CVE-2025-60854Week of November 1, 2025
CVE-2025-64095Week of November 1, 2025
CVE-2025-11833Week of November 1, 2025
CVE-2025-64446Week of November 8, 2025
CVE-2025-36250Week of November 8, 2025
CVE-2025-64400Week of November 8, 2025
CVE-2025-12686Week of November 8, 2025
CVE-2025-59118Week of November 8, 2025
VulnDB ID: 426231Week of November 8, 2025
VulnDB ID: 427979Week of November 22, 2025
CVE-2025-55796Week of November 22, 2025
CVE-2025-64428Week of November 22, 2025
CVE-2025-62703Week of November 22, 2025
VulnDB ID: 428193Week of November 22, 2025
CVE-2025-65018Week of November 22, 2025
CVE-2025-54347Week of November 22, 2025
CVE-2025-55182Week of November 29, 2025
CVE-2024-14007Week of November 29, 2025
CVE-2025-66399Week of November 29, 2025
CVE-2022-35420Week of November 29, 2025
CVE-2025-66516Week of November 29, 2025
CVE-2025-59366Week of November 29, 2025
CVE-2025-14174Week of December 6, 2026
CVE-2025-43529Week of December 6, 2026
CVE-2025-8110Week of December 6, 2026
CVE-2025-59719Week of December 6, 2026
CVE-2025-59718Week of December 6, 2026
CVE-2025-14087Week of December 6, 2026
CVE-2025-62221Week of December 6, 2026

Transform Vulnerability Management with Flashpoint

Request a demo today to see how Flashpoint can transform your vulnerability intelligence, vulnerability management, and exposure identification program.

Request a demo today.

  •  
  • ↗️
❌