Overview of High-Risk Vulnerabilities Exploited in 2025
The cybersecurity landscape in 2025 experienced a significant surge in critical vulnerabilities, with over 21,500 CVEs disclosed in the first half of the year, marking a notable increase from previous years. Among these, several vulnerabilities were actively exploited in the wild, including critical flaws in Langflow (CVE-2025-3248), Microsoft SharePoint Server (CVE-2025-53770, 53771), Sudo (CVE-2025-32463), and Docker Desktop (CVE-2025-9074), each enabling attackers to compromise enterprise infrastructure, escalate privileges, or gain unauthorized access to sensitive systems. These vulnerabilities were highlighted for their technical severity, ease of exploitation, and real-world impact on organizations across various sectors, including government and finance.
In addition to these high-profile vulnerabilities, the WordPress ecosystem faced its own set of security challenges, with notable vulnerabilities in popular plugins such as Elementor Website Builder (CVE-2025-11220), WooCommerce (CVE-2025-15033), and All in One SEO (CVE-2025-64295). These flaws exposed millions of websites to risks such as cross-site scripting and sensitive data exposure, emphasizing the importance of timely patching and security updates. The overall trend in 2025 underscored the increasing sophistication and industrialization of cybercriminal operations, with attackers leveraging both newly discovered and well-known vulnerabilities to achieve widespread compromise and persistent access to targeted environments.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Security advisories urge immediate patching and compensating controls
At the end of 2025 and start of 2026, security researchers and news reporting emphasized that rapid exploitation of critical flaws was outpacing traditional patch management. Organizations and website owners were urged to apply updates quickly, use compensating controls such as firewalls, and strengthen continuous vulnerability monitoring.
Most affected WordPress plugins receive patches, while some remain unpatched
By the end of December 2025, most of the newly disclosed WordPress plugin vulnerabilities had been addressed in plugin updates. A few plugins remained unpatched, prompting recommendations to disable the plugin or use a web application firewall as mitigation.
Multiple 2025 vulnerabilities are exploited in the wild across major platforms
Throughout 2025, high-risk flaws affecting platforms such as Langflow, Microsoft SharePoint, Docker Desktop, Samsung devices, WhatsApp/Apple, React Server Components, FortiWeb, Unitree robots, and MongoDB were reported as actively exploited. Some attacks were linked to nation-state actors and ransomware groups targeting journalists, government agencies, and critical infrastructure.
Critical WordPress plugin vulnerabilities are disclosed during December 2025
In December 2025, numerous critical and high-risk vulnerabilities were disclosed in popular WordPress plugins including Elementor Website Builder, WooCommerce, All in One SEO, Starter Templates, Ninja Forms, and Advanced Custom Fields: Extended. The issues included XSS, sensitive data exposure, arbitrary file upload, RCE, SQL injection, broken access control, IDOR, and path traversal, with some flaws affecting more than 10 million installations and requiring no authentication.
First half of 2025 sees sharp rise in disclosed CVEs
In the first half of 2025, more than 21,500 CVEs were disclosed, representing a 16–18% increase over 2024. The increase reflected a broader surge in both the volume and severity of vulnerabilities affecting widely used technologies.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical Vulnerabilities and Exploitation Trends in 2025
Security researchers highlighted several high-impact vulnerabilities that shaped the threat landscape in 2025, including unauthenticated remote code execution flaws in widely used platforms such as React Server Components (CVE-2025-55182), SAP NetWeaver (CVE-2025-31324), PAN-OS (CVE-2025-0108), Cisco IOS XE (CVE-2025-20188), and Erlang/OTP SSH (CVE-2025-32433). These vulnerabilities were notable for their rapid exploitation following public disclosure, with attackers leveraging unauthenticated access and broad software reach to maximize impact. The year saw a shift in attacker focus, with perimeter devices and enterprise software becoming primary entry points, and defenders were forced to respond quickly as the window between disclosure and exploitation narrowed. In December 2025, Microsoft released one of its lightest Patch Tuesday updates, addressing 56 new CVEs. Despite the lower volume, security experts emphasized the importance of prioritizing vulnerabilities that were already exploited, publicly disclosed, or rated as critical with a high likelihood of exploitation. The analysis provided actionable intelligence for defenders, including technology-specific threat insights and resources for mitigating risk. The convergence of these trends underscored the need for rapid vulnerability management and highlighted recurring blind spots in enterprise defense strategies.
Mar 21, 2026
Record Surge in CVE Disclosures and Microsoft Vulnerabilities in 2025
In 2025, the cybersecurity landscape was marked by an unprecedented surge in vulnerability disclosures, with nearly 49,209 CVEs published—representing a 43% increase over the previous year. Microsoft alone issued mitigations for 1,246 CVEs, including 158 rated as critical, and faced 41 zero-day vulnerabilities. Security experts noted that while the volume of vulnerabilities reached new highs, the real risk stemmed from a small subset that were actively exploited, particularly those affecting Microsoft platforms and edge devices. Attackers increasingly leveraged AI and new tactics to exploit vulnerabilities faster, often timing attacks around Patch Tuesday cycles to maximize impact before organizations could apply updates. The overwhelming number of vulnerabilities forced security teams to rethink their prioritization strategies, as traditional severity ratings like CVSS proved insufficient for predicting exploitation. Instead, models such as the Exploit Prediction Scoring System (EPSS) and asset criticality became essential for identifying which vulnerabilities posed the greatest risk. State-sponsored actors and ransomware groups were responsible for a significant portion of exploitation activity, with remote code execution and privilege escalation flaws being the most targeted. Experts emphasized the need for rapid, risk-based patching and a shift away from patching solely based on severity scores, as attackers focused on speed, exposure, and critical assets rather than the sheer number of vulnerabilities disclosed.
Mar 21, 2026
Major Cybersecurity Incidents and Threat Trends in Late 2025
A surge of significant cybersecurity incidents and threat trends marked the end of 2025, with attackers exploiting both newly disclosed and longstanding vulnerabilities across diverse platforms. Notably, a critical vulnerability in MongoDB, tracked as CVE-2025-14847 and dubbed "MongoBleed," was actively exploited, putting over 87,000 instances at risk of data leakage. The year also saw the emergence of advanced Android malware like Frogblight, which targeted users through fraudulent apps to steal banking credentials and personal data, and a continued expansion of malware campaigns beyond Windows, affecting Android and macOS users with sophisticated banking Trojans and infostealers. Meanwhile, the fallout from the 2022 LastPass breach persisted, as attackers continued to crack stolen encrypted vaults and siphon cryptocurrency through 2025, leveraging Russian cybercrime infrastructure for laundering stolen funds. The threat landscape was further shaped by large-scale DDoS campaigns, such as those orchestrated by the pro-Russian group NoName057(16), which targeted hundreds of domains across Europe, and by the exploitation of vulnerabilities in widely used devices like WatchGuard Firebox firewalls (CVE-2025-14733). High-profile breaches, including those involving Salesforce integrations and third-party contractors, exposed sensitive data from major organizations. The year also witnessed a record number of Microsoft vulnerabilities, with attackers rapidly exploiting zero-days and privilege escalation flaws, underscoring the shrinking window between disclosure and exploitation. These developments highlight the increasing sophistication, scale, and persistence of cyber threats facing organizations worldwide as 2025 concluded.
Mar 21, 2026