CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- kde messagelib KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe... 3.4 Low
- esri arcgis server Reflected XSS vulnerability in ArcGIS Server. 6.1 Medium
- esri arcgis server Stored XSS vulnerability in ArcGIS Server 6.1 Medium
- esri arcgis server There is a cross site scripting issue in ArcGIS Server. 6.1 Medium
- esri arcgis server Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server. 6.1 Medium
- esri arcgis server Unvalidated File Upload vulnerability in ArcGIS Server. 5.6 Medium
- esri arcgis server Unvalidated File Upload vulnerability in ArcGIS Server. 5.6 Medium
- esri arcgis server Reflected XSS vulnerability in ArcGIS Server. 6.1 Medium
- esri arcgis server Stored XSS vulnerability in ArcGIS Server. 6.1 Medium
- esri arcgis server Stored XSS vulnerability in ArcGIS Server. 6.1 Medium
-
trixnpm,action_text-trixRubyGems +1 more Trix has a stored XSS vulnerability through its attachment attribute 4.6 Medium - uasoft badaso Uasoft badaso Token BadasoAuthController.php forgetPassword password recovery 6.3 Medium
- kromit titra Titra has Remote Code Execution in Admin Functionality 9.1 Critical
- infiniflow ragflow RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability 8.9 High
- infiniflow ragflow RAGFlow Remote Code Execution Vulnerability 8.6 High
- pkrystian full-stack-bank PKrystian Full-Stack-Bank User sql injection 5.1 Medium
- gargoyle router management utility, gargoyle-router gargoyle +1 more Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh 8.7 High
- osuthorpe easy social WordPress Easy Social plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability 7.1 High
- uxper sala WordPress Sala theme <= 1.1.3 - Cross Site Scripting (XSS) vulnerability 7.1 High
- nebelhorn blappsta mobile app plugin – your native, mobile iphone app and android app WordPress Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin <= 0.8.8.8 - Cross Site Scripting (XSS) Vulnerability 7.1 High
- zoomsounds WordPress ZoomSounds plugin <= 6.91 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
- themefy bloggie WordPress Bloggie theme <= 2.0.8 - Cross Site Scripting (XSS) Vulnerability 7.1 High
- aa-team amazon affiliates addon for wpbakery page builder (formerly visual composer) WordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection Vulnerability 8.5 High
- aa-team pro bulk watermark plugin for wordpress WordPress Pro Bulk Watermark Plugin for WordPress <= 2.0 - Path Traversal Vulnerability 6.5 Medium
- codedraft mediabay - wordpress media library folders WordPress Mediabay - WordPress Media Library Folders <= 1.4 - SQL Injection Vulnerability 8.5 High
- proloy chakroborty zd scribd ipaper WordPress ZD Scribd iPaper plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
- zckevin zhinatwitterwidget WordPress ZhinaTwitterWidget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
- matamko en masse WordPress En Masse plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
- terry zielke zielke design project gallery WordPress Zielke Design Project Gallery plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
- christopher churchill custom-post-edit WordPress custom-post-edit plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
- merkulove worker for elementor WordPress Worker for Elementor plugin <= 1.0.10 - Broken Access Control vulnerability 5.4 Medium
- merkulove worker for wpbakery WordPress Worker for WPBakery plugin <= 1.1.1 - Broken Access Control vulnerability 5.4 Medium
- merkulove logger for elementor WordPress Logger for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability 5.4 Medium
- merkulove conformer for elementor WordPress Conformer for Elementor plugin <= 1.0.7 - Broken Access Control vulnerability 5.4 Medium
- idreamsoft icms iCMS POST Parameter ConfigAdmincp.php save code injection 5.1 Medium
- commax co., ltd. biometric access control system COMMAX Biometric Access Control System 1.0.0 Reflected XSS via Cookie Parameters 5.1 Medium
- kz broadband technologies, ltd. jt3500v, am3000m, am3100e +12 more +14 more KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability 6.9 Medium
- stvs sa provision STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files Parameter 4.8 Medium
- fredtempez zwiicms ZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pages 5.3 Medium
- metern meterN 1.2.3 Authenticated Remote Code Execution via Admin Scripts 8.6 High
- cypress 200 Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection via Firmware Upgrade 8.6 High
- cypress one Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root 9.3 Critical
- epic games inc. games psyonix rocket league Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure Permissions 8.5 High
- zblchina zbl epon onu broadband router ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint 8.7 High
- nucom 11n wireless router NuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration Backup 8.7 High
- selea carplateserver (cps) Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint 9.3 Critical
- selea carplateserver (cps) Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path 8.5 High
- libcoap libcoap Stack-Based Buffer Overflow in Address Resolution DoS or Potential RCE 8.2 High
- merkulove ungrabber WordPress UnGrabber plugin <= 3.1.3 - Broken Access Control vulnerability 5.4 Medium
- merkulove appender WordPress Appender plugin <= 1.1.1 - Broken Access Control vulnerability 5.4 Medium
- Show olderLoading…