CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- fortinet fortiauthenticatorAn improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.4,...2.6 Low
- fortinet fortiauthenticatorA direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6...2.6 Low
- fortinet fortiwebA use of password hash instead of password for authentication vulnerability [CWE-836]...4.4 Medium
- fortinet fortivoiceMultiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal')...7.7 High
- fortinet fortiwebA reliance on cookies without validation and integrity checking vulnerability in Fortinet...7.1 High
github.com/siyuan-note/siyuan/kernelGoSiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin8.6 High- b3log siyuanSiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE7.8 High
- machphy mad-proxyHTTP/HTTPS Traffic Interception Bypass in mad-proxy5.3 Medium
- argoproj argo-workflows, argo workflows +1 moreargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links8.1 High
- umbraco cms, umbraco-cms +1 moreUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality4.9 Medium
- elysiajs elysiaElysia affected by arbitrary code injection through cookie config7.5 High
- elysiajs elysiaElysia vulnerable to prototype pollution with multiple standalone schema validation9.1 Critical
- netgear mr90, ms90, rax35v2 +32 more +34 moreImproper input validation in NETGEAR Nighthawk routers4.4 Medium
- netgear r7000p, r7000p firmware +1 moreImproper input validation in NETGEAR Nighthawk router R7000P1.1 Low
- netgear c6220, c6230, c6220 firmware +1 more +3 moreDenial of Service Vulnerability in NETGEAR C6220 and C62305.0 Medium
- essential plugin slider a sliderspackWordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerability5.3 Medium
- repute infosystems armemberWordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control4.3 Medium
- taylor hawkes wp fast cacheWordPress WP Fast Cache plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- brainstorm force spectraWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability5.4 Medium
- ivanti endpoint managerImproper verification of cryptographic signatures in the patch management component of Ivanti...7.8 High
- ivanti endpoint managerPath traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote...7.1 High
- ivanti endpoint managerImproper control of dynamically managed code resources in Ivanti Endpoint Manager prior to...8.8 High
- portabilis i-educari-Educar 2.10.0 - Stored Cross-Site Scripting (XSS) in admin panel4.8 Medium
- yandex messengerDylib Hijacking in Yandex Messenger7.3 High
- ivanti endpoint managerStored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote...9.6 Critical
- yandex telemostDylib Hijacking in Yandex Telemost7.3 High
- yandex diskDylib Hijacking in Yandex Disk7.3 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4 Medium
- stellarwp givewpWordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability6.5 Medium
- tianocore edk2Un-verified kernel bypass Secure Boot mechanism in direct boot mode8.4 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreCross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server2.3 Low
- tianocore edk2Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege5.8 Medium
- happymonster happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.20.3 - Broken Access Control vulnerability4.3 Medium
- dream-theme the7 elementsWordPress The7 Elements plugin <= 2.7.11 - Local File Inclusion vulnerability7.5 High
- muffingroup bethemeWordPress Betheme theme <= 28.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dream-theme the7WordPress The7 theme < 12.8.1.1 - Local File Inclusion vulnerability7.5 High
- dream-theme the7WordPress The7 theme < 12.9.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeco cornerstoneWordPress Cornerstone plugin <= 7.7.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- averta shortcodes and extra features for phlox themeWordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.15 - Sensitive Data Exposure vulnerability5.3 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.3.32 - Sensitive Data Exposure vulnerability4.3 Medium
- vinod dalvi ivory searchWordPress Ivory Search plugin <= 5.5.12 - Broken Access Control vulnerability5.3 Medium
- sevenspark contact form 7 – dynamic text extensionWordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerability5.3 Medium
- p-themes porto theme - functionalityWordPress Porto Theme - Functionality plugin < 3.7.3 - Broken Access Control vulnerability4.3 Medium
- p-themes porto theme - functionalityWordPress Porto Theme - Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability5.3 Medium
- ashanjay eventonWordPress EventON plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- yandex metrika yandex.metricaWordPress Yandex.Metrica plugin <= 1.2.2 - Broken Access Control vulnerability5.3 Medium
- andondesign udesign coreWordPress UDesign Core plugin <= 4.14.0 - Local File Inclusion vulnerability7.5 High
- hogash kallyasWordPress KALLYAS theme < 4.25.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…