CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreWindows Storage VSP Driver Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 22h3 +13 more +15 moreWindows DirectX Information Disclosure Vulnerability6.5 Medium
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability7.5 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Spoofing Vulnerability5.3 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreWindows File Explorer Elevation of Privilege Vulnerability7.5 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +21 more +23 moreDirectX Graphics Kernel Elevation of Privilege Vulnerability7.0 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows server 2025 +3 more +5 moreApplication Information Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- microsoft excel, office, 365 apps +9 more +11 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft excel, office, 365 apps +9 more +11 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft office, 365 apps, 365 apps for enterprise +11 more +13 moreMicrosoft Outlook Remote Code Execution Vulnerability7.8 High
- microsoft excel, office, 365 apps +9 more +11 moreMicrosoft Excel Remote Code Execution Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 moreWindows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 moreWindows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 moreWindows Remote Access Connection Manager Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 moreWindows Common Log File System Driver Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows server 2025 +3 more +5 moreMicrosoft Brokering File System Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +30 more +32 moreWindows Client-Side Caching Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWin32k Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreWindows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 22h3, windows 11 version 23h2, windows 11 version 24h2 +9 more +11 moreWindows Resilient File System (ReFS) Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreWindows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability7.8 High
- nvidia nvtabularNVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could...8.8 High
- nvidia merlin transformers4recNVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where...8.8 High
- adobe dng sdk, dng software development kit +1 moreDNG SDK | Heap-based Buffer Overflow (CWE-122)7.1 High
- adobe dng sdk, dng software development kit +1 moreDNG SDK | Integer Overflow or Wraparound (CWE-190)5.5 Medium
- adobe dng sdk, dng software development kit +1 moreDNG SDK | Out-of-bounds Read (CWE-125)7.1 High
- adobe dng sdk, dng software development kit +1 moreDNG SDK | Integer Overflow or Wraparound (CWE-190)7.8 High
- dell encryptionDell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File...6.6 Medium
- dell encryptionDell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File...7.3 High
- shopwareShopware's inproper input validation can lead to Reflected XSS through Storefront Login Page7.1 High
onelogin/php-samlPackagistSAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-664759.3 Criticalnet.dv8tion:JDAMavenJDA (Java Discord API) downloads external URLs when updating message components6.9 Medium- maartenbelmans advanced product fields (product addons) for woocommerceAdvanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication4.3 Medium
- fortinet fortios, fortipam, fortiproxy +2 more +4 moreAn insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0...6.3 Medium
- fortinet fortiweb, siemens ruggedcom ape1808 +1 moreAn improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0,...9.1 Critical
- fortinet fortios, fortiproxy, fortiswitchmanager +3 more +5 moreA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0...9.1 Critical
- fortinet fortisandbox, fortisandbox cloud +1 moreAn improper neutralization of special elements used in an OS command ('OS Command Injection')...6.9 Medium
- fortinet fortisandboxAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...5.3 Medium
- neuron-ai neuron, neuron-core neuron-ai +1 moreMySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)9.4 Critical
- fortinet fortisandboxAn Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...7.0 High
- neuron-ai neuron, neuron-core neuron-ai +1 moreMySQLSelectTool Read-Only Bypass via SELECT INTO OUTFILE Allows Arbitrary File Write8.2 High
- filamentphp filamentFilament's multi-factor authentication (app) recovery codes can be used multiple times8.1 High
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreAn improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2,...6.2 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreAn unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7...6.5 Medium
- containernetworking plugins, linuxfoundation cni network plugins +1 moreCNI Plugins Portmap nftables backend intercepts non-local traffic6.6 Medium
- fortinet fortiportalAn Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow...6.4 Medium
- fortinet fortiosAn insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7.4.0, FortiOS 7.2...5.3 Medium
- fortinet fortivoiceAn improper neutralization of special elements used in an sql command ('sql injection')...6.8 Medium
- fortinet fortiextender, fortiextender firmware +1 moreA improper neutralization of special elements used in an os command ('os command injection') in...6.7 Medium
- Show moreLoading…