CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)6.2 Medium
- adobe coldfusionColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)9.1 Critical
github.com/opentofu/opentofuGoOpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs5.9 Medium- aliasrobotics cai, cybersecurity ai +1 moreCybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool9.7 Critical
- labredescefetrj wegiaWeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration Page4.3 Medium
- ibm planning analytics localIBM Planning Analytics Local is vulnerable to disclosing sensitive information4.3 Medium
- sangoma freepbx, flarum framework +1 moreFreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header9.3 Critical
- mailenableMailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspx5.3 Medium
- minidvblinux, minidvblinux simple videodiskrecorder protocol svdrp (svdrpsend.sh) exploit +1 moreMiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol Remote Code Execution6.9 Medium
- minidvblinuxMiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.sh8.7 High
- minidvblinuxMiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page8.7 High
- minidvblinux, minidvblinux change root password poc +1 moreMiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup9.3 Critical
- minidvblinux, minidvblinux minidvblinux(tm) distribution (mld) +1 moreMiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint8.7 High
- tinycontrol lk, lan controller v +1 moreTinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure9.9 Critical
- selea targa ip ocr-anpr camera, carplateserver, izero box full firmware +10 more +12 moreSelea Targa IP Camera Developer Backdoor Configuration Overwrite9.3 Critical
- selea targa ip ocr-anpr camera, carplateserver, izero box full firmware +10 more +12 moreSelea Targa IP Camera Cross-Site Request Forgery via Admin Creation8.5 High
- selea targa ip ocr-anpr camera, carplateserver, izero box full firmware +10 more +12 moreSelea Targa IP Camera Stored Cross-Site Scripting via Files List5.1 Medium
- selea targa ip ocr-anpr camera, carplateserver, izero box full firmware +10 more +12 moreSelea Targa IP Camera Remote Code Execution via Utils9.3 Critical
- selea targa ip ocr-anpr camera, carplateserver, izero box full firmware +10 more +12 moreSelea Targa IP Camera Unauthenticated Stream Disclosure8.7 High
- stvs provisionSTVS ProVision Authenticated File Disclosure via archive.rb7.1 High
- stvs provisionSTVS ProVision Cross-Site Request Forgery (Add Admin)6.9 Medium
- commax co., ltd. webviewer activex controlCNC_Ctrl DllUnregisterServer f5501 Access Violation8.7 High
- open bmcs openbmcsOpenBMCS Directory Listing Information Disclosure8.7 High
- intellichoice eforce software suiteIntelliChoice eFORCE Software Suite Username Enumeration6.9 Medium
- commax co., ltd. smart home ruvie cctv bridge dvr serviceCOMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credentials Disclosure8.7 High
- docker desktopExpired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logs2.4 Low
- commax co., ltd. smart home ruvie cctv bridge dvr serviceCOMMAX Smart Home Ruvie CCTV Bridge DVR Service Config Write / DoS8.7 High
- adobe creative cloud desktop, creative cloud +1 moreCreative Cloud Desktop | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379)5.5 Medium
- commax co., ltd. smart home iot control systemCOMMAX Smart Home IoT Control System SQL Injection Authentication Bypass9.3 Critical
- commax co., ltd. cvd-axx dvrCOMMAX CVD-Axx DVR Weak Default Credentials Stream Disclosure9.3 Critical
- commax co., ltd. biometric access control systemCOMMAX Biometric Access Control System Authentication Bypass8.7 High
- commax co., ltd. ums client activex controlCNC_Ctrl DllUnregisterServer Access Violation8.7 High
- open bmcs openbmcsOpenBMCS SQL Injection via obix_test.php8.7 High
- open bmcs openbmcsOpenBMCS Server Side Request Forgery (SSRF) via /php/query.php6.9 Medium
- open bmcs openbmcsOpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php5.3 Medium
- open bmcs openbmcsOpenBMCS User Management Privilege Escalation8.7 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Out-of-bounds Read (CWE-125)7.8 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Untrusted Search Path (CWE-426)7.8 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)3.3 Low
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Improper Verification of Cryptographic Signature (CWE-347)3.3 Low
java-1.8.0-openjdkTuxCare,java-1.8.0-openjdk-accessibilityTuxCare,java-1.8.0-openjdk-accessibility-debugTuxCare +13 more +15 moreUpdate of java-1.8.0-openjdkNo scorejava-11-openjdkTuxCare,java-11-openjdk-debugTuxCare,java-11-openjdk-demoTuxCare +15 more +17 moreUpdate of java-11-openjdkNo score- wearefrank ladybugLadybug has an XMLDecoder Deserialization Vulnerability (Java RCE)7.0 High
- angeljudesuarez student management systemitsourcecode Student Management System new_grade.php sql injection6.9 Medium
- angeljudesuarez student management systemitsourcecode Student Management System promote.php sql injection6.9 Medium
- angeljudesuarez student management systemitsourcecode Student Management System new_school_year.php sql injection6.9 Medium
- pci-sig pci express integrity and data encryption (pcie ide) specification, pcisig pci express integrity and data encryption +1 moreCVE-2025-96136.5 Medium
- pci-sig pci express integrity and data encryption (pcie ide) specification, pcisig pci express integrity and data encryption +1 moreCVE-2025-96146.5 Medium
- pci-sig pci express integrity and data encryption (pcie ide) specification, pcisig pci express integrity and data encryption +1 moreCVE-2025-96125.1 Medium
- angeljudesuarez student management systemitsourcecode Student Management System new_adviser.php sql injection6.9 Medium
- Show moreLoading…