CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- elated themes membershipElated Membership <= 1.2 - Authentication Bypass via Social Login9.8 Critical
- pipeshub, pipeshub-ai +1 morePipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload9.8 Critical
- langchain-ai langgraph, langchain langgraph-checkpoint-sqlite +1 moreLangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method7.3 High
- meatmeetThe mobile application insecurely handles information stored within memory. By performing a...4.6 Medium
- meatmeetThe application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker...7.5 High
- meatmeetDue to a lack of certificate validation, all traffic from the mobile application can be...9.1 Critical
- meatmeet pro wifi \& bluetooth meat thermometer firmwareThe ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack...6.8 Medium
- meatmeet pro wifi \& bluetooth meat thermometer firmwareAn unauthenticated attacker within proximity of the Meatmeet device can issue several commands...6.5 Medium
- meatmeetThe mobile application is configured to allow clear text traffic to all domains and communicates...9.1 Critical
- meatmeetThe mobile application was found to contain stored credentials for the network it was developed...9.8 Critical
- meatmeet pro wifi \& bluetooth meat thermometer firmwareThe firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical...4.6 Medium
- meatmeet pro wifi \& bluetooth meat thermometer firmwareAn unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized...8.8 High
- meatmeet pro wifi \& bluetooth meat thermometer firmwareThe Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for...9.8 Critical
- meatmeet pro wifi \& bluetooth meat thermometer firmwareThe ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By...6.8 Medium
- meatmeet pro wifi \& bluetooth meat thermometer firmwareAs UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary...7.5 High
- meatmeetAn issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can...9.8 Critical
- uniteddevelopers document reader\A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC,...6.5 Medium
- a1apps office app-edit word\, pdf fileA lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word...6.5 Medium
- chmln sdsd changes the group ownership of the source file8.4 High
- freeimage project freeimageAn integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before...6.5 Medium
- datagearDataGear v5.5.0 is vulnerable to Arbitrary File Deletion.9.1 Critical
- algernon project algernonAlgernon Cross-Site Scripting vulnerability6.1 Medium
- chancmsA template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows...9.8 Critical
- zcaceres markdownify mcp serverA Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown...7.5 High
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreAqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025...7.5 High
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreNULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and...6.5 Medium
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreMultiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027,...8.1 High
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreAqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025...9.8 Critical
- aqara camera hub g3 firmwareCommand injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute...6.6 Medium
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreCommand injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4...7.3 High
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreAqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail...7.4 High
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreAqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025...7.4 High
- jxlindia jxl 9 inch car android double din player firmwareAn issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0...7.5 High
- xiangshanXiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and...7.5 High
- fearlessgeekmedia fearlesscmsDirectory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote...7.5 High
- fearlessgeekmedia fearlesscmsDirectory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote...7.5 High
- fearlessgeekmedia fearlesscmsCross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote...6.1 Medium
- pagerduty runbook automationPagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the...6.5 Medium
- denx u-bootImproper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot...7.6 High
- labredescefetrj wegiaWeGIA is vulnerable to SQL Injection via editar_categoria endpoint parameter9.4 Critical
- joinmastodon mastodonMastodon Error Handling Discrepancy Enables Private Status Existence Enumeration3.7 Low
- adobe coldfusionColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)9.1 Critical
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)7.4 High
- adobe coldfusionColdFusion | Improper Input Validation (CWE-20)8.4 High
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)6.8 Medium
- adobe coldfusionColdFusion | Insufficiently Protected Credentials (CWE-522)5.3 Medium
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)8.4 High
- adobe coldfusionColdFusion | Improper Input Validation (CWE-20)9.1 Critical
- adobe coldfusionColdFusion | Improper Access Control (CWE-284)5.6 Medium
- adobe coldfusionColdFusion | Improper Input Validation (CWE-20)6.2 Medium
- Show moreLoading…