CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- jenkinsJenkins is missing a permission check on password fields4.3 Medium
- jenkinsJenkins has a Denial of service vulnerability in HTTP-based CLI7.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISP.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISO.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISM.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIPO.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIPC.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIMF.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIDP.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAU.DLL8.5 High
- mailenableMailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAM.DLL8.5 High
- 1panel-dev 1panel1Panel CSRF in Change Username Functionality Allows Account Lockout7.0 High
- imagemagickImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)7.5 High
- xwiki xwiki-renderingXWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection8.7 High
- xwiki, xwiki xwiki-platform +1 moreXWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis8.7 High
- xwiki, xwiki xwiki-platform +1 moreXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication6.5 Medium
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center .NET Remoting Path Traversal RCE8.7 High
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE10.0 Critical
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE10.0 Critical
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE10.0 Critical
- im park information technology, electronics, press, publishing and advertising, education ltd. co. dijidemiIDOR in Im Park's DijiDemi4.3 Medium
- lenovo baiying clientAn improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a...8.5 High
- lenovo one clientA potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal...8.5 High
- lenovo app store, browser +1 moreA DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser...8.5 High
- tac information services internal and external trade inc. goldenhornXSS in TACAS Consulting's GoldenHorn3.5 Low
- gogsFile overwrite in file update API in Gogs8.7 High
- jbl boombox 2, boombox 3, flip 5 +4 more +6 moreJBL: Improper validation of ICM field in connection requests6.5 Medium
- jbl live pro 2 tws, tune flex +1 moreJBL: Improper BLE security configurations and lack of authentication on the device's GATT server8.8 High
- toto link x5000r's (ax1800 router), totolink x5000r firmware +1 moreUnauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password9.8 Critical
- gtt sistema de información tributarioBypass in the authentication method of the GTT Sistema de Información Tributario application9.3 Critical
- cronosweb i2a cronoswebDirect reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A8.3 High
- wago 0852-1322 firmware, 0852-1328 firmware, indsutrial-managed-switches +2 moreStack-based buffer overflow via unsafe sscanf in check_cookie()9.8 Critical
- wago 0852-1322 firmware, 0852-1328 firmware, indsutrial-managed-switches +2 moreStack-based buffer overflow via unsafe sscanf in check_account()9.8 Critical
- bitdefender total security, antivirus, antivirus plus +2 more +4 moreLocal Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security8.8 High
- apache strutsApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed8.2 High
- videomerchant video merchantVideo Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- libimobiledevice usbmuxdLocal privilege escalation in usbmuxd from arbitrary local user to usbmux5.1 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure2.7 Low
- nomysoft informatics nomysemImproper Authorization in Nomysoft Informatics' Nomysem7.1 High
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +26 more +28 moreGlib: glib: buffer underflow in gvariant parser leads to heap corruption5.6 Medium
- moxa mxsecurity seriesUnauthenticated Device Registration Vulnerability in MXsecurity Series6.3 Medium
- ezcast pro iiPredictable Default Wi-Fi Password in EZCast Pro II Dongle9.3 Critical
- ezcast pro iiHard-coded cryptographic keys in EZCast Pro II Dongle9.3 Critical
- google cloud dialogflow cxPrivilege Escalation in Dialogflow CX via Webhook Admin Role8.7 High
- google cloud cloud data fusionArbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload8.7 High
- unknown handl utm grabber / trackerHandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page7.1 High
- unknown handl utm grabber / trackerHandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source7.1 High
- hippooo hippoo mobile app for woocommerceHippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read7.5 High
- tecno audiolink, com.transsion.audiosmartconnect +1 moreUnprotected service in the AudioLink component allows a local attacker to overwrite system files...5.3 Medium
- specialk simple download counterSimple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal4.9 Medium
- Show moreLoading…