CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- 1panel-dev maxkbMaxKB has a Python sandbox LD_PRELOAD bypass8.8 High
- wbce cmsWBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload8.6 High
- collabora kodexplorerKodExplorer 4.52 Open Redirect Vulnerability via User Login Endpoint5.3 Medium
- anydeskAnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vulnerability6.9 Medium
- xbtitfmxbtitFM 4.1.18 Insecure File Upload in file_hosting Feature8.6 High
- xbtitfmxbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.php8.7 High
- apc network management card 4APC Network Management Card 4 Path Traversal via Directory Traversal8.7 High
- xbtitfmxbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php8.7 High
- opensolution quick.cms, quick cms +1 moreQuick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login9.3 Critical
- cszcms, cszcms csz cms +1 moreCSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint9.3 Critical
- minalicminaliC 2.0.0 Denial of Service Vulnerability via Large GET Request8.7 High
- spa-cart cmsSPA-CART CMS < 2.0.0 Stored Cross-Site Scripting5.3 Medium
- flarum friendsofflarum pretty mailFoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings8.6 High
- flarum friendsofflarum pretty mailFoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings6.9 Medium
- purei cmsPurei CMS 1.0 SQL Injection via Multiple Vulnerable Endpoints9.3 Critical
- siklu multihaul tg seriesSiklu MultiHaul TG Series <= 2.0.0 Unauthenticated Credential Disclosure Vulnerability8.7 High
- 1panel-dev maxkbMaxKB vulnerable to privilege escalation through sandbox bypass8.8 High
- bmc software compuware istrobe webCompuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload9.2 Critical
- pyrocmsPyroCMS v3.0.1 Stored Cross-Site Scripting via Admin Redirects5.3 Medium
- phoenixcart ce phoenixCE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.php5.3 Medium
- elkarte forumElkArte Forum 1.1.9 Authenticated Remote Code Execution via Theme Upload8.6 High
- freepbxFreePBX 16 Authenticated Remote Code Execution via API Module8.7 High
- akauntingAkaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields8.6 High
- xmbforum2 xmb forumXMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates5.3 Medium
- flatboardFlatboard 3.2 Authenticated Stored Cross-Site Scripting via Forum Information Field5.3 Medium
- elements xhibiter nft marketplaceXhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint9.3 Critical
- microweberMicroweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields5.3 Medium
- genexus protection serverGenexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation8.7 High
- renginereNgine 2.2.0 Authenticated Command Injection via Scan Engine Configuration8.7 High
- vexorian dizquetvdizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path9.3 Critical
- sandboxie-plus sandboxieSandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise9.9 Critical
- yangshare warehousemanager 仓库管理系统yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting5.1 Medium
- azeotech daqfactoryUse After Free vulnerability in AzeoTech DAQFactory7.3 High
- altera quartus prime standard, intel quartus prime +1 moreQuartus Prime Standard Security Advisory5.4 Medium
- azeotech daqfactoryType Confusion vulnerability in AzeoTech DAQFactory7.3 High
- azeotech daqfactoryAccess of Uninitialized Pointer vulnerability in AzeoTech DAQFactory8.4 High
- azeotech daqfactoryOut-of-bounds Read vulnerability in AzeoTech DAQFactory8.4 High
- azeotech daqfactoryOut-of-bounds Write vulnerability in AzeoTech DAQFactory8.4 High
- altera quartus prime pro, intel quartus prime +1 moreQuartus Prime Pro Edition Installer Advisory5.4 Medium
- code-projects class and exam timetable management, fabian class and exam timetable management system +1 morecode-projects Class and Exam Timetable Management preview7.php sql injection6.9 Medium
- wpjobportal wp job portal – ai-powered recruitment system for company or job board websiteWP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreDenial of Service Vulnerability in React Server Components7.5 High
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +2 more +4 moreSource Code Exposure Vulnerability in React Server Components5.3 Medium
- code-projects class and exam timetable management, fabian class and exam timetable management system +1 morecode-projects Class and Exam Timetable Management Login index.php sql injection6.9 Medium
- ibm aspera orchestratorIBM Aspera Orchestrator SQL Injection7.6 High
- ibm aspera orchestratorIBM Aspera Orchestrator Unverified Password Change8.1 High
- ibm aspera orchestratorIBM Aspera Orchestrator Command Injection8.8 High
- ibm aspera orchestratorIBM Aspera Orchestrator Denial of Service5.3 Medium
- hcl software workload schedulerHCL Workload Scheduler is vulnerable to plain text storage of a password5.5 Medium
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formConfigFastDirectionW strcpy buffer overflow9.3 Critical
- Show moreLoading…