CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- ays-pro secure copy content protection and content lockingSecure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File5.3 Medium
- ays-pro secure copy content protection and content lockingSecure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export4.3 Medium
- rodolforizzo76 simple bike rentalSimple Bike Rental <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposure4.3 Medium
- kubernetesPortworx Half-Blind SSRF in kube-controller-manager5.8 Medium
- unknown woomultiWooMulti <= 1.7 - Subscriber+ Arbitrary File Deletion7.3 High
kubernetesopenSUSESecurity update for kubernetes-clientNo scorekubernetes-oldopenSUSESecurity update for kubernetes-clientNo score- unknown bookitBookit < 2.5.1 – Unauthenticated Settings Update5.3 Medium
- apache hugegraph, apache software foundation hugegraph-server +1 moreApache HugeGraph-Server: RAFT and deserialization vulnerability8.8 High
- apache fineractApache Fineract: IDOR via self-service API8.1 High
- mailerlite – signup forms (official)MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpressEmail Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution5.3 Medium
- addonsorg pdf for contact form 7 + drag and drop template builderPDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication4.3 Medium
- apache fineractApache Fineract: Server Key not masked9.1 Critical
- apache fineractApache Fineract: weak password policy8.5 High
container-suseconnectSUSESecurity update for container-suseconnectNo score- siemens simcenter femapA vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected...7.3 High
- iworks simple csv tableSimple CSV Table <= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- frappe learning, lms +1 moreFrappe authenticated users can execute XSS through form description fields5.1 Medium
- amans2k funnelkit – funnel builder for woocommerce checkoutFunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection7.5 High
- wpchill modula image gallery – photo grid & video galleryImage Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing6.5 Medium
- emrevona wp fastest cache premiumWP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery3.5 Low
- bannersky bsk pdf managerBSK PDF Manager <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload5.5 Medium
- e4jvikwp vikrentitems flexible rental management systemVikRentItems Flexible Rental Management System <= 1.2.0 - Reflected Cross-Site Scripting via 'delto' Parameter6.1 Medium
- jbrinley mailgun subscriptionsMailgun Subscriptions <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- shaneisrael fireshareFireshare Public Uploads feature is vulnerable to OS Command Injection (RCE)9.8 Critical
- parse-community parse-serverParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management6.9 Medium
- qdonow wpnakama – team and multi-client collaboration, editorial and project managementWPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameter7.5 High
- hippooo hippoo mobile app for woocommerceHippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write5.3 Medium
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF4.3 Medium
- radykal fancy product designerFancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload7.2 High
- rcatheme guest supportGuest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint5.3 Medium
- tornadoweb tornadoTornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5 High
- sparkle wp construction lightConstruction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation4.3 Medium
- tornadoweb tornadoTornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5 High
- tornadoweb tornadoTornado vulnerable to Header Injection and XSS via reason argument5.4 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreIn GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and...5.1 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreSQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession...5.3 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreCross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0,...5.1 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreGroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and...6.9 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreIn GroupSession, a Circular notice can be created with its memo field non-editable, but the...5.3 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7...5.1 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3...5.1 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreStored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1,...4.8 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreStored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0,...4.8 Medium
- groupsession, japan total system co.,ltd. groupsession bycloud, groupsession free edition +1 more +3 moreStored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0,...5.1 Medium
- masacmsMasa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter8.2 High
- wpletsgo wplg default mail fromWPLG Default Mail From <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- darendev simple theme changerSimple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update4.3 Medium
- izuchy contact form 7 with chatworkContact Form 7 with ChatWork <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api_token' and 'roomid' Settings4.4 Medium
- Show moreLoading…