CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- apple macosA privacy issue was addressed with improved private data redaction for log entries. This issue is...3.3 Low
- apple macosA denial-of-service issue was addressed with improved input validation. This issue is fixed in...6.5 Medium
- apple macosA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing...5.5 Medium
- grassroots dicom (gdcm), medinria, numfocus simpleitk +2 moreGrassroots DICOM (GDCM) Out-of-bounds Write6.8 Medium
- cisa software acquisition guide, software acquisition guide tool +1 moreSoftware Acquisition Guide Supplier Response Web Tool XSS4.6 Medium
- qualitorQualitor viewDocumento.php cross site scripting5.1 Medium
github.com/babylonlabs-io/finality-providerGoFinality Provider vulnerable to anti-slashing bypassing due to misconfiguration8.7 High- puneethreddyhc online shopping system advanced, online-shopping-system-advanced +1 moreOnline Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter8.7 High
- flow-scanner lightning-flow-scannerLightning Flow Scanner is Vulnerable to Code Injection via Unsafe Use of new Function() in APIVersion Rule8.4 High
- angeljudesuarez student management systemitsourcecode Student Management System update_account.php sql injection6.9 Medium
- atcom technology co., ltd. 100m ip phonesAtcom 2.7.x.x Authenticated Command Injection via Web Configuration CGI8.7 High
- dormakaba saflok system 6000Dormakaba Saflok System 6000 Key Generation Cryptographic Weakness8.7 High
- wondercmsWonderCMS 4.3.2 Cross-Site Scripting Remote Code Execution via Module Installation8.6 High
- pcman ftp serverPCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command9.3 Critical
- typoraTypora 1.7.4 OS Command Injection via Export PDF Preferences8.5 High
- frappe learning, lms +1 moreFrappe Authenticated Users can Execute JavaScript through its Job Form5.1 Medium
- utt 进取 512w, 512w firmware +1 moreUTT 进取 512W formWebAuthGlobalConfig memory corruption8.7 High
vuetifynpm,@rootio/vuetifyRoot +1 moreVuetify Prototype Pollution via Preset options8.6 High- suse neuvectorNeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)8.8 High
- google chrome, chromium, apple ipados +7 more +9 moreOut of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a...8.8 High
vuetifynpmVuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'6.3 Medium- projectworlds advanced library management systemprojectworlds Advanced Library Management System borrow_book.php sql injection6.9 Medium
- projectworlds advanced library management systemprojectworlds Advanced Library Management System view_admin.php sql injection6.9 Medium
- ggml-org whisper.cppggml-org whisper.cpp common-whisper.cpp read_audio_data use after free4.8 Medium
- haxxorsid stock-management-systemhaxxorsid Stock-Management-System User.php sql injection5.3 Medium
- linux, siemens ruggedcom rst2428p +1 moreusb: storage: sddr55: Reject out-of-bound new_pba7.0 High
nextnpm,@rootio/nextRoot +1 moreNext has a Denial of Service with Server Components - Incomplete Fix Follow-Up7.5 High@vitejs/plugin-rscnpmVite Plugin React has a Source Code Exposure Vulnerability in React Server Components5.3 Medium@vitejs/plugin-rscnpmVite Plugin React has a Denial of Service Vulnerability in React Server Components7.5 High- haxxorsid stock-management-systemhaxxorsid Stock-Management-System employees missing authentication6.9 Medium
- dr.buho buhontfsBuhoNTFS 1.3.2 - Local Privilege Escalation8.5 High
- kidaze courseselectionsystemkidaze CourseSelectionSystem reg.php sql injection6.9 Medium
- kidaze courseselectionsystemkidaze CourseSelectionSystem login1.php sql injection6.9 Medium
- waveterm, waveterm wave terminal +1 moreCode Injection in Wave Term v0.12.2 allowing TCC Bypass6.9 Medium
- apache streamparkApache StreamPark: Uses the user’s password as the secret key5.9 Medium
- apache streamparkApache StreamPark: Use hard-coded key vulnerability9.8 Critical
- apache streamparkApache StreamPark: Weak Encryption Algorithm in StreamPark7.5 High
- solaredge monitoring platform, monitoring platform (saas) +1 moreSolarEdge Monitoring Platform contains a XSS upon report deletion4.8 Medium
- solaredge se3680h, se3680h firmware +1 moreSolarEdge SE3680H - Information Exposure during Bootloader Loop2.4 Low
- solaredge se3680h, se3680h firmware +1 moreSolarEdge SE3680H - Exposed Debug interface8.6 High
- solaredge se3680h, se3680h firmware +1 moreSolarEdge SE3680H contains Linux Kernel vulnerabilities8.6 High
- ami aptiov, aptio v +1 moreTCG2 TPM RT Not Locked Issue7.2 High
- cleverdisplay b.v. blueone (cleverdisplay hardware player)CleverDisplay BlueOne unauthorized BIOS access through physical USB keyboard2.4 Low
ImageMagickTuxCare,ImageMagick-c++TuxCare,ImageMagick-c++-develTuxCare +3 more +5 moreUpdate of ImageMagickNo score- nebim neyir computer industry and services inc. v3 erpImproper Authorization in Nebim Neyir's Nebim V3 ERP8.8 High
- rustcrypto signaturesRustCrypto: Signatures has timing side-channel in ML-DSA decomposition6.4 Medium
- soportecibeles ai feedsAI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode6.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion4.3 Medium
- nalam-1 magical posts display – elementor advanced posts widgetsMagical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget6.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure5.3 Medium
- Show moreLoading…