CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text...8.8 High
- eddyverbruggen cordova-plugin-x-socialsharingThe Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0...6.2 Medium
- wekan project wekanAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed...6.5 Medium
- wekan project wekanAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed...8.2 High
- wekan project wekanAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed...8.8 High
- wekan project wekanAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed...7.5 High
- wekan project wekanAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed...8.1 High
- newgensoft omnidocsAn unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs...8.2 High
- allauthdjango-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions5.4 Medium
- allauthdjango-allauth does not reject access tokens for inactive users5.4 Medium
- mthreads torch musaMooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in...9.8 Critical
- dynatrace oneagentAn issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote...7.5 High
- kagilum icescrumA Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows...8.8 High
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function...6.5 Medium
- totolink a3300r firmware, n200re firmware +1 moreTOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u...9.1 Critical
- totolink n200re firmwareTOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via...6.5 Medium
- sunbirddcim power iqAn error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The...2.5 Low
- microstudioA HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29...6.1 Medium
- fntsoftware fnt commandFNT Command 13.4.0 is vulnerable to Directory Traversal.8.3 High
- fntsoftware fnt commandFNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module.8.8 High
- anirbandutta9 news-buzzSQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute...5.3 Medium
- inventory management system project management systemInventory Management System 1 was discovered to contain a SQL injection vulnerability.5.3 Medium
- inventory management system project management systemA reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP...6.1 Medium
- kristapsdz openrsyncopenrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client...5.3 Medium
- mayan edms, mayan-edms mayan edms +1 moreMayan EDMS authentication redirect5.3 Medium
- mayan edms, mayan-edms mayan edms +1 moreMayan EDMS authentication cross site scripting5.3 Medium
- nxlog agentNXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.8.1 High
- uriparseruriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by...2.9 Low
- mjmlMJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-128274.5 Medium
- aizuda snail-jobaizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injection5.3 Medium
- gmg137 snap7-rsgmg137 snap7-rs client.rs as_ct_write heap-based overflow6.9 Medium
- gmg137 snap7-rsgmg137 snap7-rs s7_micro_client.cpp opWriteArea heap-based overflow6.9 Medium
- campcodes advanced online examination systemcampcodes Advanced Online Examination System loginExe.php sql injection6.9 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection6.9 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection6.9 Medium
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request DhcpListClient stack-based overflow9.3 Critical
- campcodes supplier management systemCampcodes Supplier Management System view_unit.php sql injection6.9 Medium
- code-projects student file management systemcode-projects Student File Management System update_student.php cross site scripting4.8 Medium
- code-projects student file management systemcode-projects Student File Management System Update User update_user.php cross site scripting4.8 Medium
- itsourcecode student managemen system, angeljudesuarez student management system +1 moreitsourcecode Student Managemen System advisers.php sql injection6.9 Medium
- decocms meshDecoCMS Mesh Workspace Domain api.ts createTool access control6.3 Medium
- d-link dir-860lb1, dir-868lb1, dlink dir-860l b1 firmware +1 more +3 moreD-Link DIR-860LB1/DIR-868LB1 DHCP command injection8.7 High
- tenda ac20, ac20 firmware +1 moreTenda AC20 openSchedWifi httpd buffer overflow8.7 High
- tenda ac20, ac20 firmware +1 moreTenda AC20 httpd SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow8.7 High
- tenda ac20, ac20 firmware +1 moreTenda AC20 httpd setPptpUserList formSetPPTPUserList stack-based overflow8.7 High
- angeljudesuarez student management systemitsourcecode Student Management System addrecord.php sql injection6.9 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System admindetail.php sql injection6.9 Medium
- martialbe one-hubMartialBE one-hub docker-compose.yml hard-coded key6.3 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System product.php sql injection6.9 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System supplier.php sql injection6.9 Medium
- Show moreLoading…