CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- misskeyMisskey has a login rate limit bypass via spoofed X-Forwarded-For header6.9 Medium
- misskeymisskey.js's export data contains private post data7.1 High
- eyemaxsystems nvclientNVClient 5.0 Stack Buffer Overflow Vulnerability via User Configuration6.7 Medium
- vion707 dmadminvion707 DMadmin Backend AddonsController.class.php add cross site scripting4.8 Medium
- ateme titan, titan file +1 moreAteme TITAN File 3.9 Authenticated Server-Side Request Forgery Vulnerability5.3 Medium
- blackcat-cms blackcat cmsBlackcat CMS 1.4 Remote Code Execution via Jquery Plugin Manager8.6 High
- blackcat-cms blackcat cmsBlackcat CMS 1.4 Stored Cross-Site Scripting via Page Modification5.1 Medium
- grabaperch perchPerch CMS 3.2 Stored Cross-Site Scripting via SVG File Upload5.1 Medium
- grabaperch perchPerch CMS 3.2 Remote Code Execution via Unrestricted File Upload8.6 High
- zomp zomplogZomplog 3.9 Remote Code Execution via Authenticated File Manipulation8.6 High
- zomp zomplogZomplog 3.9 Cross-Site Scripting Vulnerability via Page Creation5.1 Medium
- xlightftpd xlight ftp serverXlight FTP Server 3.9.3.6 Stack Buffer Overflow Vulnerability via Execute Program5.1 Medium
- webutlerWebutler v3.2 Remote Code Execution via Arbitrary File Upload8.6 High
- webedition cmsWebedition CMS v2.9.8.8 Stored Cross-Site Scripting via SVG Upload5.1 Medium
- webedition cmsWebedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation8.6 High
- jlexart jlex guestbookJLex GuestBook 1.6.4 Reflected Cross-Site Scripting via URL Parameter5.1 Medium
- ruijie reyeeos, ruijienetworks reyee os +1 moreReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP9.2 Critical
- luceeLucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces4.8 Medium
- phpjabbers member login scriptMember Login Script 3.3 Client-Side Request Desynchronization Vulnerability6.9 Medium
- phpjabbers bus reservation systemBus Reservation System 1.1 Multiple SQL Injection via pickup_id Parameter9.3 Critical
- creativeitem academy lmsAcademy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings5.1 Medium
- gomlab gom playerGOM Player 2.3.90.5360 Remote Code Execution via Insecure IE Component7.5 High
- gomlab gom playerGOM Player 2.3.90.5360 Buffer Overflow via Equalizer Preset Name6.7 Medium
- flexense ltd. syncbreezeSyncBreeze 15.2.24 Denial of Service via Login Endpoint Overflow8.7 High
- wp2facWp2Fac 1.0 OS Command Injection via send.php Endpoint9.3 Critical
- soosyzeSoosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic6.9 Medium
- joraniJorani 1.0.3 Cross-Site Scripting Vulnerability via Language Parameter5.1 Medium
- webigniterWEBIGniter 28.7.23 Unrestricted File Upload Remote Code Execution8.7 High
- coppermine coppermine-gallery, coppermine-gallery coppermine photo gallery +1 moreCoppermine Gallery 1.6.25 Remote Code Execution via Plugin Upload8.7 High
- emqx nanomqNanoMQ has Buffer Overflow8.5 High
ffmpegMageiaUpdated ffmpeg packages fix security vulnerabilitiesNo score- weblateWeblate has improper validation upon invitation acceptance1.0 Low
- ibm devops deploy, ucd - ibm devops deploy +1 moreIBM DevOps Deploy is susceptible to a Cleartext Transmission of Sensitive Information5.9 Medium
- amazon harmonix, aws harmonix on aws +1 moreOverly Permissive Trust Policy in Harmonix on AWS EKS8.6 High
- ibm devops deploy, ucd - ibm devops deploy +1 moreIBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability6.5 Medium
- zephyrproject-rtos zephyrBluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP6.5 Medium
- ibm devops deploy, ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more +3 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerability5.0 Medium
- enterprisedb hybrid manager - innovation, hybrid manager - lts, hybrid manager +2 moreEDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access...7.0 High
- red hat lightspeed (formerly insights) for runtimes 1.0, runtimes inventory operator +1 moreInsights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands8.7 High
- red hat openshift gitops, redhat-developer gitops-operator, red hat openshift gitops 1.16 +2 more +4 moreOpenshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs9.1 Critical
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social6.4 Medium
- rockwell automation micro820®, micro850®, micro870®Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities8.7 High
- rockwell automation micro820®, micro850®, micro870®Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities7.1 High
- manager-io managerNetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCE8.7 High
- manager-io managerNetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery8.4 High
- manager-io managerNetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure8.7 High
- ays-pro fox lms – wordpress lms pluginFox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'9.8 Critical
- onesignal – web push notificationsOneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update5.3 Medium
- techjewel fluentauth – the ultimate authorization & security plugin for wordpressFluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode6.4 Medium
- wpdevelop booking calendarBooking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check7.5 High
- Show moreLoading…