CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- meltytech shotcutMeltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs...9.8 Critical
- nopcommercenopCommerce 4.90.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Schedule Tasks...8.8 High
- nopcommercenopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management...6.1 Medium
- nopcommercenopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.5.4 Medium
- nopcommercenopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality...5.4 Medium
- nopcommercenopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.6.1 Medium
- volosoft abpABP Account Module has an Open Redirect through Improper validation in its register function5.3 Medium
- dbitnet dbit n300 t1 pro firmwareAn issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version...6.5 Medium
- blixhq bluemailWhen using the attachment interaction functionality, Blue Mail 1.140.103 and below saves...9.1 Critical
- canarymail canary mailWhen using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents...9.1 Critical
- invoiceplaneInvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler...4.3 Medium
- allskyteam allskyA Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an...10.0 Critical
- amperecomputing ampereone a128-34x firmware, ampereone a144-24x firmware, ampereone a144-26m firmware +10 more +12 moreAmpere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and...9.8 Critical
- amperecomputing ampereone a128-34x firmware, ampereone a144-24x firmware, ampereone a144-26m firmware +10 more +12 moreAmpere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and...9.8 Critical
- amperecomputing ampereone a128-34x firmware, ampereone a144-24x firmware, ampereone a144-26m firmware +10 more +12 moreAmpere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and...4.6 Medium
- cteraServer-Side Request Forgery (SSRF) vulnerability in Ctera Portal 8.1.x (8.1.1417.24) allows...7.5 High
- mercurycom d196g firmwareMercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function...9.8 Critical
- mercurycom d196g firmwareMercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function...9.8 Critical
- linksys e5600 firmwareA stored cross-site scripting (XSS) vulnerability in the page_save component of Linksys E5600 V1...6.1 Medium
- autodesk shared componentsMODEL File Parsing Out-of-Bounds Write Vulnerability7.8 High
- autodesk shared componentsMODEL File Parsing Out-of-Bounds Write Vulnerability7.8 High
- autodesk autocad, shared components +1 moreMultiple Vulnerabilities in Certain Autodesk Products7.8 High
- autodesk shared componentsCATPART File Parsing Memory Corruption Vulnerability7.8 High
- autodesk shared componentsMODEL File Parsing Out-of-Bounds Write Vulnerability7.8 High
- autodesk shared componentsMODEL File Parsing Memory Corruption Vulnerability7.8 High
- autodesk shared componentsMODEL File Parsing Memory Corruption Vulnerability7.8 High
- autodesk shared componentsCATPART File Parsing Out-of-Bounds Write Vulnerability7.8 High
- autodesk shared componentsCATPRODUCT File Parsing Out-of-Bounds Read Vulnerability7.8 High
- autodesk autocad, shared components +1 moreMultiple Vulnerabilities in Certain Autodesk Products7.8 High
- autodesk autocad, shared components +1 moreCATPRODUCT File Parsing Heap-Based Overflow Vulnerability7.8 High
- autodesk shared componentsSLDPRT File Parsing Out-of-Bounds Read Vulnerability7.8 High
- autodesk shared componentsSLDPRT File Parsing Out-of-Bounds Read Vulnerability7.8 High
- trailofbits ficklingFickling has Code Injection vulnerability via pty.spawn()7.1 High
- autodesk shared componentsPRT File Parsing Memory Corruption Vulnerability7.8 High
- autodesk shared componentsSLDPRT File Parsing Memory Corruption Vulnerability7.8 High
- weblateWeblate has Server-Side Request Forgery vulnerability5.0 Medium
- trailofbits ficklingFickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list7.1 High
- autodesk shared componentsCATPRODUCT File Parsing Out-of-Bounds Read Vulnerability7.8 High
- autodesk shared componentsPRT File Parsing Out-of-Bounds Read Vulnerability7.8 High
- autodesk shared componentsPRT File Parsing Out-of-Bounds Read Vulnerability7.8 High
- autodesk shared componentsSLDPRT File Parsing Memory Corruption Vulnerability7.8 High
- code-projects content management system, ctcms project ctcms +1 moreCTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine5.3 Medium
- autodesk shared componentsCATPART File Parsing Out-of-Bounds Read Vulnerability7.8 High
- freshrssFreshRSS vulnerable to authenticated RCE via path traversal inside include()7.4 High
- code-projects content management system, ctcms project ctcms +1 moreCTCMS Content Management System Backend System Configuration Ct_Config.php code injection5.1 Medium
- code-projects content management system, ctcms project ctcms +1 moreCTCMS Content Management System Backend App Configuration Ct_App.php save code injection5.1 Medium
- hitachi vantara pentaho data integration and analyticsHitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data8.8 High
- hitachi vantara pentaho data integration and analyticsHitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information5.3 Medium
- weblateWeblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)4.3 Medium
- weblateWeblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration5.3 Medium
- Show moreLoading…