CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- linuxjfs: fix uninitialized waitqueue in transaction manager7.8 High
- linuxgpiolib: fix invalid pointer access in debugfs7.8 High
- linuxnet: ipv6: fix field-spanning memcpy warning in AH output4.8 Medium
- linuxceph: fix multifs mds auth caps issue8.8 High
- linuxdrm/sysfb: Do not dereference NULL pointer in plane reset7.8 High
- linuxperf/x86/intel: Fix KASAN global-out-of-bounds warning7.8 High
- linuxriscv: stacktrace: Disable KASAN checks for non-current tasks7.1 High
- linuxnet/smc: fix general protection fault in __smc_diag_dumpNo score
- linuxspi: rockchip-sfc: Fix DMA-API usage7.8 High
- linuxsysfs: check visibility before changing group attribute ownership4.8 Medium
- linuxdrm/amd/display: increase max link count and fix link->enc NULL pointer access7.8 High
- linuxarm64: mte: Do not warn if the page is already tagged in copy_highpage()2.0 Low
- linuxplatform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock initNo score
- linuxhfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()5.3 Medium
- linuxnet/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ9.8 Critical
- linuxhfs: validate record offset in hfsplus_bmap_alloc7.8 High
- linuxslab: Avoid race on slab->obj_exts in alloc_slab_obj_extsNo score
- linuxnet: enetc: fix the deadlock of enetc_mdio_lock7.5 High
- linuxarch_topology: Fix incorrect error check in topology_parse_cpu_capacity()7.8 High
- xiongwei smart catering cloud platformXiongwei Smart Catering Cloud Platform dish_trade_detail_get sql injection5.3 Medium
- wavestore server, video management software server +1 moreArbitrary File Read and Delete via Path Traversal in WaveStore Server8.6 High
- wavestore server, video management software server +1 moreArbitrary File Read and Delete via Path Traversal in WaveStore Server5.1 Medium
- wavestore server, video management software server +1 moreOS Command Injection via Path Traversal in WaveStore Server8.6 High
- red hat openshift container platform 4Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanism6.4 Medium
bincodecrates.ioBincode is unmaintainedNo score- menulux software inc. mobile appIDOR in Menulux Software's Mobile App7.5 High
- publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categoriesSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure4.3 Medium
- elemntor elementor website builder – more than just a page builderElementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path6.4 Medium
- milestone systems xprotect vmsXProtect MIP API Missing Authorization5.3 Medium
- whyun wpcom memberWPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP8.1 High
- radykal fancy product designerFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition6.5 Medium
- merkulove huger for elementorWordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability5.4 Medium
- merkulove modalier for elementorWordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability5.4 Medium
- merkulove reformer for elementorWordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability5.4 Medium
- merkulove buttoner for elementorWordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerability5.4 Medium
- nitesh ultimate auctionWordPress Ultimate Auction plugin <= 4.3.3 - Broken Access Control vulnerability5.4 Medium
- meks quick plugin disablerWordPress Meks Quick Plugin Disabler plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- semrush cy ltd content toolkitWordPress Semrush Content Toolkit plugin <= 1.1.32 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- saad iqbal user avatar - reloadedWordPress User Avatar - Reloaded plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themenectar salient shortcodesWordPress Salient Shortcodes plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themenectar salient portfolioWordPress Salient Portfolio theme <= 1.8.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- select-themes stockholmWordPress Stockholm theme <= 9.14.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- select-themes stockholm coreWordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- g5theme essential real estateWordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- vektor,inc. vk google job posting managerWordPress VK Google Job Posting Manager plugin <= 1.2.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- select-themes stockholmWordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerability7.5 High
- select-themes stockholm coreWordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerability7.5 High
- pencidesign soledadWordPress Soledad theme <= 8.7.0 - Local File Inclusion vulnerability7.5 High
- liquidthemes hub coreWordPress Hub Core plugin < 6.0.2 - Local File Inclusion vulnerability7.5 High
- thememove minimogwpWordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability7.5 High
- Show moreLoading…