CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- slims project slimsReflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling...6.1 Medium
- keepassxc keepassxc-browserKeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents...7.1 High
- entrinsik informerThere is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows...2.8 Low
- portrait dell color managementAn issue was discovered in the Portrait Dell Color Management application through 3.3.008 for...7.8 High
- portrait dell color managementThe Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,7.8 High
- conda miniconda3Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability...7.8 High
- anaconda anaconda3Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability...7.8 High
- python-jose project python-joseDuplicate Advisory: python-jose denial of service via compressed JWE content5.3 Medium
- netaxis api orchestratorNetaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).9.8 Critical
- google chromeOut of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote...8.8 High
- google chromeUse after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to...8.8 High
- nagios xiNagios XI Privilege Escalation via Writable PHP Include Executed with Sudo8.6 High
- glpi-project glpiGLPI vulnerable to unauthorized access to restricted Knowledge Base items through the API6.5 Medium
- grassroot dicom dicom, malaterre grassroots dicom +1 moreAn out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of...7.4 High
- grassroot dicom dicom, malaterre grassroots dicom +1 moreAn out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of...7.4 High
- grassroot dicom dicom, malaterre grassroots dicom +1 moreAn out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality...7.4 High
- grassroot dicom dicom, malaterre grassroots dicom +1 moreAn out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of...7.4 High
- güralp systems certimus series, fortimus series, minimus series +2 moreGüralp Systems Fortimus Series, Minimus Series, and Certimus Series have an Allocation of Resources Without Limits or Throttling vulnerability6.9 Medium
- emiago sipgoSIPGO library has response DoS vulnerability via nil pointer dereference8.7 High
- better-authBetter Auth before 1.4.5 Path Normalization Bypass via rou38.8 High
- abhinavxd libredeskImproper Neutralization of HTML Tags in a Web Page in libredesk7.3 High
- fortra core privileged access manager (boks)Weak Password Hash in Core Privileged Access Manager (BoKS)6.2 Medium
- arista networks eosA specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted7.1 High
- tp-link systems inc. tapo appPassword Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network7.0 High
- openedx edx-platformCourseLimitedStaff Role Allows Studio Access9.9 Critical
- expr-lang exprExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 High
- vitejs vite-plugin-react@vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on Development7.5 High
- sebhildebrandt systeminformationCommand Injection in fsSize() on Windows8.1 High
- parse-community parse-serverParse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter8.3 High
- tox-dev filelockfilelock has TOCTOU race condition that allows symlink attacks during lock file creation6.3 Medium
- claris filemaker serverAn authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator...5.4 Medium
- claris filemaker serverApache Commons Text versions prior to 1.10.0 included interpolation features that could be abused...9.8 Critical
- claris filemaker serverTo enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS...5.3 Medium
- facelessuser pymdown extensions, pymdown-extensions +1 morePyMdown Extensions has ReDOS bug in Figure Capture extension2.7 Low
- nvidia resiliency extensionNVIDIA Resiliency Extension for Linux contains a vulnerability in the checkpointing core, where...7.8 High
- nvidia resiliency extensionNVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an...8.4 High
- nvidia isaac labNVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this...9.0 Critical
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to...7.3 High
- spipSpip 4.1.10 Admin Account Spoofing via Malicious SVG Upload4.8 Medium
- d-link dap-1325, dlink dap-1325 firmware +1 moreD-Link DAP-1325 Hardware A1 Unauthenticated Configuration Download8.7 High
- pimpmylog, potsky pimp my log +1 morePimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint9.3 Critical
- websitebakerWebsiteBaker 2.13.3 Stored Cross-Site Scripting via SVG File Upload5.1 Medium
- websitebakerWebsiteBaker 2.13.3 Directory Traversal via Media Delete Endpoint7.0 High
- unknown wbce cms, wbce cms +1 moreWBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability7.1 High
- podcastgenerator, podcastgenerator podcast generator +1 morePodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection5.1 Medium
- rukovoditelRukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Configuration5.1 Medium
- rukovoditelRukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via Comments5.1 Medium
- dulldusk phpfm, phpfilemanager +1 morephpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerability9.3 Critical
- trpctRPC has possible prototype pollution in `experimental_nextAppDirCaller`8.5 High
- Show moreLoading…