CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- wpcodefactory download plugins and themes in zip from dashboardDownload Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival4.3 Medium
- dylanjkotze zephyr project managerZephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery4.9 Medium
- kstover ninja forms – the contact form builder that grows with you, ninjaforms ninja forms +1 moreNinja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token7.5 High
- mateuszgbiorczyk converter for media – optimize images | convert webp & avifConverter for Media <= 6.3.2 - Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-attachment REST Endpoint4.3 Medium
- wplegalpages cookie banner for gdpr / ccpa – wplp cookie consentCookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion5.3 Medium
- tecno pova6 pro 5g, transsion hios +1 moreFactory Mode App Exists Privilege Escalation Issue Allowing Third-Party Apps to Open ADB6.5 Medium
- wordplus better messages – live chat, chat rooms, real-time messaging & private messagesBetter Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- brechtvds wp recipe makerWP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- adreastrian wp social ninja – embed social feeds, user reviews & chat widgetsWP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 4.0.1 - Missing Authorization to Unauthenticated Plugin's Settings Disclos…6.5 Medium
- linksoftware html forms – simple wordpress forms pluginHTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- asus live update"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with...9.3 Critical
- asus armoury crateAn out-of-bounds read vulnerability has been identified in the asComSvc service. This...4.8 Medium
- asus w680 series, b460 series, b560 series +10 more +12 moreAn uncontrolled resource consumption vulnerability affects certain ASUS motherboards using Intel ...7.0 High
- growi, inc. growiCross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a...5.1 Medium
- acer listcheck.exeAcer｜ListCheck.exe - Local Privilege Escalation8.5 High
- asrock intel 500 chipset motherboard, intel 600 chipset motherboard, intel 700 chipset motherboard +1 more +3 moreASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism Failure7.0 High
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- asrockind intel 600 chipset motherboard, intel 700 chipset motherboard +1 moreMSI｜Motherboard - Protection Mechanism Failure7.0 High
- asrockind intel 600 chipset motherboard, intel 700 chipset motherboard, intel 800 chipset motherboard +3 more +5 moreGIGABYTE｜Motherboard - Protection Mechanism Failure7.0 High
- xiweicheng tms, teamwork management system +1 morexiweicheng TMS create createComment cross site scripting4.8 Medium
- wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patternsEssential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure4.3 Medium
- mitsubishi electric corporation gt designer3 version1 (got1000), gt designer3 version1 (got2000) +1 moreInformation Disclosure Vulnerability in GT Designer35.1 Medium
- fuji electric monitouch v-sft-6Fuji Electric Monitouch V-SFT-6 Out-of-bounds Write8.4 High
- arcadia technology, llc crafty controllerImproper Neutralization of Special Elements Used in a Template Engine in Crafty Controller9.9 Critical
- arcadia technology, llc crafty controllerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller7.1 High
mosquittoOSS-FuzzBad-cast to UT_hash_bucket' (aka 'struct UT_hash_bucket')password_file__cleanupNo score- drivelockAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25...6.1 Medium
- drivelockAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25...9.8 Critical
- drivelockAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1...7.8 High
- drivelockAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through...9.8 Critical
- drivelockAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1...7.5 High
- drivelockAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1...5.3 Medium
- drivelockAn issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock...9.6 Critical
- drivelockAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1...9.9 Critical
- angeljudesuarez covid tracking system using qr-codeA SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID...7.3 High
- ritecmsA local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary...7.5 High
- ritecmsA Cross-Site Request Forgery (CSRF) in the page creation/editing function of RiteCMS v3.1.0...6.8 Medium
- ritecmsRiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE)...7.2 High
- ritecmsIncorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to...7.5 High
- ritecmsA reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to...6.1 Medium
- ritecmsRiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.5.3 Medium
- pagekitPagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component9.8 Critical
- pagekitPagekit CMS is vulnerable to OS Command Injection via Storage component9.9 Critical
- tenda ac10 firmwareA Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0...6.5 Medium
- tenda ac10 firmwareA Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0...9.8 Critical
- nardamiteq upc2 firmwareCSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker...8.8 High
- opensourcepos open source point of saleA Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of...6.1 Medium
- opensourcepos open source point of saleA Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of...7.2 High
- opensourcepos open source point of saleA Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point...7.2 High
- netun helpflash iot firmwareThe OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware...6.6 Medium
- Show moreLoading…