CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- hcl software bigfix remote control, hcltechsw hcl devops deploy, hcl launch +2 moreHCL BigFix Remote Control is vulnerable to an insecure CSP configuration4.7 Medium
- jupyter nbconvertnbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows8.5 High
- riot-os riotRIOT OS has buffer overflow in gnrc_ipv6_ext_frag_reass1.7 Low
- aws s3 encryption client for goAmazon S3 Encryption Client has a Key Commitment Issue6.0 Medium
- aws s3 encryption client for javaAmazon S3 Encryption Client for Java has a Key Commitment Issue6.0 Medium
- aws sdk for rubyAWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue6.0 Medium
- aws sdk for phpAWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue6.0 Medium
- aws sdk for c++aws-sdk-cpp security update6.0 Medium
- aws s3 encryption client for .netAmazon S3 Encryption Client for .NET has a Key Commitment Issue6.0 Medium
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary Video Rotation5.3 Medium
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary Comment Image Upload8.7 High
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary File Deletion8.7 High
- world wide broadcast network avideoAVideo < 20.1 IDOR Arbitrary File Upload8.7 High
- world wide broadcast network avideoAVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion9.3 Critical
- lfprojects model context protocol servers, modelcontextprotocol servers +1 moremcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations6.5 Medium
- world wide broadcast network avideoAVideo < 20.1 Open Redirect via cancelUri Parameter4.8 Medium
- world wide broadcast network avideoAVideo < 20.1 Open Redirect via siteRedirectUri Parameter4.8 Medium
- world wide broadcast network avideoAVideo < 20.1 System Path Disclosure via Public API6.9 Medium
- world wide broadcast network avideoAVideo < 20.1 User Information Disclosure via Public API6.9 Medium
- riot-os riotRIOT-OS has NULL pointer dereference in gnrc_ipv6_ext_frag_reass1.7 Low
- churchcrm, churchcrm crm +1 moreChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control8.3 High
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in User Editor via `type` Parameter Key7.2 High
- churchcrm, churchcrm crm +1 moreSQL Injection in Event List via `WhichType` Parameter8.8 High
- churchcrm, churchcrm crm +1 moreChurchCRM has unauthenticated RCE in its Install Wizard10.0 Critical
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass4.3 Medium
- livecomposer live composer – free wordpress website builderLive Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting6.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'6.4 Medium
- mattermost, mattermost desktop +1 moreMattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store3.9 Low
- mattermost, mattermost server +1 moreLack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation3.7 Low
- mattermost, mattermost desktop +1 moreMattermost Desktop App logging sensitive information and fails to clear data on server deletion3.3 Low
- mattermost, mattermost server +1 moreDoS in Calls plugin via malformed UTF-8 in WebSocket request6.5 Medium
- bmeme http client managerHTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-1267.5 High
- cisco asyncos, secure email, secure email and web manager +1 more +3 moreCisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability10.0 Critical
- johnson controls openblue workplace (formerly fm systems)OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)6.5 Medium
- johnson control istar ultra, istar ultra se, istar ultra g2, istar ultra g2 se, istar edge g2iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - setFaultDebounce8.7 High
- f5 nginx ingress controllerNGINX Ingress Controller vulnerability8.7 High
helmopenSUSESecurity update for helmNo score- ercom cryptoboxCSRF in Ercom Cryptobox administration console0.6 Low
python39openSUSE,python39-coreopenSUSE,python39-documentationopenSUSE +2 moreSecurity update for python39No score- johnson controls istarex, istar edge, istar ultra lt, istar ultra , istar ultra seiSTAR- Improper Validation of Certificate Expiration7.1 High
- radiometer medical aps abl800 basic and abl800 flex analyzers, abl90 flex and abl90 flex plus analyzers, aqt90 flex analyzers +2 moreRemote Code Execution Vulnerability in Radiometer Products7.2 High
- radiometer medical aps abl800 basic and abl800 flex analyzers, abl90 flex and abl90 flex plus analyzers, aqt90 flex analyzers +2 moreCredential Disclosure vulnerability in Radiometer Products8.4 High
- mattermost, mattermost server +1 moreOpen redirect in error page when link opened in new tab3.1 Low
- mattermost, mattermost server +1 moreMattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijacking3.0 Low
- mattermost, mattermost server +1 moreCSRF Allows Call Initiation and Message Delivery4.3 Medium
- apache software foundation airflow providers edge3, apache apache-airflow-providers-edge3 +1 moreApache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 29.8 Critical
- radiometer medical aps abl800 basic and abl800 flex analyzers, abl9 analyzers, abl90 flex and abl90 flex plus analyzers +1 more +3 morePrivilege boundary violation in Radiometer Products6.8 Medium
- gg soft software services inc. paperworkIDOR in GG Soft's PaperWork7.1 High
buildahopenSUSESecurity update for buildahNo score- proliz software ltd. obs (student affairs information system)0Reflected XSS in Proliz's OBS6.3 Medium
- Show moreLoading…