CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- projectsendProjectSend r1605 CSV Injection via User Account Export Functionality6.2 Medium
- xenforoXenforo 2.2.13 Authenticated Stored Cross-Site Scripting via Smilie Categories5.1 Medium
- osc ondemand, open ondemand +1 moreOpen OnDemand affected by Apache proxy passing sensitive headers7.6 High
- anisha online appointment booking systemcode-projects Online Appointment Booking System deletemanagerclinic.php sql injection6.9 Medium
- storybookStorybook manager bundle may expose environment variables during build7.3 High
- opensourcepos open source point of sale, opensourcepos +1 moreopensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation8.8 High
- opensourcepos open source point of sale, opensourcepos +1 moreopensourcepos has a Cross-site Scripting vulnerability8.1 High
- lfprojects model context protocol servers, modelcontextprotocol servers +1 moremcp-server-git has missing path validation when using --repository flag6.4 Medium
- lfprojects model context protocol servers, modelcontextprotocol servers +1 moremcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files6.3 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System updateproduct.php sql injection6.9 Medium
- freerdpPotential Heap Out-of-Bounds Read in freerdp_certificate_data_hash_ via Unsafe _snprintf Usage6.6 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to Stored XSS - Group name > Person Listing9.2 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeover6.2 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php9.3 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php2.0 Low
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL injection in EditEventAttendees.php9.6 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in eGive Import Feature7.2 High
- churchcrm, churchcrm crm +1 moreChurchCRM discloses database information on error message10.0 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to RCE with database restore functionality9.1 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM SQL Injection Vulnerability7.4 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking9.3 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking8.5 High
- capstone-engine capstoneCapstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow4.8 Medium
- capstone-engine capstoneCapstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow4.8 Medium
- homarrHomarr: missing input sanitization and possible privilege escalation through ldap search query injection7.5 High
auth0/wordpressPackagistAuth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency6.8 Mediumauth0/symfonyPackagistAuth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK6.8 Mediumauth0/loginPackagistAuth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency6.8 Medium- auth0 auth0-php, laravel-auth0, symfony +1 more +3 moreAuth0-PHP SDK has Improper Audience Validation6.8 Medium
- apple macosThe issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2...5.5 Medium
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.2. An app...8.8 High
- apple macosThe issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreA permissions issue was addressed with additional restrictions. This issue is fixed in watchOS 26...3.3 Low
- apple ipados, macos, safari +3 more +5 moreThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18...4.3 Medium
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An...7.8 High
- apple ipados, macos, tvos +4 more +6 moreMultiple memory corruption issues were addressed with improved input validation. This issue is...5.7 Medium
- apple ipados, macos, safari +6 more +8 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in...8.8 High
- apple ipados, ios and ipados, iphone os +2 moreA logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and...5.5 Medium
- apple macos, safari +1 moreThis issue was addressed with improved URL validation. This issue is fixed in macOS Tahoe 26.2,...9.8 Critical
- apple ipados, macos, visionos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in visionOS...5.5 Medium
- apple ipados, macos, safari +5 more +7 moreA race condition was addressed with improved state handling. This issue is fixed in watchOS 26.2,...3.1 Low
- hcl software bigfix remote control, hcltechsw hcl devops deploy, hcl launch +2 moreHCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)3.7 Low
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.2 and...5.5 Medium
- apple ipados, macos, safari +2 more +4 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in...4.3 Medium
- apple ipados, macos, visionos +2 more +4 moreA configuration issue was addressed with additional restrictions. This issue is fixed in visionOS...9.8 Critical
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An...5.5 Medium
- apple ipados, macos, safari +3 more +5 moreA type confusion issue was addressed with improved state handling. This issue is fixed in Safari...4.3 Medium
- apple ipados, macos, safari +3 more +5 moreA buffer overflow issue was addressed with improved memory handling. This issue is fixed in...4.3 Medium
- apple macos, safari +1 moreThe issue was addressed with additional permissions checks. This issue is fixed in macOS Tahoe 26...5.5 Medium
- apple ipados, macos, watchos +2 more +4 moreA logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26...3.3 Low
- Show moreLoading…