CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- opennetworking upfA denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up...7.5 High
- free5gcThe free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session...7.5 High
- free5gcAn issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a...7.5 High
- open5gsAn issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session...7.5 High
- sourcefabric phonieboxAn insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi...7.5 High
- tomaszdunia twittodonAn insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon...7.5 High
- yohanawi hotel management systemA Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit...6.1 Medium
- craigtaub phpmsadminA SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An...5.4 Medium
- craigtaub phpmsadminA Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the...5.4 Medium
- mintplexlabs anythingllmAn authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces...5.3 Medium
- ollamaOllama Platform has missing authentication enabling attackers to perform model management operations9.8 Critical
- langgenius difyA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...9.1 Critical
- difyDify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send...4.3 Medium
- langgenius difyA Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in...9.1 Critical
- langgenius difyDefault credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker...9.8 Critical
- linkdingCross-Site Request Forgery (CSRF) Leading to Account Takeover via SVG File Upload8.2 High
- zzcmsZZCMS Backend Website Settings siteconfig.php stripfxg code injection5.1 Medium
- nicotsx zerobyteZerobyte has Authentication Bypass by Primary Weakness9.1 Critical
- zzcmsZZCMS User Data Storage user_save.php cleartext storage in file5.1 Medium
- carmelo simple stock systemcode-projects Simple Stock System checkuser.php sql injection5.3 Medium
- zedZed IDE MCP Context Server Configuration Arbitrary Code Execution7.8 High
- powerstonegh affiliate meAffiliate Me 5.0.1 SQL Injection Vulnerability via Admin Panel8.7 High
- zedZed IDE LSP Binary Configuration Arbitrary Code Execution7.8 High
- s9y serendipitySerendipity 2.4.0 Authenticated Remote Code Execution via File Upload8.7 High
- s9y serendipitySerendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation5.1 Medium
- revive-adserver revive adserver, revive-adserver +1 moreRevive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced Settings5.1 Medium
- projectsendProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability7.1 High
- phpmyfaqphpMyFAQ 3.1.12 CSV Injection via User Profile Export6.2 Medium
- php-fusion phpfusionPHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload5.1 Medium
- phpjabbers simple cmsPHPJabbers Simple CMS 5.0 Stored Cross-Site Scripting via Section Creation5.1 Medium
- phpjabbers simple cmsPHPJabbers Simple CMS 5.0 SQL Injection via Column Parameter8.7 High
- ulicmsUliCMS 2023.1 Stored Cross-Site Scripting via SVG File Upload5.1 Medium
- ulicmsUliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar Upload8.7 High
- ulicmsUliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creation9.3 Critical
- tinywebgalleryTinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload9.3 Critical
- sitemagic cms, sitemagiccms +1 moreSitemagicCMS 4.4.3 Remote Code Execution via Unrestricted File Upload8.7 High
- podcastgenerator, podcastgenerator podcast generator +1 morePodcastGenerator Stored Cross-Site Scripting via Podcast Title Field5.1 Medium
- podcastgenerator, podcastgenerator podcast generator +1 morePodcastGenerator Stored Cross-Site Scripting via Freebox Content Field5.1 Medium
- podcastgenerator, podcastgenerator podcast generator +1 morePodcastGenerator Stored Cross-Site Scripting via Episode Title Field5.1 Medium
- zenphotoZenphoto 1.6 Stored Cross-Site Scripting via User Postal Code Field5.1 Medium
- zenphotoZenphoto 1.6 Stored Cross-Site Scripting via Album Description5.1 Medium
- ulicmsUliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability9.3 Critical
- rukovoditelRukovoditel 3.3.1 CSV Injection via User Account Export6.2 Medium
- binisoft usb flash drives controlUSB Flash Drives Control 4.1.0.0 Unquoted Service Path Privilege Escalation8.5 High
- textpattern, textpattern cms, tmrswrr textpattern cms +2 moreTextpattern CMS 4.8.8 Authenticated Stored Cross-Site Scripting via Article Excerpt5.1 Medium
- wbce cms, wbce-cms wbce cms +1 moreWBCE CMS 1.6.1 Stored Cross-Site Scripting via Page Content5.1 Medium
- wbce cms, wbce-cms wbce cms +1 moreWBCE CMS 1.6.1 SVG File Content Cross-Site Scripting5.1 Medium
- belden hisecosHiSecOS 04.0.01 Privilege Escalation via User Role Modification8.7 High
- bludit backup plugin, bludit +1 moreBludit < 3.13.0 Authenticated Arbitrary File Download via Backup Plugin7.1 High
- projectsendProjectSend r1605 Stored Cross-Site Scripting via Custom Assets Page5.1 Medium
- Show moreLoading…