CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- ancorathemes gardisWordPress Gardis theme <= 1.2.13 - Local File Inclusion vulnerability8.1 High
- ancorathemes glamchicWordPress GlamChic theme <= 1.0.11 - Local File Inclusion vulnerability8.1 High
- digitalme eroomWordPress eRoom plugin <= 1.5.6 - Sensitive Data Exposure vulnerability5.8 Medium
- e4jvikwp vikbooking hotel booking engine & pmsWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Sensitive Data Exposure vulnerability5.9 Medium
- jetmonsters restaurant menu by motopressWordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerability6.5 Medium
- a wp life login page customizer – customizer login page, admin page, custom designWordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin <= 2.1.1 - Broken Access Control vulnerability6.5 Medium
- silverplugins217 custom fields account registration for woocommerceWordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability7.2 High
- ancorathemes struxWordPress Strux theme <= 1.9 - Local File Inclusion vulnerability8.1 High
- ancorathemes lymcoinWordPress Lymcoin theme <= 1.3.12 - Local File Inclusion vulnerability8.1 High
- ancorathemes lettuceWordPress Lettuce theme <= 1.1.7 - Local File Inclusion vulnerability8.1 High
- ancorathemes palladioWordPress Palladio theme <= 1.1.10 - Local File Inclusion vulnerability8.1 High
- ancorathemes monyxiWordPress Monyxi theme <= 1.1.8 - Local File Inclusion vulnerability8.1 High
- ancorathemes hananiWordPress Hanani theme <= 1.2.11 - Local File Inclusion vulnerability8.1 High
- ancorathemes jack wellWordPress Jack Well theme <= 1.0.14 - Local File Inclusion vulnerability8.1 High
- ancorathemes ludos paradiseWordPress Ludos Paradise theme <= 2.1.3 - Local File Inclusion vulnerability8.1 High
- ancorathemes kings & queensWordPress Kings & Queens theme <= 1.1.16 - Local File Inclusion vulnerability8.1 High
- ancorathemes graciozaWordPress Gracioza theme <= 1.0.15 - Local File Inclusion vulnerability8.1 High
- ancorathemes mamitaWordPress Mamita theme <= 1.0.9 - Local File Inclusion vulnerability8.1 High
- ancorathemes militarologyWordPress Militarology theme <= 1.0.15 - Local File Inclusion vulnerability8.1 High
- ancorathemes shieldgroupWordPress ShieldGroup theme <= 2.13 - Local File Inclusion vulnerability8.1 High
- the african boss get cashWordPress Get Cash plugin <= 3.2.3 - Broken Access Control vulnerability6.5 Medium
- roxnor popupkitWordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerability8.5 High
- codepeople contact form emailWordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- codename065 download managerDownload Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure4.3 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode6.4 Medium
- ruijie networks co., ltd. ap180(ja) v1.xx, ap180(ja) v2.xx, ap180(jp) v1.xx +6 more +8 moreRG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd....8.6 High
- biopythonBiopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez4.9 Medium
- qualcomm aqt1000 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +43 more +45 moreUntrusted Pointer Dereference in Camera7.8 High
- qualcomm qam8255p firmware, qam8620p firmware, qam8650p firmware +21 more +23 moreBuffer Copy Without Checking Size of Input in Boot9.0 Critical
- qualcomm fastconnect 6900 firmware, fastconnect 7800 firmware, qca0000 firmware +16 more +18 moreUse After Free in DSP Service7.8 High
- qualcomm csr8811 firmware, ipq8070 firmware, ipq8070a firmware +42 more +44 moreUntrusted Pointer Dereference in TZ Firmware6.5 Medium
- qualcomm ar8035 firmware, csra6620 firmware, csra6640 firmware +176 more +178 moreInteger Overflow or Wraparound in Audio7.8 High
- qualcomm ar8031 firmware, ar8035 firmware, csra6620 firmware +109 more +111 moreUse After Free in Automotive Linux OS7.8 High
- qualcomm ar8031 firmware, ar8035 firmware, csra6620 firmware +113 more +115 moreBuffer Copy Without Checking Size of Input in Core Services7.8 High
- qualcomm 9206 lte modem firmware, apq8017 firmware, aqt1000 firmware +211 more +213 moreOut-of-bounds Write in Audio7.8 High
- qualcomm ar8035 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +116 more +118 moreExposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS6.7 Medium
- qualcomm csra6620 firmware, csra6640 firmware, fastconnect 6200 firmware +109 more +111 moreUse After Free in Video7.8 High
- debian freedomboxFreedombox before 25.17.1 does not set proper permissions for the backups-data directory,...3.2 Low
- awsmin embed any document – embed pdf, word, powerpoint and excel filesEmbed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ruoyiy_project RuoYi getnames code injection5.3 Medium
- offis dcmtkOFFIS DCMTK dcmqrscp dcmqrdbi.cc startMoveRequest null pointer dereference4.8 Medium
mongooseOSS-FuzzHeap-buffer-overflow in rx_icmpNo score- bulwarkmail webmailRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS)...7.2 High
- bulwarkmail webmailRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure...7.2 High
- simplemachines simple machines forumA stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows...6.1 Medium
- opennetworking upfA denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version...7.5 High
- opennetworking upfA denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version...7.5 High
- linuxfoundation upfA denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version...7.5 High
- opennetworking upfA denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version...7.5 High
- opennetworking upfA denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc...7.5 High
- Show moreLoading…