CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- tp-link systems inc. wr940n and wr941ndUninitialized Pointer Vulnerability in TP-Link WR940N and WR941ND6.8 Medium
- tp-link systems inc. wa850re, tp-link tl-wa850re firmware +1 moreConfiguration Disclosure Vulnerability in TP-Link WA850RE5.7 Medium
- tp-link systems inc. wa850re, tp-link tl-wa850re firmware +1 moreCommand Injection Vulnerability in TP-Link WA850RE7.1 High
- d-link dir-605, dlink dir-605 firmware +1 moreD-Link DIR-605 Firmware Update Service command injection8.6 High
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request onSSIDChange stack-based overflow9.3 Critical
- sparkle wp construction lightWordPress Construction Light theme <= 1.6.7 - Broken Access Control vulnerability5.4 Medium
- sparkle wp fse, sparklewpthemes sparkle fse +1 moreWordPress Sparkle FSE theme <= 1.0.9 - Broken Access Control vulnerability5.4 Medium
- wp messiah ai copilotWordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerability5.0 Medium
- wp for church sermon managerWordPress Sermon Manager plugin <= 2.30.0 - Broken Access Control vulnerability5.3 Medium
- pickplugins post grid and gutenberg blocksWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- amentotech tuturnWordPress Tuturn plugin < 3.6 - Arbitrary File Download vulnerability6.5 Medium
- amentotech tuturnWordPress Tuturn plugin < 3.6 - Broken Authentication vulnerability9.8 Critical
- yuzutech krokidue to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and...8.7 High
- radiustheme radius blocksWordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.7.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pickplugins post grid and gutenberg blocksWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability6.5 Medium
- tenda wh450, wh450 firmware +1 moreTenda WH450 HTTP Request wirelessRestart stack-based overflow9.3 Critical
- campcodes supplier management systemCampcodes Supplier Management System add_retailer.php sql injection6.9 Medium
- connectwise screenconnectCertificate Signing Extension Returns Encrypted Values5.3 Medium
- ssw tinacms, tinacms\/cli, tinacms\/graphql +2 moretinacms vulnerable to arbitrary code execution7.3 High
- arduino ide, arduino-ide +1 moreArduino IDE for macOS has Insecure File Permissions4.8 Medium
- arduino ide, arduino-ide +1 moreArduino IDE for macOS has TCC Bypass via Dynamic Library Injection4.8 Medium
- wodesys wd-r608u, wdr122b v2.0, wdr28 +2 moreUnauthorized Access to files in WODESYS WD-R608U router7.1 High
- wodesys wd-r608u, wdr122b v2.0, wdr28 +2 moreMissing authorizations for admin panel password change in WODESYS WD-R608U router7.1 High
- wodesys wd-r608u, wdr122b v2.0, wdr28 +2 moreInsecure Password Storage in WODESYS WD-R608U router7.1 High
- wodesys wd-r608u, wdr122b v2.0, wdr28 +2 moreOS Command Injection in WODESYS WD-R608U router9.4 Critical
- wodesys wd-r608u, wdr122b v2.0, wdr28 +2 moreMissing Authentication for Critical Function in WODESYS WD-R608U router8.7 High
- linuxnet/sched: sch_cake: Fix incorrect qlen reduction in cake_drop6.8 Medium
- linuxscsi: imm: Fix use-after-free bug caused by unfinished delayed work7.1 High
- linuxusb: typec: ucsi: fix use-after-free caused by uec->workNo score
- ni labviewStack-based Buffer Overflow in LVResource::DetachResource() in NI LabVIEW8.5 High
- ni labviewUse-after-Free in sentry!sentry_span_set_data() in NI LabVIEW8.5 High
- utarit soliclubUse of Hard-coded Credentials in Utarit Informatics' SoliClub7.5 High
- utarit soliclubMissing Authorization in Utarit Informatics' SoliClub4.3 Medium
- ni labviewOut-of-Bounds Read in LVResFile::FindRsrcListEntry() in NI LabVIEW8.5 High
- ni labviewOut-of-Bounds Read in lvre!ExecPostedProcRecPost() in NI LabVIEW8.5 High
- ni labviewOut-of-Bounds Read in lvre!DataSizeTDR() in NI LabVIEW8.5 High
- ni labviewOut-of-Bounds Read in lvre!VisaWriteFromFile() in NI LabVIEW8.5 High
- ni labviewOut-of-Bounds Read in LVResource::DetachResource() in NI LabVIEW8.5 High
- utarit soliclubIDOR in Utarit Informatics' SoliClub7.5 High
- ni labviewOut-of-Bounds Read in LVResFile::RGetMemFileHandle() in NI LabVIEW8.5 High
- utarit soliclubSensitive Data Exposure in Utarit Informatics' SoliClub7.5 High
- ni labviewOut of Bounds Write in mgocre_SH_25_3!RevBL() in NI LabVIEW8.5 High
- mozilla firefoxMemory safety bugs fixed in Firefox 146.0.18.8 High
- mozilla firefoxUse-after-free in the Disability Access APIs component9.8 Critical
- mozilla firefox, firefox for ios +1 moreFilename spoofing via Unicode Right-to-Left Override in Firefox for iOS6.5 Medium
- utarit soliclubHardcoded Credentials in Utarit Informatics' SoliClub7.5 High
- zohocorp manageengine applications managerStored XSS6.1 Medium
- checkmkExposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule2.3 Low
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 morePath traversal in Import Arc data archive functionality in Guardian/CMC before 25.5.07.2 High
- Show moreLoading…