CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- advantech webaccess/scada, webaccess\/scada +1 moreAdvantech WebAccess/SCADA SQL Injection5.3 Medium
- advantech webaccess/scada, webaccess\/scada +1 moreAdvantech WebAccess/SCADA Absolute Path Traversal5.3 Medium
- bullwall ransomware containmentBullWall Ransomware Containment file count detection bypass5.3 Medium
- advantech webaccess/scada, webaccess\/scada +1 moreAdvantech WebAccess/SCADA Unrestricted Upload of File with Dangerous Type8.7 High
- bullwall ransomware containmentBullWall Ransomware Containment hard-coded folder exclusions8.7 High
- bullwall ransomware containmentBullWall Ransomware Containment incomplete file inspection6.9 Medium
- advantech webaccess/scada, webaccess\/scada +1 moreAdvantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted Directory7.2 High
- avahiAvahi: simple protocol server ignores accepts unlimited connections and logs failures without limit5.5 Medium
- inductive automation ignitionInductive Automation Ignition Execution with Unnecessary Privileges7.3 High
- campcodes advanced voting management systemCampcodes Advanced Voting Management System Password voters_edit.php improper authorization5.3 Medium
- alfonzm codigo markdown editorCodigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown File8.4 High
- hubstaffHubstaff 1.6.13 and 1.6.14 DLL Search Order Hijacking via wow64log Library8.5 High
- kentico xperienceKentico Xperience <= 13.0.158 Checkbox Form Component Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.158 Shipping Options Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.159 Form Validation Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.159 Authentication Information Disclosure6.9 Medium
- kentico xperienceKentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.162 Rich Text Editor Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.164 Cookie Security Configuration6.9 Medium
- easyphp webserverEasyPHP Webserver 14.1 Path Traversal via Directory Traversal Sequences7.1 High
- glpi-project glpiGLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint6.9 Medium
- leefish file thingieFile Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution9.4 Critical
- easyphp webserverEasyPHP Webserver 14.1 Remote Code Execution9.3 Critical
- tinywebgalleryTinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter5.1 Medium
- iwind rockmongoRockMongo 1.1.7 Stored Cross-Site Scripting Vulnerability via Multiple Parameters5.1 Medium
- tuzitio cameleon cms, camaleon cms +1 moreCameleon CMS 2.7.4 Authenticated Persistent Cross-Site Scripting via Post Creation5.1 Medium
- codester wbiz deskWBiz Desk 1.2 SQL Injection Vulnerability via ticket.php Parameter5.3 Medium
- kentico xperienceKentico Xperience <= 12.0.98 GetResource Handler Denial of Service8.7 High
- kentico xperienceKentico Xperience <= 13.0.109 Page Preview Reflected XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.101 Localization Application Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.120 Administration Interface Reflected XSS5.1 Medium
- kentico xperienceKentico Xperience <= 12.0 Portal Engine Form Control Information Disclosure6.9 Medium
- kentico xperienceKentico Xperience <= 13.0.56 File Upload Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.71 Form Emails HTML Injection5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.74 Form Configuration Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.79 Routing Engine CRLF Injection6.9 Medium
- kentico xperienceKentico Xperience <= 13.0.88 Rich Text Editor Reflected XSS5.1 Medium
- kentico xperienceKentico Xperience <= 13.0.92 Email Marketing Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 12.0.102 URL Hashing Cryptography Vulnerability6.9 Medium
- kentico xperienceKentico Xperience <= 13.0.52 Online Marketing Macros SQL Injection8.7 High
- kentico xperienceKentico Xperience <= 12.0.49 File Upload Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 10 Administrator Access Control Bypass8.6 High
- kentico xperienceKentico Xperience <= 12.0.90 Administration Interface Stored XSS5.1 Medium
- kentico xperienceKentico Xperience <= 12.0.0 User Widget Information Disclosure5.3 Medium
- kentico xperienceKentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload8.7 High
- kentico xperienceKentico Xperience <= 12.0.47 Virtual Context Information Disclosure5.1 Medium
- palantir com.palantir.controlpanel:control-panelInsufficient permission checks when pre-enrolling users Summary4.1 Medium
- aiven myhoardMyhoard logs backup encryption key in plain text7.1 High
- lerouxyxchire client database management systemSourceCodester Client Database Management System Leads Generation user_leads.php unrestricted upload5.3 Medium
- freshrssFreshRSS has Logout CSRF that Leads to DoS via <track src>5.3 Medium
- Show moreLoading…